# Installazione Gitea su VPS OVH — copia/incolla (root/sudo)
# Obbiettivo: git.zomas.net  (Gitea dietro Apache; non tocca zomas.net / zomas.org)
# VPS: Debian 12, 4 vCPU, 7.6GB RAM
# Chi esegue: TU (root o sudo). Esegui i blocchi in ordine.

#
# ⚠️ PREREQUISITO DNS: prima del Passo 5 deve risolvere pubblicamente:
#     dig +short git.zomas.net   ->  deve tornare 145.239.94.49
#     (finché dà NXDOMAIN, SALTA il Passo 5 e resta solo in HTTP)
#

###############################################################################
# PASSO 1 — Installa Gitea (binario ufficiale + utente dedicato + sqlite)
###############################################################################

apt-get update && apt-get upgrade -y
apt-get install -y git sqlite3 curl wget

# utente di sistema dedicato (senza login)
adduser --system --group --disabled-password --home /var/lib/gitea gitea
mkdir -p /etc/gitea /var/lib/gitea/custom /var/lib/gitea/data /var/lib/gitea/log
chown -R root:gitea /etc/gitea
chown -R gitea:gitea /var/lib/gitea/
chmod -R g+rws /var/lib/gitea/
chmod -R g+rw /var/lib/gitea/

# ultima versione stabile
VERSION=$(curl -sL https://dl.gitea.com/gitea/version.json | python3 -c "import sys,json;print(json.load(sys.stdin)['latest']['version'])" 2>/dev/null || echo "1.22.0")
echo "Installazione Gitea $VERSION"
curl -sL -o /tmp/gitea "https://dl.gitea.com/gitea/$VERSION/gitea-$VERSION-linux-amd64"

# sposta e rendi eseguibile
install -o root -g root -m 755 /tmp/gitea /usr/local/bin/gitea
/usr/local/bin/gitea --version

###############################################################################
# PASSO 2 — Configurazione Gitea (app.ini)
###############################################################################

cat > /etc/gitea/app.ini <<'EOF'
RUN_USER = gitea
RUN_MODE = prod

[server]
; porta INTERNA: Apache farà da proxy verso questa
HTTP_PORT = 3000
HTTP_ADDR = 127.0.0.1
ROOT_URL  = https://git.zomas.net/
DOMAIN    = git.zomas.net
DISABLE_SSH = false
SSH_PORT = 2222
LFS_START_SERVER = true

[database]
DB_TYPE  = sqlite3
PATH     = /var/lib/gitea/data/gitea.db

[repository]
ROOT = /var/lib/gitea/data/gitea-repositories

[service]
DISABLE_REGISTRATION = false   ; metti true quando vuoi bloccare le iscrizioni esterne
EOF

chown -R gitea:gitea /etc/gitea

###############################################################################
# PASSO 3 — Servizio systemd
###############################################################################

tee /etc/systemd/system/gitea.service >/dev/null <<'EOF'
[Unit]
Description=Gitea (Git with a cup of tea)
After=syslog.target
After=network.target

[Service]
RestartSec=2s
Type=simple
User=gitea
Group=gitea
WorkingDirectory=/var/lib/gitea/
ExecStart=/usr/local/bin/gitea web --config /etc/gitea/app.ini
Restart=always
Environment=USER=gitea HOME=/var/lib/gitea GITEA_WORK_DIR=/var/lib/gitea

[Install]
WantedBy=multi-user.target
EOF

systemctl daemon-reload
systemctl enable gitea
systemctl start gitea
systemctl status gitea --no-pager | head -15

# verifica locale (deve rispondere HTTP)
curl -sI http://127.0.0.1:3000 | head -3

###############################################################################
# PASSO 4 — Virtualhost Apache (reverse proxy verso Gitea)
###############################################################################

# abilita i moduli necessario (i siti zomas.net/zomas.org NON vengono toccati)
a2enmod proxy_http proxy ssl
systemctl reload apache2

# virtualhost HTTP (redirect -> https)
cat > /etc/apache2/sites-available/git.zomas.net.conf <<'EOF'
<VirtualHost *:80>
    ServerName git.zomas.net
    Redirect permanent / https://git.zomas.net/
</VirtualHost>
EOF

# virtualhost HTTPS (proxy verso Gitea su 127.0.0.1:3000) — certbot poi aggiunge il SSL
cat > /etc/apache2/sites-available/git.zomas.net-ssl.conf <<'EOF'
<VirtualHost *:443>
    ServerName git.zomas.net
    CustomLog /var/log/apache2/git.zomas.net-access.log combined
    ErrorLog  /var/log/apache2/git.zomas.net-error.log

    ProxyPreserveHost On
    RequestHeader set Host %{HTTP_HOST}e
    ProxyRequests Off
    ProxyPass / http://127.0.0.1:3000/
    ProxyPassReverse / http://127.0.0.1:3000/
</VirtualHost>
EOF

# abilita i virtualhost (mantenendo net/org intatti)
a2ensite git.zomas.net.conf
a2ensite git.zomas.net-ssl.conf
systemctl reload apache2

# verifica: il vhost :80 deve rispondere
curl -sI http://127.0.0.1:80 -H "Host: git.zomas.net" | head -3

###############################################################################
# PASSO 5 — Certificato HTTPS con Let's Encrypt
# ⚠️ FAI SOLO QUANDO git.zomas.net risolve pubblicamente (dig +short = 145.239.94.49)
###############################################################################

