#!/bin/bash
# Fully automated Webmin installer with Let's Encrypt SSL and automatic UFW
# UBUNTU 18.04 LTS version

set -e

############################################
# CONFIGURATION
############################################
DOMAIN="$1"               # Domain name
PREFERRED_PORT="$2"       # Preferred port (optional)
EMAIL="admin@example.com" # Email for Let's Encrypt

PREFERRED_PORT=${PREFERRED_PORT:-10000}

if [[ -z "$DOMAIN" ]]; then
    echo "Usage: $0 yourdomain.com [preferred-port]"
    exit 1
fi


############################################
# FUNCTIONS
############################################
check_root() {
    [[ "$EUID" -ne 0 ]] && { echo "Please run as root"; exit 1; }
}

get_public_ip() {
    PUBLIC_IP=$(curl -s https://api.ipify.org)
    echo "Detected public IP: $PUBLIC_IP"
}

verify_domain() {
    DOMAIN_IP=$(dig +short "$DOMAIN" | tail -n1)
    if [[ "$DOMAIN_IP" != "$PUBLIC_IP" ]]; then
        echo "⚠️  WARNING: $DOMAIN does NOT point to $PUBLIC_IP"
        echo "Let's Encrypt may fail, but continuing..."
    fi
}

select_free_port() {
    WEBMIN_PORT="$PREFERRED_PORT"
    while ss -tuln | grep -q ":$WEBMIN_PORT "; do
        echo "Port $WEBMIN_PORT already in use... choosing a new one."
        WEBMIN_PORT=$((RANDOM % 30000 + 10000))
    done
    echo "Using Webmin port: $WEBMIN_PORT"
}

install_dependencies() {
    apt update -y
    apt install -y wget curl software-properties-common apt-transport-https gnupg ufw dnsutils

    # Certbot for Ubuntu 18.04 (uses snap or old PPA)
    if ! command -v certbot >/dev/null 2>&1; then
        add-apt-repository -y ppa:certbot/certbot
        apt update -y
        apt install -y certbot
    fi
}

install_webmin() {
    wget -q http://www.webmin.com/jcameron-key.asc
    apt-key add jcameron-key.asc
    rm jcameron-key.asc

    echo "deb http://download.webmin.com/download/repository sarge contrib" \
        > /etc/apt/sources.list.d/webmin.list

    apt update -y
    apt install -y webmin
}

configure_webmin_port() {
    sed -i "s/^port=.*/port=$WEBMIN_PORT/" /etc/webmin/miniserv.conf
}

configure_ufw() {
    if ! ufw status | grep -q "Status: active"; then
        echo "Enabling UFW firewall..."
        ufw --force enable
    fi
    
    echo "Allowing Webmin port $WEBMIN_PORT..."
    ufw allow "$WEBMIN_PORT/tcp"
    ufw reload
}

obtain_ssl() {
    echo "Temporarily opening port 80 for Let's Encrypt..."
    ufw allow 80/tcp

    systemctl stop webmin

    certbot certonly --standalone \
        -d "$DOMAIN" \
        --non-interactive --agree-tos -m "$EMAIL"

    ufw delete allow 80/tcp
    systemctl start webmin
}

configure_ssl_webmin() {
    CERT="/etc/letsencrypt/live/$DOMAIN/fullchain.pem"
    KEY="/etc/letsencrypt/live/$DOMAIN/privkey.pem"

    [[ ! -f "$CERT" ]] && { echo "Let's Encrypt certificate missing"; exit 1; }

    sed -i "s/^ssl=0/ssl=1/" /etc/webmin/miniserv.conf
    sed -i "s|^keyfile=.*|keyfile=$KEY|" /etc/webmin/miniserv.conf
    sed -i "s|^certfile=.*|certfile=$CERT|" /etc/webmin/miniserv.conf

    systemctl restart webmin
}

setup_auto_renew() {
    echo "0 3 * * * root certbot renew --post-hook 'systemctl restart webmin'" \
        > /etc/cron.d/webmin-le-renew
}

print_success() {
    echo "--------------------------------------------------------"
    echo "  ✅ Webmin Installed Successfully on Ubuntu 18.04"
    echo "  URL: https://$DOMAIN:$WEBMIN_PORT/"
    echo "  SSL: Let's Encrypt (Auto-renew enabled)"
    echo "--------------------------------------------------------"
}


############################################
# EXECUTION
############################################
check_root
get_public_ip
verify_domain
select_free_port
install_dependencies
install_webmin
configure_webmin_port
configure_ufw
obtain_ssl
configure_ssl_webmin
setup_auto_renew
print_success