#!/usr/bin/env bash
set -euo pipefail

SCRIPT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
SOURCE_DIR=$SCRIPT_DIR
# shellcheck source=/dev/null
source "$SCRIPT_DIR/scripts/libenv.sh"

log() { printf '[install] %s\n' "$*"; }

usage() {
  cat <<'EOF'
Usage: ./install.sh [options]

Interactive installer wrapper for Limristem eMail. Missing values are prompted when a TTY is available.

Options:
  -u, --update                        Update an existing Limristem eMail install without reinitializing it
  -o, --overwrite                     Force a fresh reinstall and replace Limristem eMail-managed configs
  --hostname <fqdn>                     Mail hostname (example: mail.example.com)
  --path, --install-path <dir>          Installation path (default: /opt/limristem-mail)
  --ssl-mode <plain|selfsigned|letsencrypt>
  --le-email <email>                    Let's Encrypt email
  --public-ip <ipv4>
  --public-ipv6 <ipv6>
  --dkim-selector <selector>            Default DKIM selector (default: default)
  --enable-api <yes|no>
  --enable-nginx <yes|no>
  --enable-rspamd <yes|no>
  --enable-srs <yes|no>
  --enable-mta-sts <yes|no>
  --enable-tls-rpt <yes|no>
  --enable-backup-timer <yes|no>
  --enable-deliverability-timer <yes|no>
  --enable-web-panel <yes|no>
  --dry-run                            Show resolved settings without installing
  --non-interactive                     Do not prompt; fail if required values are invalid
  --help                                Show this help
EOF
}

require_root() {
  if [[ $EUID -ne 0 ]]; then
    log "Esegui questo script come root (sudo)."
    exit 1
  fi
}

normalize_bool() {
  local value=${1,,}
  case "$value" in
    y|yes|1|true|on) printf 'yes\n' ;;
    n|no|0|false|off) printf 'no\n' ;;
    *)
      log "Valore booleano non valido: $1"
      exit 1
      ;;
  esac
}

default_hostname() {
  local candidate=''
  if candidate=$(hostname -f 2>/dev/null) && [[ -n "$candidate" ]]; then
    printf '%s\n' "$candidate"
    return 0
  fi
  if candidate=$(hostname 2>/dev/null) && [[ -n "$candidate" ]]; then
    printf '%s\n' "$candidate"
    return 0
  fi
  printf 'mail.example.com\n'
}

ensure_fqdn() {
  local value=${1,,}
  value=${value%.}
  if [[ ${#value} -le 253 && "$value" =~ ^([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$ ]]; then
    printf '%s\n' "$value"
    return 0
  fi
  log "Hostname non valido: '$1'. Usa un FQDN ASCII come mail.example.com"
  exit 1
}

validate_install_path() {
  local value=$1
  if [[ "$value" =~ ^/[A-Za-z0-9._/-]+$ && "$value" != "/" && "$value" != *"/../"* && "$value" != *"/.." && "$value" != *"/./"* ]]; then
    printf '%s\n' "${value%/}"
    return 0
  fi
  log "Percorso di installazione non valido: '$value'. Usa un percorso assoluto senza spazi o '..'."
  exit 1
}

validate_ip_if_set() {
  local value=$1
  local family=$2
  [[ -z "$value" ]] && return 0
  python3 - "$value" "$family" <<'PY'
import ipaddress
import sys

address = ipaddress.ip_address(sys.argv[1])
expected = int(sys.argv[2])
if address.version != expected:
    raise SystemExit(f"Expected IPv{expected} address")
PY
}

tty_is_usable() {
  # /dev/tty may exist as a node but be unusable under non-TTY SSH (no -t).
  { : < /dev/tty; } 2>/dev/null
}

prompt_value() {
  local prompt=$1
  local default_value=$2
  local current_value=$3
  local input=''
  local resolved_default=${current_value:-$default_value}
  if [[ "$NON_INTERACTIVE" == "yes" ]]; then
    printf '%s\n' "$resolved_default"
    return 0
  fi
  if [ -t 0 ]; then
    read -r -p "$prompt [$resolved_default]: " input || input=""
  elif tty_is_usable; then
    read -r -p "$prompt [$resolved_default]: " input < /dev/tty || input=""
  else
    input=""
  fi
  printf '%s\n' "${input:-$resolved_default}"
}

