#!/bin/bash
# ==============================================================================
# WALLARM DEPLOYMENT SCRIPT - V1.0 (Native deployment)
# ==============================================================================
# Purpose: Deploy Wallarm filtering node natively (NO Docker) after preflight
# Features:
# - Reads preflight check results from .env file
# - Interactive configuration (cloud region, ports, token, upstream)
# - Downloads and runs the official Wallarm all-in-one installer (meganode.wallarm.com)
# - Configures NGINX server block (proxy, wallarm_mode, trusted proxies, health)
# - Deployment verification (health endpoint, wallarm-status, node registration)
# - DAU-friendly error handling with remediation
# ==============================================================================

# Script location and shared library (colors, logging, validation, detection, connectivity)
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
# shellcheck source=../common/wallarm-lib.sh
source "$SCRIPT_DIR/../common/wallarm-lib.sh"

# Strict error handling
set -euo pipefail
trap early_error_handler ERR

# Configuration
ENV_FILE=".env"
LOG_FILE="${HOME:-.}/logs/wallarm-deployment-native.log"

# Wallarm all-in-one installer (current recommended native install method)
# Override WALLARM_VERSION to pin a different version.
WALLARM_VERSION="${WALLARM_VERSION:-6.12.7}"
INSTALLER_BASE_URL="https://meganode.wallarm.com/${WALLARM_VERSION%.*}"

# Optional node labels for the installer (e.g. 'group=prod')
WALLARM_LABELS="${WALLARM_LABELS:-}"

# Deployment variables (set during execution)
CLOUD_REGION=""
API_HOST=""
INGRESS_PORT=""
UPSTREAM_IP=""
UPSTREAM_PORT=""
WALLARM_TOKEN=""
INSTANCE_NAME=""
INSTANCE_DIR=""
NGINX_CONFIG=""

# Resource reachability from check script
US_CLOUD_REACHABLE="false"
EU_CLOUD_REACHABLE="false"
INSTALLER_REACHABLE="false"

# ==============================================================================
# PREFLIGHT CHECK VERIFICATION
# ==============================================================================

verify_preflight_check() {
    log_message "INFO" "Verifying preflight check results..."

    if [ ! -f "$ENV_FILE" ]; then
        log_message "ERROR" "Preflight check file not found: $ENV_FILE"
        echo -e "\n${YELLOW}Preflight check has not been run or .env file is missing.${NC}"
        echo -e "${YELLOW}Would you like to run the preflight check now?${NC}"
        read -r -p "$(echo -e "${YELLOW}Run preflight check? (Y/n): ${NC}")" -n 1
        echo
        if [[ ! $REPLY =~ ^[Nn]$ ]]; then
            echo -e "${CYAN}Running preflight check...${NC}"
            if ! "$SCRIPT_DIR/wallarm-ct-check.sh"; then
                fail_with_remediation "Preflight check failed" \
                    "Run the preflight check manually and fix any issues:
1. $SCRIPT_DIR/wallarm-ct-check.sh
2. Review the errors in $ENV_FILE
3. Fix the issues and run this script again"
            fi
        else
            fail_with_remediation "Preflight check required" \
                "Run the preflight check before deployment:
1. $SCRIPT_DIR/wallarm-ct-check.sh
2. Review results in $ENV_FILE
3. Run this script again"
        fi
    fi

    # Load environment variables from .env file (from shared library)
    if ! load_env_file "$ENV_FILE"; then
        fail_with_remediation "Cannot load preflight results" \
            "The preflight check results file could not be read.
1. Run the preflight check: $SCRIPT_DIR/wallarm-ct-check.sh
2. Verify $ENV_FILE exists and is readable
3. Run this script again"
    fi

    if [ "${CHECK_RESULT:-}" != "pass" ]; then
        log_message "ERROR" "Preflight check failed (result: $CHECK_RESULT)"
        echo -e "\n${YELLOW}Preflight check found issues. Please review:${NC}"
        echo -e "${YELLOW}1. Check file: $ENV_FILE${NC}"
        echo -e "${YELLOW}2. Run: $SCRIPT_DIR/wallarm-ct-check.sh${NC}"
        echo -e "${YELLOW}3. Fix the issues and try again${NC}"
        exit 1
    fi

    log_message "SUCCESS" "Preflight check verified:"
    log_message "SUCCESS" "  OS: $OS_NAME $OS_VERSION"
    log_message "SUCCESS" "  Architecture: $ARCHITECTURE"
    log_message "SUCCESS" "  Init System: $INIT_SYSTEM"
    log_message "SUCCESS" "  US Cloud Reachable: $US_CLOUD_REACHABLE"
    log_message "SUCCESS" "  EU Cloud Reachable: $EU_CLOUD_REACHABLE"
    log_message "SUCCESS" "  Wallarm Installer Reachable: $INSTALLER_REACHABLE"

