@echo off
setlocal EnableDelayedExpansion
REM ============================================================
REM   GO LIVE ON A DOMAIN - one-shot, with a safety gate.
REM
REM   Does, in order:
REM     1. checks DNS for the game domain -> your IP
REM     2. installs + configures Caddy (game domain, valid cert)
REM     3. GATE: verifies the game domain answers over a VALID cert
REM        -> if it doesn't, it STOPS and does NOT deploy the
REM           BaseURL change (so players can't get locked out)
REM     4. only if the gate passes: deploys the server package
REM     5. re-tests both domains
REM
REM   You still do the two external bits yourself:
REM     - create the No-IP A record (gameauth -> 50.114.179.17)
REM     - change the in-game client redirect to the game domain
REM       and set the Photon dashboard auth URL (same game domain)
REM
REM   Reads the root password from password.txt (same folder).
REM ============================================================

cd /d "%~dp0"

set HOST=50.114.179.17
set USER=root
set GAME=gameauth.ddns.net
REM Photon custom-auth is served by the SAME game domain (/photon/auth),
REM so there is no separate photon hostname to set up any more.
set PHOTON=gameauth.ddns.net
set PKG=campus-deploy.tar.gz
set PWFILE=password.txt

echo.
echo  ===========================================
echo    GO LIVE - game=%GAME%  photon=%PHOTON%
echo    target: %USER%@%HOST%
echo  ===========================================
echo.

REM --- prereqs -------------------------------------------------
if not exist "%PWFILE%"  ( echo  [X] %PWFILE% not found.& goto :fail )
if not exist "Caddyfile" ( echo  [X] Caddyfile not found.& goto :fail )
if not exist "%PKG%"     ( echo  [X] %PKG% not found - run PackageServer first.& goto :fail )
where plink >nul 2>&1 || ( echo  [X] PuTTY tools missing: winget install PuTTY.PuTTY & goto :fail )

set PW=
for /f "usebackq delims=" %%p in ("%PWFILE%") do if not defined PW set "PW=%%p"
if not defined PW ( echo  [X] %PWFILE% is empty.& goto :fail )

REM --- 1. DNS check -------------------------------------------
echo  [1/5] Checking DNS ...
nslookup %GAME% 2>nul | findstr /C:"%HOST%" >nul
if errorlevel 1 (
  echo  [X] %GAME% does not resolve to %HOST% yet.
  echo      Create the A record on No-IP and wait for propagation, then re-run.
  goto :fail
)
echo        %GAME% resolves to %HOST%.

REM --- 2. install + configure Caddy ---------------------------
echo.
echo  [2/5] Installing + configuring Caddy ^(apt ~60s^) ...
echo y | plink -ssh -pw "!PW!" %USER%@%HOST% "apt-get update -qq && apt-get install -y debian-keyring debian-archive-keyring apt-transport-https curl gnupg && curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' | gpg --batch --yes --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg && curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' > /etc/apt/sources.list.d/caddy-stable.list && apt-get update -qq && apt-get install -y caddy"
if errorlevel 1 ( echo  [X] Caddy install failed - see above.& goto :fail )

echo y | pscp -pw "!PW!" "Caddyfile" %USER%@%HOST%:/etc/caddy/Caddyfile
if errorlevel 1 ( echo  [X] Caddyfile upload failed.& goto :fail )

echo y | plink -ssh -pw "!PW!" %USER%@%HOST% "sed -i 's/\r$//' /etc/caddy/Caddyfile; ufw allow 80 >/dev/null 2>&1; ufw allow 443 >/dev/null 2>&1; systemctl enable caddy >/dev/null 2>&1; systemctl restart caddy && sleep 2 && systemctl is-active caddy"
if errorlevel 1 ( echo  [X] Caddy restart failed - see above.& goto :fail )

REM --- 3. GATE: game domain must answer over a VALID cert -----
echo.
echo  [3/5] Verifying %GAME% over a valid cert ^(waiting for issuance^) ...
set OK=
for /l %%i in (1,1,6) do (
  if not defined OK (
    timeout /t 10 /nobreak >nul
    REM  -f fails on HTTP errors; NO -k so the cert MUST be valid
    curl -sf -o nul --max-time 15 https://%GAME%/ && set OK=1
    if defined OK ( echo        OK - valid cert, server answered. ) else ( echo        not ready yet, retrying ... )
  )
)
if not defined OK (
  echo.
  echo  [X] %GAME% did not answer over a valid cert in time.
  echo      Caddy could still be issuing, or ports 80/443 are blocked
  echo      by your host firewall, or DNS just propagated.
  echo      NOTHING was deployed - your players are UNAFFECTED.
  echo      Fix it and re-run this file.
  goto :fail
)

REM --- 4. deploy the server package (BaseURL -> domain) -------
echo.
echo  [4/5] Cert verified - deploying the server ^(BaseURL now the domain^) ...
echo y | pscp -pw "!PW!" "%PKG%" %USER%@%HOST%:/root/
if errorlevel 1 ( echo  [X] Package upload failed.& goto :fail )
echo y | plink -ssh -pw "!PW!" %USER%@%HOST% "cd /root && rm -rf campus-deploy && tar -xzf %PKG% && cd campus-deploy && chmod +x install.sh Campus2023 && ./install.sh"
if errorlevel 1 ( echo  [X] Server install failed - see above.& goto :fail )

REM --- 5. re-test both domains -------------------------------
echo.
echo  [5/5] Final checks ...
timeout /t 4 /nobreak >nul
echo        game   : GET https://%GAME%/
curl -s -o nul -w "                 -> HTTP %%{http_code}, cert %%{ssl_verify_result} (0=valid)\n" --max-time 20 https://%GAME%/
echo        photon : GET https://%PHOTON%/photon/auth
curl -s --max-time 20 https://%PHOTON%/photon/auth
echo.
echo.
echo  ===========================================
echo    DONE ^(server side^).
echo    Now finish the two manual bits:
echo      1. In-game client redirect  -^>  %GAME%   ^(port 443, no :2059^)
echo      2. Photon dashboard auth URL -^>  https://%PHOTON%/photon/auth
echo         + enable the Custom provider
echo.
echo    If the game ever breaks on the domain: tell me and I set
echo    BaseURL back to the IP, redeploy, point the client at the IP.
echo    Your :2059 IP endpoint is still running as a fallback.
echo  ===========================================
echo.
goto :done

:fail
echo.
echo  Stopped. Nothing risky was deployed unless it got past step 3.
:done
endlocal
pause