prompt_bool() {
  local prompt=$1
  local default_value=$2
  local current_value=$3
  local input=''
  local resolved normalized default_hint
  resolved=${current_value:-$default_value}
  normalized=$(normalize_bool "$resolved")
  if [[ "$normalized" == "yes" ]]; then
    default_hint='y'
  else
    default_hint='n'
  fi
  if [[ "$NON_INTERACTIVE" == "yes" ]]; then
    printf '%s\n' "$normalized"
    return 0
  fi
  # No interactive TTY available: accept the resolved default instead of looping forever.
  if [[ ! -t 0 ]] && ! tty_is_usable; then
    printf '%s\n' "$normalized"
    return 0
  fi
  while true; do
    if [ -t 0 ]; then
      read -r -p "$prompt [y/n, default $default_hint]: " input || input=""
    elif tty_is_usable; then
      read -r -p "$prompt [y/n, default $default_hint]: " input < /dev/tty || input=""
    else
      input=""
    fi
    input=${input:-$default_hint}
    case "${input,,}" in
      y|n)
        normalize_bool "$input"
        return 0
        ;;
      *)
        log "Rispondi solo con y o n."
        ;;
    esac
  done
}

layout_package_tree() {
  # Materialize runtime layout (scripts→bin, api→bin/api, …) from a source tree.
  # Used both for out-of-tree installs and in-place package extraction under INSTALL_PATH.
  local source_dir=$1
  local target_dir=$2
  local same_tree=no
  if [[ "$(readlink -f "$source_dir")" == "$(readlink -f "$target_dir")" ]]; then
    same_tree=yes
  fi
  mkdir -p "$target_dir/bin" "$target_dir/bin/api" "$target_dir/bin/panel" "$target_dir/config" "$target_dir/templates" "$target_dir/database" "$target_dir/keys/public"

  install_if_different() {
    local mode=$1 src=$2 dst=$3
    [[ -e "$src" ]] || return 0
    if [[ "$(readlink -f "$src" 2>/dev/null || true)" == "$(readlink -f "$dst" 2>/dev/null || true)" ]]; then
      chmod "$mode" "$dst" 2>/dev/null || true
      return 0
    fi
    install -m "$mode" "$src" "$dst"
  }

