

#Install CISO Assistant
# sudo openssl req -x509 -nodes -days 3650 \
#    -subj "/C=US/ST=OK/L=Durant/O=RCI/OU=Information Technology/CN=ubuntu.lab.internal" \
#    -newkey rsa:2048 -keyout /etc/ssl/private/ca.self.key \
#    -out /etc/ssl/certs/ca.self.crt

#clone the repo
git clone https://github.com/intuitem/ciso-assistant-community.git


#go to the config generator
cd ciso-assistant-community/config

#Copy the cert files
mkdir cert

#cert
cat << EOF >>cert/ca.self.crt
-----BEGIN CERTIFICATE-----
[payload removed: 1992 characters in 32 lines]
-----END CERTIFICATE-----
EOF

cat << EOF >>cert/ca.self.key
-----BEGIN PRIVATE KEY-----
[payload removed: 3168 characters in 50 lines]
-----END PRIVATE KEY-----
EOF

cat << EOF >>compose.yml
services:
  backend:
    container_name: backend
    image: ghcr.io/intuitem/ciso-assistant-community/backend:latest
    pull_policy: always
    restart: always
    environment:
      - ALLOWED_HOSTS=backend,localhost,ubuntu.lab.internal
      - CISO_ASSISTANT_URL=https://ubuntu.lab.internal:4443
      - DJANGO_DEBUG=True
      - AUTH_TOKEN_TTL=7200
    volumes:
      - ./db:/code/db
    healthcheck:
      test: ["CMD-SHELL", "curl -f http://backend:8000/api/build || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 20
      start_period: 100s
  huey:
    container_name: huey
    image: ghcr.io/intuitem/ciso-assistant-community/backend:latest
    pull_policy: always
    depends_on:
      backend:
        condition: service_healthy
    restart: always
    environment:
      - ALLOWED_HOSTS=backend,localhost
      - CISO_ASSISTANT_URL=https://ubuntu.lab.internal:4443
      - DJANGO_DEBUG=False
      - AUTH_TOKEN_TTL=7200
    volumes:
      - ./db:/code/db
    entrypoint:
      - /bin/sh
      - -c
      - |
        poetry run python manage.py run_huey -w 2 --scheduler-interval 60
  frontend:
    container_name: frontend
    environment:
      - PUBLIC_BACKEND_API_URL=http://backend:8000/api
      - PUBLIC_BACKEND_API_EXPOSED_URL=https://ubuntu.lab.internal:4443/api
      - PROTOCOL_HEADER=x-forwarded-proto
      - HOST_HEADER=x-forwarded-host
    image: ghcr.io/intuitem/ciso-assistant-community/frontend:latest
    pull_policy: always
    depends_on:
      backend:
        condition: service_healthy
  caddy:
    container_name: caddy
    image: caddy:2.10.0
    environment:
      - CISO_ASSISTANT_URL=https://ubuntu.lab.internal:4443
    depends_on:
      backend:
        condition: service_healthy
    restart: unless-stopped
    ports:
      - 4443:4443
    volumes:
      - ./caddy_data:/data
      - ./cert:/data/cert
    command: |
      sh -c 'echo $$CISO_ASSISTANT_URL "{
      reverse_proxy /api/* backend:8000
      reverse_proxy /* frontend:3000
      tls /data/cert/ca.self.crt /data/cert/ca.self.key
      }" > Caddyfile && caddy run'
EOF
# # setting up the python project and dependencies 
# python3 -m venv .venv
# source .venv/bin/activate
# pip install -r requirements.txt

# # run the interactive config generator
# python make_config.py

# ./docker-compose.sh

# deactivate

docker compose up -d

echo "Waiting for CISO Assistant backend to be ready..."
until docker compose exec -T backend curl -f http://localhost:8000/api/build >/dev/null 2>&1; do
  echo "Backend is not ready - waiting 10s..."
  sleep 10
done

echo -e "Backend is ready!"
echo "Creating superuser..."
docker compose exec backend poetry run python manage.py createsuperuser --email student@lab.internal