    # Validate we have at least one cloud region reachable
    if [ "$US_CLOUD_REACHABLE" = "false" ] && [ "$EU_CLOUD_REACHABLE" = "false" ]; then
        fail_with_remediation "No Wallarm cloud region reachable" \
            "Network connectivity issues detected:
1. Check firewall rules for Wallarm cloud endpoints
2. Verify network connectivity
3. Run preflight check again: $SCRIPT_DIR/wallarm-ct-check.sh"
    fi

    # The all-in-one installer must be reachable for a native deployment
    if [ "$INSTALLER_REACHABLE" != "true" ]; then
        fail_with_remediation "Wallarm all-in-one installer not reachable" \
            "Native deployment requires access to the Wallarm all-in-one installer:
1. Verify network access to $INSTALLER_BASE_URL
2. Check the current version at https://docs.wallarm.com/updating-migrating/node-artifact-versions/
3. Pin the version with: WALLARM_VERSION=<version> sudo ./$0"
    fi
}

# ==============================================================================
# CONFIGURATION COLLECTION
# ==============================================================================
# select_cloud_region, validate_ip_address and check_port_available are provided
# by the shared library (../common/wallarm-lib.sh).

collect_configuration() {
    log_message "INFO" "Collecting deployment configuration..."

    # Get ingress port
    local default_port=80
    local ingress_port=""
    while [[ ! "$ingress_port" =~ ^[0-9]+$ ]] || [ "$ingress_port" -lt 1 ] || [ "$ingress_port" -gt 65535 ]; do
        read -r -p "$(echo -e "${YELLOW}Enter inbound port [${default_port}]: ${NC}")" ingress_port
        ingress_port="${ingress_port:-$default_port}"

        if [[ ! "$ingress_port" =~ ^[0-9]+$ ]]; then
            echo -e "${RED}Port must be a number${NC}"
        elif [ "$ingress_port" -lt 1 ] || [ "$ingress_port" -gt 65535 ]; then
            echo -e "${RED}Port must be between 1 and 65535${NC}"
        elif ! check_port_available "$ingress_port"; then
            echo -e "${RED}Port $ingress_port is already in use${NC}"
            ingress_port=""
        fi
    done

    # Get application server details
    local upstream_ip=""
    local upstream_port=""

    echo -e "\n${CYAN}${BOLD}Application Server Configuration:${NC}"
    echo -e "${YELLOW}Enter the IP/hostname and port of your backend application${NC}"

    while [[ -z "$upstream_ip" ]]; do
        read -r -p "$(echo -e "${YELLOW}Upstream App IP/Hostname [127.0.0.1]: ${NC}")" upstream_ip
        upstream_ip="${upstream_ip:-127.0.0.1}"

        if ! validate_ip_address "$upstream_ip" && \
           ! [[ "$upstream_ip" =~ ^[a-zA-Z0-9][a-zA-Z0-9.-]*[a-zA-Z0-9]$ ]]; then
            echo -e "${RED}Invalid IP/hostname format${NC}"
            upstream_ip=""
        fi
    done

    while [[ ! "$upstream_port" =~ ^[0-9]+$ ]] || [ "$upstream_port" -lt 1 ] || [ "$upstream_port" -gt 65535 ]; do
        read -r -p "$(echo -e "${YELLOW}Upstream App Port [8080]: ${NC}")" upstream_port
        upstream_port="${upstream_port:-8080}"

        if [[ ! "$upstream_port" =~ ^[0-9]+$ ]]; then
            echo -e "${RED}Port must be a number${NC}"
        elif [ "$upstream_port" -lt 1 ] || [ "$upstream_port" -gt 65535 ]; then
            echo -e "${RED}Port must be between 1 and 65535${NC}"
        fi
    done

