#!/usr/bin/env bash
# 生产服务器初始化（Issue #91）：系统更新 / Docker / 防火墙 / SSH 加固 / 部署用户
set -euo pipefail

log() { echo "[setup] $*"; }

log "系统更新"
apt-get update && apt-get -y upgrade

log "安装 Docker 与 compose 插件"
if ! command -v docker >/dev/null; then
  curl -fsSL https://get.docker.com | sh
  systemctl enable --now docker
fi

log "创建部署用户 deploy（非 root 运行）"
id -u deploy >/dev/null 2>&1 || useradd -m -s /bin/bash deploy
usermod -aG docker deploy
mkdir -p /opt/wms && chown deploy:deploy /opt/wms

log "防火墙：仅放行 22/80/443"
if command -v ufw >/dev/null; then
  ufw default deny incoming
  ufw default allow outgoing
  ufw allow 22/tcp
  ufw allow 80/tcp
  ufw allow 443/tcp
  ufw --force enable
fi

log "SSH 加固"
sed -i 's/^#\?PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
sed -i 's/^#\?PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
systemctl reload sshd || true

log "时间同步"
timedatectl set-timezone Asia/Shanghai

log "完成。请将 TLS 证书放入 /opt/wms/deploy/production/certs/ 后执行 scripts/deploy.sh"