  if command -v rsync >/dev/null 2>&1; then
    install_if_different 0755 "$source_dir/limristem-mail" "$target_dir/limristem-mail"
    install_if_different 0755 "$source_dir/install.sh" "$target_dir/install.sh"
    install_if_different 0644 "$source_dir/version.json" "$target_dir/version.json"
    if [ -f "$source_dir/limristem-email.png" ]; then
      install_if_different 0644 "$source_dir/limristem-email.png" "$target_dir/limristem-email.png"
    fi
    if [ -d "$source_dir/keys/public" ]; then
      rsync -a "$source_dir/keys/public"/ "$target_dir/keys/public"/
    fi
    # scripts/ may already be gone on re-run; prefer scripts, fall back if bin already populated.
    if [ -d "$source_dir/scripts" ]; then
      rsync -a --delete \
        --exclude '.git' \
        --exclude '.venv' \
        --exclude '__pycache__' \
        --exclude '*.pyc' \
        "$source_dir/scripts"/ "$target_dir/bin"/
    fi
    if [ -d "$source_dir/api" ]; then
      rsync -a --delete \
        --exclude 'templates' \
        --exclude '__pycache__' \
        --exclude '*.pyc' \
        "$source_dir/api"/ "$target_dir/bin/api"/
      if [ -d "$source_dir/api/templates" ]; then
        rsync -a --delete \
          --exclude '__pycache__' \
          --exclude '*.pyc' \
          "$source_dir/api/templates"/ "$target_dir/bin/panel"/
      fi
    fi
    if [ -d "$source_dir/templates" ]; then
      rsync -a --delete \
        --exclude '__pycache__' \
        --exclude '*.pyc' \
        "$source_dir/templates"/ "$target_dir/templates"/
    fi
    if [ -d "$source_dir/database" ]; then
      rsync -a --delete \
        --exclude '__pycache__' \
        --exclude '*.pyc' \
        "$source_dir/database"/ "$target_dir/database"/
    fi
  else
    install_if_different 0755 "$source_dir/limristem-mail" "$target_dir/limristem-mail"
    install_if_different 0755 "$source_dir/install.sh" "$target_dir/install.sh"
    install_if_different 0644 "$source_dir/version.json" "$target_dir/version.json"
    if [ -f "$source_dir/limristem-email.png" ]; then
      install_if_different 0644 "$source_dir/limristem-email.png" "$target_dir/limristem-email.png"
    fi
    mkdir -p "$target_dir/bin" "$target_dir/bin/api" "$target_dir/bin/panel"
    if [ -d "$source_dir/scripts" ]; then
      tar --exclude='__pycache__' -C "$source_dir/scripts" -cf - . | tar -C "$target_dir/bin" -xf -
    fi
    if [ -d "$source_dir/api" ]; then
      tar --exclude='templates' --exclude='__pycache__' -C "$source_dir/api" -cf - . | tar -C "$target_dir/bin/api" -xf -
      if [ -d "$source_dir/api/templates" ]; then
        tar --exclude='__pycache__' -C "$source_dir/api/templates" -cf - . | tar -C "$target_dir/bin/panel" -xf -
      fi
    fi
    if [ -d "$source_dir/templates" ]; then
      tar --exclude='__pycache__' -C "$source_dir/templates" -cf - . | tar -C "$target_dir/templates" -xf -
    fi
    if [ -d "$source_dir/database" ]; then
      tar --exclude='__pycache__' -C "$source_dir/database" -cf - . | tar -C "$target_dir/database" -xf -
    fi
    if [ -d "$source_dir/keys/public" ]; then
      mkdir -p "$target_dir/keys/public"
      tar -C "$source_dir/keys/public" -cf - . | tar -C "$target_dir/keys/public" -xf -
    fi
  fi
  # Ensure helper scripts are executable (tar may ship scripts/install.sh as 0644).
  if [[ -d "$target_dir/bin" ]]; then
    find "$target_dir/bin" -maxdepth 1 -type f \( -name '*.sh' -o -name 'limristem-mail' -o -name 'dovecot-*' \) -exec chmod 0755 {} +
  fi
  # After bin/ is populated, drop package-layout duplicates (api/, scripts/).
  if [[ -f "$target_dir/bin/install.sh" ]]; then
    chmod 0755 "$target_dir/bin/install.sh"
    rm -rf "$target_dir/api" "$target_dir/scripts"
  else
    log "ERRORE: layout incompleto, manca $target_dir/bin/install.sh"
    exit 1
  fi
  rm -f "$target_dir/config/"*.example
  unset -f install_if_different
}

sync_package() {
  local source_real target_real
  source_real=$(readlink -f "$SOURCE_DIR")
  mkdir -p "$INSTALL_PATH"
  target_real=$(readlink -f "$INSTALL_PATH")
  case "$target_real" in
    "$source_real"/*)
      if [[ "$source_real" != "$target_real" ]]; then
        log "Il percorso di installazione non può stare dentro la sorgente del pacchetto."
        exit 1
      fi
      ;;
  esac
  if [[ "$source_real" == "$target_real" ]]; then
    # In-place install (tar extracted into INSTALL_PATH): still materialize bin/ layout.
    if [[ ! -x "$INSTALL_PATH/bin/install.sh" ]]; then
      log "Materializzo layout runtime (bin/) in-place in $INSTALL_PATH"
      layout_package_tree "$SOURCE_DIR" "$INSTALL_PATH"
    fi
    return 0
  fi
  log "Sincronizzo Limristem eMail in $INSTALL_PATH"
  layout_package_tree "$SOURCE_DIR" "$INSTALL_PATH"
}

existing_install_env_file() {
  if [[ -f "$INSTALL_PATH/config/limristem-mail.env" ]]; then
    printf '%s\n' "$INSTALL_PATH/config/limristem-mail.env"
  elif [[ -f /etc/limristem-mail.env ]]; then
    printf '/etc/limristem-mail.env\n'
  fi
}