# richiedi il certificato per git.zomas.net (usa il vhost :80 come challenge)
certbot --apache -d git.zomas.net
# quando ti chiede il redirect HTTP->HTTPS scegli: 2

systemctl reload apache2

# verifica finale HTTPS
curl -sI https://git.zomas.net | head -3

###############################################################################
# PRIMO ACCESSO (dopo il Passo 3, già funziona in HTTP)
###############################################################################
# Apri nel browser:  https://git.zomas.net   (o http:// se non hai ancora il passo 5)
# Al primo avvio Gitea mostra la pagina di installazione:
#   - DB:  SQLite3
#   - Path DB: /var/lib/gitea/data/gitea.db
#   - URL:  https://git.zomas.net/
#   - Crea l'account amministratore (utente final, nome, email, password)
# Si può rilanciare la procedura con:  su gitea -s /bin/bash -c "cd /var/lib/gitea && /usr/local/bin/gitea admin create-user --username admin --password 'ScegliPasswordSicura' --email you@example.com --admin"
#   (poi applica via web)
#
# Nota SSH: Gitea usa la porta 2222 per git over SSH (oltre alla web). Da client:
#   git clone ssh://git@git.zomas.net:2222/<utente>/<repo>.git

###############################################################################
# PASSO 6 — Certificati Let's Encrypt per origine (plugin dns-cloudflare)
# ⚠️ da eseguire come ROOT sul VPS. Il token CF è già in /tmp/cloudflare_tmp.ini
# Genera i cert con challenge DNS: funziona anche con i record messi "proxied".
# NON tocca i vhost esistenti di zomas.net / zomas.org (stesso --cert-name).
###############################################################################

set -ea
mkdir -p /root/.config/letsencrypt
[ -f /tmp/cloudflare_tmp.ini ] && { cp /tmp/cloudflare_tmp.ini /root/.config/letsencrypt/cloudflare.ini; chmod 600 /root/.config/letsencrypt/cloudflare.ini; } || { echo "Manca /tmp/cloudflare_tmp.ini"; exit 1; }

echo "=== 1/3 zomas.net + www ==="
certbot certonly --dns-cloudflare \
  --dns-cloudflare-credentials /root/.config/letsencrypt/cloudflare.ini \
  --dns-cloudflare-propagation-seconds 60 \
  -d zomas.net -d www.zomas.net \
  --cert-name zomas.net --non-interactive --agree-tos -m zomas@zomas.net --force-renewal

echo "=== 2/3 zomas.org + www ==="
certbot certonly --dns-cloudflare \
  --dns-cloudflare-credentials /root/.config/letsencrypt/cloudflare.ini \
  --dns-cloudflare-propagation-seconds 60 \
  -d zomas.org -d www.zomas.org \
  --cert-name zomas.org --non-interactive --agree-tos -m zomas@zomas.org --force-renewal

echo "=== 3/3 git.zomas.net ==="
certbot certonly --dns-cloudflare \
  --dns-cloudflare-credentials /root/.config/letsencrypt/cloudflare.ini \
  --dns-cloudflare-propagation-seconds 60 \
  -d git.zomas.net \
  --cert-name git.zomas.net --non-interactive --agree-tos -m zomas@zomas.net

echo "=== file generati in /etc/letsencrypt/live ==="
ls -la /etc/letsencrypt/live/
echo "=== certificati git ==="
ls -la /etc/letsencrypt/live/git.zomas.net/

###############################################################################
# PASSO 7 — (dopo aver generato i cert) Completare il vhost SSL di git
# e riabilitarlo. Il certificato git ora esiste in live/git.zomas.net.
# ⚠️ Leggi il contenuto di git.zomas.net-ssl.conf e COMPLETA il blocco
#    aggiungendo: SSLEngine on + SSLCertificateFile/Key con i path git.
#    Esempio (sostituisci tutto il contenuto del file):
###############################################################################

cat > /etc/apache2/sites-available/git.zomas.net-ssl.conf <<'EOF'
<VirtualHost *:443>
    ServerName git.zomas.net
    CustomLog /var/log/apache2/git.zomas.net-access.log combined
    ErrorLog  /var/log/apache2/git.zomas.net-error.log

    SSLEngine on
    Include /etc/letsencrypt/options-ssl-apache.conf
    SSLCertificateFile /etc/letsencrypt/live/git.zomas.net/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/git.zomas.net/privkey.pem

    ProxyPreserveHost On
    RequestHeader set Host %{HTTP_HOST}e
    ProxyRequests Off
    ProxyPass / http://127.0.0.1:3000/
    ProxyPassReverse / http://127.0.0.1:3000/
</VirtualHost>
EOF

# riabilita il vhost SSL di git (dopo aver verificato che i cert esistono)
a2ensite git.zomas.net-ssl.conf
apache2ctl configtest
systemctl reload apache2

# verifica certificato da linea di comando
curl -sk -o /dev/null -w "https git (via IP/SNI) HTTP %{http_code}\n" https://127.0.0.1 -H "Host: git.zomas.net" --resolve git.zomas.net:443:127.0.0.1

###############################################################################
# PASSO 8 — Pannello Cloudflare: attiva il proxy (arancio) SOLO sui record web
# ⚠️ NON toccare: MX, mail.*, sole, calendar, docs, _dmarc, SPF, SRV
# Metti "Proxy (arancio)" su:
#   - git.zomas.net   (già arancio)
#   - zomas.net       (A)
#   - www.zomas.net   (CNAME)
#   - zomas.org       (A)
#   - www.zomas.org   (CNAME)
# Poi in SSL/TLS -> Overview seleziona:  "Full (strict)"
###############################################################################