#!/usr/bin/env bash
set -euo pipefail

# Run as a sudo-capable user on Ubuntu 22.04

sudo apt update
sudo apt install -y curl gnupg2 software-properties-common ufw nginx postgresql-15 postgresql-client-15 certbot python3-certbot-nginx

# Node.js 20
curl -fsSL https://deb.nodesource.com/setup_20.x | sudo -E bash -
sudo apt install -y nodejs

# Basic firewall
sudo ufw allow 22/tcp
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw deny 5432
sudo ufw --force enable

# App directory and user
if ! id -u esnAdmin >/dev/null 2>&1; then
  sudo adduser --disabled-password --gecos "" esnAdmin
fi
sudo mkdir -p /opt/esn-api
sudo chown -R esnAdmin:esnAdmin /opt/esn-api

echo "Bootstrap complete. Upload project files into /opt/esn-api, then run deploy/scripts/deploy_update.sh"