NON_INTERACTIVE=no
DRY_RUN=no
INSTALL_PATH=/opt/limristem-mail
INSTALL_PATH_EXPLICIT=no
UPDATE_MODE=no
OVERWRITE_MODE=no
HOSTNAME_VALUE=
SSL_MODE=selfsigned
LE_EMAIL=
PUBLIC_IP=
PUBLIC_IPV6=
DKIM_SELECTOR=default
ENABLE_API=yes
ENABLE_NGINX=yes
ENABLE_RSPAMD=yes
ENABLE_SRS=yes
ENABLE_MTA_STS=no
ENABLE_TLS_RPT=no
ENABLE_BACKUP_TIMER=yes
ENABLE_DELIVERABILITY_TIMER=no
ENABLE_WEB_PANEL=no
UPDATE_CHANNEL=stable
INSTALL_WEBMAIL=yes
ASSUME_DNS_READY=no

# Auto non-interactive when stdin is not a TTY (CI / ssh without -t) unless overridden later.
if [[ ! -t 0 ]] && ! tty_is_usable; then
  NON_INTERACTIVE=yes
fi

while [[ $# -gt 0 ]]; do
  case "$1" in
    -u|--update)
      UPDATE_MODE=yes
      shift
      ;;
    -o|--overwrite)
      OVERWRITE_MODE=yes
      shift
      ;;
    --hostname)
      HOSTNAME_VALUE=${2:?}
      shift 2
      ;;
    --path|--install-path)
      INSTALL_PATH=${2:?}
      INSTALL_PATH_EXPLICIT=yes
      shift 2
      ;;
    --ssl-mode)
      SSL_MODE=${2:?}
      shift 2
      ;;
    --le-email)
      LE_EMAIL=${2:?}
      shift 2
      ;;
    --public-ip)
      PUBLIC_IP=${2:?}
      shift 2
      ;;
    --public-ipv6)
      PUBLIC_IPV6=${2:?}
      shift 2
      ;;
    --dkim-selector)
      DKIM_SELECTOR=${2:?}
      shift 2
      ;;
    --enable-api)
      ENABLE_API=$(normalize_bool "${2:?}")
      shift 2
      ;;
    --enable-nginx)
      ENABLE_NGINX=$(normalize_bool "${2:?}")
      shift 2
      ;;
    --enable-rspamd)
      ENABLE_RSPAMD=$(normalize_bool "${2:?}")
      shift 2
      ;;
    --enable-srs)
      ENABLE_SRS=$(normalize_bool "${2:?}")
      shift 2
      ;;
    --enable-mta-sts)
      ENABLE_MTA_STS=$(normalize_bool "${2:?}")
      shift 2
      ;;
    --enable-tls-rpt)
      ENABLE_TLS_RPT=$(normalize_bool "${2:?}")
      shift 2
      ;;
    --enable-backup-timer)
      ENABLE_BACKUP_TIMER=$(normalize_bool "${2:?}")
      shift 2
      ;;
    --enable-deliverability-timer)
      ENABLE_DELIVERABILITY_TIMER=$(normalize_bool "${2:?}")
      shift 2
      ;;
    --enable-web-panel)
      ENABLE_WEB_PANEL=$(normalize_bool "${2:?}")
      shift 2
      ;;
    --channel)
      UPDATE_CHANNEL=${2:?}
      shift 2
      ;;
    --install-webmail)
      INSTALL_WEBMAIL=$(normalize_bool "${2:?}")
      shift 2
      ;;
    --non-interactive)
      NON_INTERACTIVE=yes
      shift
      ;;
    --dry-run)
      DRY_RUN=yes
      shift
      ;;
    --help|-h)
      usage
      exit 0
      ;;
    *)
      log "Opzione non riconosciuta: $1"
      usage
      exit 1
      ;;
  esac
done

require_root

if [[ "$UPDATE_MODE" == "yes" && "$OVERWRITE_MODE" == "yes" ]]; then
  log "Le opzioni -u/--update e -o/--overwrite sono mutualmente esclusive."
  exit 1
fi