    # Verify application server reachability
    log_message "INFO" "Verifying application server reachability..."
    if timeout 5 bash -c "cat < /dev/null > /dev/tcp/$upstream_ip/$upstream_port" 2>/dev/null; then
        log_message "SUCCESS" "Application server $upstream_ip:$upstream_port is reachable"
    else
        log_message "WARNING" "Application server $upstream_ip:$upstream_port is not reachable"
        echo -e "${YELLOW}${BOLD}Warning:${NC} Cannot reach application server at $upstream_ip:$upstream_port"
        echo -e "${YELLOW}This may cause the Wallarm node to fail. Possible reasons:${NC}"
        echo -e "1. Application server is not running"
        echo -e "2. Firewall blocking port $upstream_port"
        echo -e "3. Wrong IP/hostname"
        echo -e "4. Application server not listening on that port"

        read -r -p "$(echo -e "${YELLOW}Continue anyway? (y/N): ${NC}")" -n 1
        echo
        if [[ ! $REPLY =~ ^[Yy]$ ]]; then
            fail_with_remediation "Application server unreachable" \
                "Ensure your application server is accessible:
1. Start your application server
2. Check it's listening: sudo ss -tlnp | grep :$upstream_port
3. Verify firewall rules allow inbound connections
4. Test connectivity: telnet $upstream_ip $upstream_port
5. If using hostname, verify DNS resolution: nslookup $upstream_ip"
        fi
    fi

    # Get Wallarm node token
    local wallarm_token=""
    echo -e "\n${CYAN}${BOLD}Wallarm Node Token:${NC}"
    echo -e "${YELLOW}Get your token from Wallarm Console:${NC}"
    echo -e "Create a new 'Wallarm node' and copy the token (will be visible as you type)"
    while [[ -z "$wallarm_token" ]]; do
        read -r -p "$(echo -e "${YELLOW}Paste Wallarm Node Token: ${NC}")" wallarm_token
        wallarm_token=$(echo "$wallarm_token" | tr -d '[:space:]')

        if [[ -z "$wallarm_token" ]]; then
            echo -e "${RED}Token cannot be empty${NC}"
        elif [[ ! "$wallarm_token" =~ ^[A-Za-z0-9_+/=\-]+$ ]]; then
            echo -e "${RED}Token contains invalid characters. Wallarm tokens are base64 strings (A-Z, a-z, 0-9, _, -, +, /, =)${NC}"
            echo -e "${YELLOW}First 20 chars of what you entered: '${wallarm_token:0:20}...'${NC}"
            wallarm_token=""
        else
            token_length=${#wallarm_token}
            echo -e "${GREEN}Token accepted (${token_length} characters).${NC}"
            echo -e "${YELLOW}First 8 chars for verification: ${wallarm_token:0:8}...${NC}"
        fi
    done

    # Get trusted proxy IPs for real IP configuration
    local trusted_proxies=""
    echo -e "\n${CYAN}${BOLD}Real Client IP Configuration:${NC}"
    echo -e "${YELLOW}For Wallarm to see the real client IP, specify the IP address(es) of trusted proxies"
    echo -e "(e.g., load balancers, firewalls, CDNs) that forward traffic to this node.${NC}"
    echo -e "${YELLOW}You can enter:${NC}"
    echo -e "  - Single IP: 10.0.0.10"
    echo -e "  - CIDR range: 10.0.0.0/24"
    echo -e "  - Multiple entries separated by spaces: 10.0.0.10 10.0.1.0/24 192.168.1.1"
    echo -e "${YELLOW}If unsure, you can leave empty and configure later${NC}"

    read -r -p "$(echo -e "${YELLOW}Trusted proxy IPs/CIDRs (space-separated): ${NC}")" trusted_proxies_input

    local validated_proxies=()
    if [[ -n "$trusted_proxies_input" ]]; then
        IFS=' ' read -ra proxy_array <<< "$trusted_proxies_input"

        for proxy in "${proxy_array[@]}"; do
            proxy=$(echo "$proxy" | xargs)
            if [[ -n "$proxy" ]]; then
                if validate_ip_or_cidr "$proxy"; then
                    validated_proxies+=("$proxy")
                else
                    echo -e "${RED}Invalid IP/CIDR format: $proxy${NC}"
                    echo -e "${YELLOW}Example valid formats: 10.0.0.10, 10.0.0.0/24, 192.168.1.1${NC}"
                fi
            fi
        done

        if [[ ${#validated_proxies[@]} -eq 0 ]]; then
            echo -e "${YELLOW}No valid proxy IPs provided. Will skip set_real_ip_from configuration.${NC}"
            echo -e "${YELLOW}You can configure it later with the reconfigure script.${NC}"
            trusted_proxies=""
        else
            trusted_proxies="${validated_proxies[*]}"
            echo -e "${GREEN}Trusted proxies configured: $trusted_proxies${NC}"
        fi
    else
        echo -e "${YELLOW}No trusted proxies specified. The node will see the last hop IP only.${NC}"
    fi

