#!/bin/bash
set -euo pipefail

if [[ $# -lt 6 ]]; then
  echo "Uso: $0 <site_user> <domain> <db_name> <db_user> <db_pass> <mysql_root_pass> [php_version]"
  exit 1
fi

site_user="$1"
domain="$2"
db_name="$3"
db_user="$4"
db_pass="$5"
mysql_root_pass="$6"
php_version="${7:-}"

if ! [[ "$site_user" =~ ^[a-z_][a-z0-9_-]{0,31}$ ]]; then
  echo "Error: site_user invalido"
  exit 1
fi

if ! [[ "$db_user" =~ ^[a-z_][a-z0-9_]{0,31}$ ]]; then
  echo "Error: db_user invalido"
  exit 1
fi

if ! [[ "$db_name" =~ ^[a-zA-Z0-9_]+$ ]]; then
  echo "Error: db_name invalido"
  exit 1
fi

if [[ -z "$php_version" ]]; then
  php_version="$(php -r 'echo PHP_MAJOR_VERSION.".".PHP_MINOR_VERSION;' 2>/dev/null || true)"
fi

if [[ -z "$php_version" || ! -d "/etc/php/$php_version/fpm" ]]; then
  echo "Error: no se encontro PHP-FPM para la version: $php_version"
  exit 1
fi

site_dir="/var/www/html/$site_user"
pool_file="/etc/php/$php_version/fpm/pool.d/$site_user.conf"
socket_file="/run/php/php-fpm-$site_user.sock"
apache_conf="/etc/apache2/sites-available/$domain.conf"

sudo mkdir -p "$site_dir"
sudo mkdir -p "$site_dir/public"
sudo mkdir -p "$site_dir/tmp"
sudo mkdir -p "$site_dir/public/wp-content"

if id "$site_user" >/dev/null 2>&1; then
  true
else
  sudo useradd -r -d "$site_dir" -s /usr/sbin/nologin "$site_user"
fi

sudo chown -R "$site_user:$site_user" "$site_dir"
sudo chmod 750 "$site_dir"
sudo find "$site_dir" -type d -exec chmod 750 {} \;
sudo find "$site_dir" -type f -exec chmod 640 {} \;

sudo chown -R "$site_user:www-data" "$site_dir/public/wp-content"
sudo find "$site_dir/public/wp-content" -type d -exec chmod 775 {} \;
sudo find "$site_dir/public/wp-content" -type f -exec chmod 664 {} \;

sudo tee "$pool_file" >/dev/null <<EOF
[$site_user]
user = $site_user
group = $site_user

listen = $socket_file
listen.owner = www-data
listen.group = www-data
listen.mode = 0660

pm = ondemand
pm.max_children = 8
pm.process_idle_timeout = 10s
pm.max_requests = 500

php_admin_value[open_basedir] = $site_dir/public:/tmp:$site_dir/tmp
php_admin_value[upload_tmp_dir] = $site_dir/tmp
php_admin_value[session.save_path] = $site_dir/tmp
php_admin_value[expose_php] = Off
php_admin_value[display_errors] = Off
php_admin_value[log_errors] = On
php_admin_value[disable_functions] = exec,passthru,shell_exec,system,proc_open,popen,pcntl_exec,putenv,dl,show_source
EOF

sudo a2enmod proxy proxy_fcgi setenvif rewrite headers >/dev/null 2>&1 || true
sudo a2enconf "php${php_version}-fpm" >/dev/null 2>&1 || true

sudo tee "$apache_conf" >/dev/null <<EOF
<VirtualHost *:80>
  ServerName $domain
  DocumentRoot $site_dir/public

  <Directory $site_dir/public>
    AllowOverride All
    Require all granted
    Options -Indexes +FollowSymLinks
  </Directory>

  <FilesMatch \.php$>
    SetHandler "proxy:unix:$socket_file|fcgi://localhost/"
  </FilesMatch>

  ErrorLog \${APACHE_LOG_DIR}/${domain}-error.log
  CustomLog \${APACHE_LOG_DIR}/${domain}-access.log combined

  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set X-Content-Type-Options "nosniff"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
</VirtualHost>
EOF

sudo a2ensite "$domain.conf" >/dev/null 2>&1 || true

mysql -uroot -p"$mysql_root_pass" <<SQL
CREATE DATABASE IF NOT EXISTS \`$db_name\` CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER IF NOT EXISTS '$db_user'@'localhost' IDENTIFIED BY '$db_pass';
REVOKE ALL PRIVILEGES, GRANT OPTION FROM '$db_user'@'localhost';
GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP, INDEX, ALTER, CREATE TEMPORARY TABLES, LOCK TABLES
ON \`$db_name\`.*
TO '$db_user'@'localhost';
FLUSH PRIVILEGES;
SQL

sudo systemctl restart "php${php_version}-fpm"
sudo systemctl reload apache2

echo "OK"
echo "Dir: $site_dir/public"
echo "Apache vhost: $apache_conf"
echo "PHP-FPM pool: $pool_file"
echo "DB: $db_name"
echo "DB user: $db_user@localhost"