EXISTING_ENV_FILE=$(existing_install_env_file)
if [[ -n "$EXISTING_ENV_FILE" && "$DRY_RUN" != "yes" ]]; then
  limristem_mail_normalize_env_file "$EXISTING_ENV_FILE"
  if [[ "$EXISTING_ENV_FILE" == /etc/limristem-mail.env ]]; then
    limristem_mail_normalize_env_file /etc/limristem-mail-backup.env
  else
    limristem_mail_normalize_env_file "$INSTALL_PATH/config/limristem-mail-backup.env"
  fi
fi

if [[ "$UPDATE_MODE" == "yes" ]]; then
  if [[ -z "$EXISTING_ENV_FILE" ]]; then
    log "Nessuna installazione Limristem eMail esistente rilevata. Avvia ./install.sh senza -u per una nuova installazione."
    exit 1
  fi
  limristem_mail_load_env_file "$EXISTING_ENV_FILE"
  if [[ "$INSTALL_PATH_EXPLICIT" != "yes" && -n "${LIMRISTEM_MAIL_BASE_DIR:-}" ]]; then
    INSTALL_PATH=$LIMRISTEM_MAIL_BASE_DIR
  fi
  INSTALL_PATH=$(validate_install_path "$INSTALL_PATH")
  log "Limristem eMail risulta già installato: eseguo aggiornamento in modalità -u."
  sync_package
  export LIMRISTEM_MAIL_BASE_DIR=$INSTALL_PATH
  export LIMRISTEM_MAIL_UPDATE_MODE=yes
  export LIMRISTEM_MAIL_OVERWRITE_MODE=no
  export LIMRISTEM_MAIL_LOG_FILE=/var/log/limristem-mail-install.log
  cd "$INSTALL_PATH"
  exec bash ./bin/install.sh
fi

if [[ -n "$EXISTING_ENV_FILE" && "$OVERWRITE_MODE" != "yes" ]]; then
  log "Limristem eMail risulta già installato."
  log "Usa ./install.sh -u per aggiornare template, servizi e pannello senza reinstallazione completa."
  log "Usa ./install.sh -o per forzare una reinstallazione completa e sostituire i file gestiti da Limristem eMail."
  exit 1
fi

if [[ "$DRY_RUN" != "yes" && -f "$INSTALL_PATH/config/limristem-mail.env" ]]; then
  limristem_mail_normalize_env_file "$INSTALL_PATH/config/limristem-mail.env"
  limristem_mail_normalize_env_file "$INSTALL_PATH/config/limristem-mail-backup.env"
elif [[ "$DRY_RUN" != "yes" && -f /etc/limristem-mail.env ]]; then
  limristem_mail_normalize_env_file /etc/limristem-mail.env
  limristem_mail_normalize_env_file /etc/limristem-mail-backup.env
fi

INSTALL_PATH=$(prompt_value "Percorso di installazione" "/opt/limristem-mail" "$INSTALL_PATH")
INSTALL_PATH=$(validate_install_path "$INSTALL_PATH")
DEFAULT_HOSTNAME=$(default_hostname)
if [[ "$DEFAULT_HOSTNAME" != *.* ]]; then
  DEFAULT_HOSTNAME=mail.example.com
fi
HOSTNAME_VALUE=$(prompt_value "Hostname FQDN del server mail" "$DEFAULT_HOSTNAME" "$HOSTNAME_VALUE")
HOSTNAME_VALUE=$(ensure_fqdn "$HOSTNAME_VALUE")
SSL_MODE=$(prompt_value "Modalità SSL (plain|selfsigned|letsencrypt)" "selfsigned" "$SSL_MODE")
case "$SSL_MODE" in
  plain|selfsigned|letsencrypt) ;;
  *)
    log "Modalità SSL non valida: $SSL_MODE"
    exit 1
    ;;
esac
if [[ "$SSL_MODE" == "letsencrypt" ]]; then
  LE_EMAIL=$(prompt_value "Email per Let's Encrypt" "postmaster@${HOSTNAME_VALUE#*.}" "$LE_EMAIL")
fi
if [[ -z "$PUBLIC_IP" ]]; then
  DETECTED_IPV4=$(curl -s4 -m 3 https://api64.ipify.org 2>/dev/null || curl -s4 -m 3 https://icanhazip.com 2>/dev/null || true)
else
  DETECTED_IPV4="$PUBLIC_IP"
fi
if [[ -z "$PUBLIC_IPV6" ]]; then
  DETECTED_IPV6=$(curl -s6 -m 3 https://api64.ipify.org 2>/dev/null || curl -s6 -m 3 https://icanhazip.com 2>/dev/null || true)
else
  DETECTED_IPV6="$PUBLIC_IPV6"
fi