    # Generate instance name and directory
    local instance_name
    instance_name="wallarm-$(hostname -s | tr '[:upper:]' '[:lower:]')-$(date +%Y%m%d)"
    local instance_dir="/opt/wallarm/$instance_name"

    sudo mkdir -p "$instance_dir"

    log_message "SUCCESS" "Configuration collected:"
    log_message "SUCCESS" "  Ingress Port: $ingress_port"
    log_message "SUCCESS" "  Upstream: $upstream_ip:$upstream_port"
    if [[ -n "$trusted_proxies" ]]; then
        log_message "SUCCESS" "  Trusted Proxies: $trusted_proxies"
    else
        log_message "INFO" "  Trusted Proxies: Not configured (will need manual setup)"
    fi
    log_message "SUCCESS" "  Instance: $instance_name"
    log_message "SUCCESS" "  Directory: $instance_dir"

    INGRESS_PORT="$ingress_port"
    UPSTREAM_IP="$upstream_ip"
    UPSTREAM_PORT="$upstream_port"
    WALLARM_TOKEN="$wallarm_token"
    INSTANCE_NAME="$instance_name"
    INSTANCE_DIR="$instance_dir"
    TRUSTED_PROXIES="$trusted_proxies"
}

# ==============================================================================
# WALLARM NATIVE INSTALLATION (all-in-one installer)
# ==============================================================================

install_wallarm_native() {
    log_message "INFO" "Installing Wallarm filtering node natively (all-in-one installer)..."

    # Select the correct installer for the detected architecture
    local arch_suffix
    case "$ARCHITECTURE" in
        "x86_64")  arch_suffix="x86_64-glibc" ;;
        "aarch64") arch_suffix="aarch64-glibc" ;;
        *)
            fail_with_remediation "Unsupported architecture for native install: $ARCHITECTURE" \
                "The Wallarm all-in-one installer supports x86_64 and aarch64.
1. Check architecture: uname -m
2. If you are on a 32-bit system, consider the Docker deployment instead.
3. See https://docs.wallarm.com/installation/nginx/all-in-one/ for supported platforms."
            ;;
    esac

    local installer_name="wallarm-${WALLARM_VERSION}.${arch_suffix}.sh"
    local installer_url="${INSTALLER_BASE_URL}/${installer_name}"

    log_message "INFO" "Downloading Wallarm installer: $installer_name"
    if ! download_from_git "$installer_url" "$installer_name" "Wallarm all-in-one installer"; then
        fail_with_remediation "Failed to download Wallarm installer" \
            "Could not download $installer_url
1. Verify network access to meganode.wallarm.com
2. Check the current version at https://docs.wallarm.com/updating-migrating/node-artifact-versions/
3. Pin the version with: WALLARM_VERSION=<version> sudo ./$0"
    fi

    chmod +x "$installer_name"

    # Build installer arguments (batch mode)
    local install_args="-- --batch -t $WALLARM_TOKEN"
    if [ "$CLOUD_REGION" = "US" ]; then
        install_args="$install_args -c US"
        log_message "INFO" "Using US cloud (us1.api.wallarm.com)"
    else
        log_message "INFO" "Using EU cloud (api.wallarm.com)"
    fi

