#!/bin/bash
# HAL 8 file browser: Filebrowser behind the existing Caddy on this box.
# Browse root is /srv/files (a shared folder) - deliberately NOT the whole
# disk, so server secrets (tank key, supplier keys, git tokens) are never
# one misclick from a browser tab.
set -e

sudo mkdir -p /srv/files
sudo rm -rf /opt/filebrowser && sudo mkdir -p /opt/filebrowser
NET=$(sudo docker network ls --format '{{.Name}}' | grep -m1 hal8)
echo "using docker network: $NET"

PW=$(openssl rand -base64 12)
HASH=$(sudo docker run --rm filebrowser/filebrowser hash "$PW")

sudo docker rm -f filebrowser >/dev/null 2>&1 || true
sudo docker run -d --restart unless-stopped --name filebrowser --network "$NET" \
  -v /srv/files:/srv \
  -v /opt/filebrowser:/database \
  -e FB_DATABASE=/database/filebrowser.db \
  -e FB_USERNAME=jerry \
  -e FB_PASSWORD="$HASH" \
  filebrowser/filebrowser

printf 'files.odyssey-works.io {\n\treverse_proxy filebrowser:80\n}\n' \
  | sudo tee /opt/marketplace/caddy/files.caddy >/dev/null
CADDY_CONFIG_SHA=$(sudo sh -c "cat /opt/hal8/deploy/Caddyfile /opt/marketplace/caddy/*.caddy | sha256sum | cut -d' ' -f1")
cd /opt/hal8
sudo CADDY_CONFIG_SHA="$CADDY_CONFIG_SHA" docker compose -f docker-compose.prod.yaml up -d --no-build --force-recreate caddy

echo "===================================================="
echo "LOGIN:    https://files.odyssey-works.io  user: jerry"
echo "PASSWORD: $PW"
echo "===================================================="