PUBLIC_IP=$(prompt_value "IPv4 pubblico (0 per omettere)" "$DETECTED_IPV4" "$PUBLIC_IP")
PUBLIC_IPV6=$(prompt_value "IPv6 pubblico (0 per omettere)" "$DETECTED_IPV6" "$PUBLIC_IPV6")

if [[ "$PUBLIC_IP" == "0" ]]; then PUBLIC_IP=""; fi
if [[ "$PUBLIC_IPV6" == "0" ]]; then PUBLIC_IPV6=""; fi

if [[ -z "$PUBLIC_IP" && -z "$PUBLIC_IPV6" ]]; then
  log "ERRORE: Devi specificare almeno un indirizzo IP (IPv4 o IPv6)."
  exit 1
fi

DKIM_SELECTOR=$(prompt_value "DKIM selector" "default" "$DKIM_SELECTOR")
validate_ip_if_set "$PUBLIC_IP" 4
validate_ip_if_set "$PUBLIC_IPV6" 6
if [[ ! "$DKIM_SELECTOR" =~ ^[A-Za-z0-9_-]{1,63}$ ]]; then
  log "DKIM selector non valido: $DKIM_SELECTOR"
  exit 1
fi
ENABLE_API=$(prompt_bool "Attivare API di controllo" "yes" "$ENABLE_API")
ENABLE_NGINX=$(prompt_bool "Attivare Nginx per HTTPS / MTA-STS" "yes" "$ENABLE_NGINX")
ENABLE_RSPAMD=$(prompt_bool "Attivare Rspamd anti-spam" "yes" "$ENABLE_RSPAMD")
ENABLE_SRS=$(prompt_bool "Attivare SRS per forwarding" "yes" "$ENABLE_SRS")
ENABLE_WEB_PANEL=$(prompt_bool "Attivare piccolo pannello web HTTPS" "no" "$ENABLE_WEB_PANEL")
INSTALL_WEBMAIL=$(prompt_bool "Installare Webmail (Roundcube + PHP 8.4-FPM)" "yes" "$INSTALL_WEBMAIL")

UPDATE_CHANNEL=$(prompt_value "Canale di aggiornamento (stable|nightly)" "stable" "$UPDATE_CHANNEL")
if [[ "$UPDATE_CHANNEL" != "nightly" ]]; then
  UPDATE_CHANNEL="stable"
fi

if [[ "$ENABLE_WEB_PANEL" == "yes" ]]; then
  ENABLE_API=yes
  ENABLE_NGINX=yes
  if [[ "$SSL_MODE" == "plain" ]]; then
    log "Il pannello richiede HTTPS: imposto automaticamente SSL selfsigned."
    SSL_MODE=selfsigned
  fi
fi

if [[ "$SSL_MODE" == "letsencrypt" && "$ENABLE_NGINX" == "yes" ]]; then
  ENABLE_MTA_STS=$(prompt_bool "Attivare MTA-STS" "yes" "$ENABLE_MTA_STS")
else
  ENABLE_MTA_STS=no
fi
ENABLE_TLS_RPT=$(prompt_bool "Attivare TLS-RPT" "$ENABLE_MTA_STS" "$ENABLE_TLS_RPT")
ENABLE_BACKUP_TIMER=$(prompt_bool "Attivare timer backup" "yes" "$ENABLE_BACKUP_TIMER")
ENABLE_DELIVERABILITY_TIMER=$(prompt_bool "Attivare timer report deliverability" "no" "$ENABLE_DELIVERABILITY_TIMER")
if [[ "$ENABLE_NGINX" != "yes" ]]; then
  ENABLE_MTA_STS=no
fi

log "Riepilogo installazione"
log "- path: $INSTALL_PATH"
log "- hostname: $HOSTNAME_VALUE"
log "- ssl: $SSL_MODE"
log "- api: $ENABLE_API"
log "- nginx: $ENABLE_NGINX"
log "- rspamd: $ENABLE_RSPAMD"
log "- srs: $ENABLE_SRS"
log "- mta-sts: $ENABLE_MTA_STS"
log "- tls-rpt: $ENABLE_TLS_RPT"
log "- backup-timer: $ENABLE_BACKUP_TIMER"
log "- deliverability-timer: $ENABLE_DELIVERABILITY_TIMER"
log "- web-panel: $ENABLE_WEB_PANEL"
log "- webmail: $INSTALL_WEBMAIL"
log "- channel: $UPDATE_CHANNEL"

if [[ "$SSL_MODE" == "letsencrypt" && "$ASSUME_DNS_READY" != "yes" ]]; then
  log "Verifico i record DNS per Let's Encrypt..."
  if ! command -v dig >/dev/null 2>&1; then
    apt-get update -qq && apt-get install -yq dnsutils
  fi
  verify_domain() {
    local d=$1
    local ok=0
    if [[ -n "$PUBLIC_IP" ]]; then
      if dig +short -t A "$d" | grep -qx "$PUBLIC_IP"; then ok=1; fi
    fi
    if [[ -n "$PUBLIC_IPV6" ]]; then
      if dig +short -t AAAA "$d" | grep -qx "$PUBLIC_IPV6"; then ok=1; fi
    fi
    if [[ $ok -eq 0 ]]; then
      log "ERRORE: Il dominio $d non punta all'IP di questo server ($PUBLIC_IP / $PUBLIC_IPV6)."
      log "Configura il DNS (A o AAAA) e attendi la propagazione prima di installare."
      exit 1
    fi
  }
  verify_domain "$HOSTNAME_VALUE"
  if [[ "$ENABLE_MTA_STS" == "yes" ]]; then
    verify_domain "mta-sts.${HOSTNAME_VALUE}"
  fi
  log "Record DNS verificati con successo."
fi

export LIMRISTEM_MAIL_MTA_STS_HOST="mta-sts.${HOSTNAME_VALUE}"

if [[ "$NON_INTERACTIVE" != "yes" ]]; then
  confirm=$(prompt_bool "Procedere con l'installazione" "yes" "yes")
  if [[ "$confirm" != "yes" ]]; then
    log "Installazione annullata."
    exit 1
  fi
fi

if [[ "$DRY_RUN" == "yes" ]]; then
  log "Dry-run: nessuna modifica eseguita."
  exit 0
fi

sync_package

export LIMRISTEM_MAIL_BASE_DIR=$INSTALL_PATH
export LIMRISTEM_MAIL_HOSTNAME=$HOSTNAME_VALUE
export LIMRISTEM_MAIL_SSL_MODE=$SSL_MODE
export LIMRISTEM_MAIL_LE_EMAIL=$LE_EMAIL
export LIMRISTEM_MAIL_PUBLIC_IP=$PUBLIC_IP
export LIMRISTEM_MAIL_PUBLIC_IPV6=$PUBLIC_IPV6
export LIMRISTEM_MAIL_DKIM_SELECTOR=$DKIM_SELECTOR
export LIMRISTEM_MAIL_ENABLE_API=$ENABLE_API
export LIMRISTEM_MAIL_ENABLE_NGINX=$ENABLE_NGINX
export LIMRISTEM_MAIL_ENABLE_RSPAMD=$ENABLE_RSPAMD
export LIMRISTEM_MAIL_ENABLE_SRS=$ENABLE_SRS
export LIMRISTEM_MAIL_ENABLE_MTA_STS=$ENABLE_MTA_STS
export LIMRISTEM_MAIL_ENABLE_TLS_RPT=$ENABLE_TLS_RPT
export LIMRISTEM_MAIL_ENABLE_BACKUP_TIMER=$ENABLE_BACKUP_TIMER
export LIMRISTEM_MAIL_ENABLE_DELIVERABILITY_TIMER=$ENABLE_DELIVERABILITY_TIMER
export LIMRISTEM_MAIL_ENABLE_WEB_PANEL=$ENABLE_WEB_PANEL
export LIMRISTEM_MAIL_INSTALL_WEBMAIL=$INSTALL_WEBMAIL
export LIMRISTEM_MAIL_UPDATE_CHANNEL=$UPDATE_CHANNEL
export LIMRISTEM_MAIL_ASSUME_DNS_READY=$ASSUME_DNS_READY
export LIMRISTEM_MAIL_UPDATE_MODE=$UPDATE_MODE
export LIMRISTEM_MAIL_OVERWRITE_MODE=$OVERWRITE_MODE
export LIMRISTEM_MAIL_LOG_FILE=/var/log/limristem-mail-install.log

cd "$INSTALL_PATH"
if [[ ! -f ./bin/install.sh ]]; then
  log "Runtime installer mancante: ./bin/install.sh non trovato dopo sync_package."
  exit 1
fi
chmod 0755 ./bin/install.sh
exec bash ./bin/install.sh