    # Run the installer (batch mode). The installer registers the node with the
    # token and configures NGINX + the Wallarm module automatically.
    log_message "INFO" "Running Wallarm all-in-one installer (this may take several minutes)..."
    if [ -n "$WALLARM_LABELS" ]; then
        log_message "INFO" "Using node labels: $WALLARM_LABELS"
        if ! sudo env WALLARM_LABELS="$WALLARM_LABELS" sh "$installer_name" $install_args; then
            rm -f "$installer_name"
            fail_with_remediation "Wallarm installer failed" \
                "The all-in-one installer exited with an error. Check:
1. The installer log output above for the exact error
2. Token validity in the Wallarm Console
3. Network access to Wallarm repositories (the installer adds them automatically)
4. Disk space and memory: df -h / && free -h
5. Retry with a higher log verbosity, or see https://docs.wallarm.com/installation/nginx/all-in-one/"
        fi
    else
        if ! sudo sh "$installer_name" $install_args; then
            rm -f "$installer_name"
            fail_with_remediation "Wallarm installer failed" \
                "The all-in-one installer exited with an error. Check:
1. The installer log output above for the exact error
2. Token validity in the Wallarm Console
3. Network access to Wallarm repositories (the installer adds them automatically)
4. Disk space and memory: df -h / && free -h
5. Retry with a higher log verbosity, or see https://docs.wallarm.com/installation/nginx/all-in-one/"
        fi
    fi

    rm -f "$installer_name"
    log_message "SUCCESS" "Wallarm all-in-one installer completed"

    # Verify the node was registered
    if [ -f "/opt/wallarm/etc/wallarm/node.yaml" ]; then
        log_message "SUCCESS" "Wallarm node configuration found: /opt/wallarm/etc/wallarm/node.yaml"
    else
        log_message "WARNING" "Wallarm node configuration not found at /opt/wallarm/etc/wallarm/node.yaml"
        echo -e "${YELLOW}The node may not have been registered. Check the installer output.${NC}"
    fi
}

# ==============================================================================
# NGINX CONFIGURATION
# ==============================================================================

# Detect existing NGINX server blocks that would conflict with our ingress port
# and disable the default site if necessary.
resolve_port_conflict() {
    local port="$1"

    log_message "INFO" "Checking for NGINX config conflicts on port $port..."

    # Only relevant for default port 80 where distro default sites listen
    if [ "$port" != "80" ]; then
        return 0
    fi

    # Look for default server blocks listening on port 80
    local conflicting
    conflicting=$(grep -rl "listen.*80" /etc/nginx/sites-enabled/ /etc/nginx/conf.d/ 2>/dev/null | head -1 || true)

    if [ -n "$conflicting" ]; then
        log_message "WARNING" "Default NGINX site found: $conflicting"
        echo -e "${YELLOW}The default site listens on port 80 and may conflict with the Wallarm node.${NC}"
        read -r -p "$(echo -e "${YELLOW}Disable it (backup to .bak)? (Y/n): ${NC}")" -n 1
        echo
        if [[ ! $REPLY =~ ^[Nn]$ ]]; then
            sudo mv "$conflicting" "${conflicting}.bak"
            log_message "SUCCESS" "Disabled $conflicting (backup: ${conflicting}.bak)"
        else
            log_message "WARNING" "Keeping default site. The Wallarm node may not receive traffic on port 80."
        fi
    fi
}

create_nginx_config() {
    NGINX_CONFIG="/etc/nginx/conf.d/wallarm-${INSTANCE_NAME}.conf"

    log_message "INFO" "Creating NGINX configuration: $NGINX_CONFIG"

    # Also keep a copy in the instance directory for reference/backup
    sudo tee "$NGINX_CONFIG" > /dev/null <<EOF
# Wallarm filtering node: $INSTANCE_NAME
# Generated: $(date)
server {
    listen $INGRESS_PORT;
    server_name _;
EOF

    # Add set_real_ip_from directives if trusted proxies are configured
    if [[ -n "$TRUSTED_PROXIES" ]]; then
        for proxy in $TRUSTED_PROXIES; do
            sudo tee -a "$NGINX_CONFIG" > /dev/null <<EOF
    set_real_ip_from  $proxy;
EOF
        done
        sudo tee -a "$NGINX_CONFIG" > /dev/null <<EOF
    real_ip_header    X-Real-IP;
    real_ip_recursive on;
EOF
    fi

    # Add the rest of the configuration
    sudo tee -a "$NGINX_CONFIG" > /dev/null <<EOF

    location / {
        proxy_pass http://$UPSTREAM_IP:$UPSTREAM_PORT;
        proxy_set_header Host \$host;
        proxy_set_header X-Real-IP \$remote_addr;
        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto \$scheme;
        proxy_set_header X-Forwarded-Server \$http_x_forwarded_server;

        # Wallarm directives
        wallarm_mode monitoring;
    }

    # Health check endpoint
    location /health {
        access_log off;
        return 200 "healthy\n";
        add_header Content-Type text/plain;
    }
}
EOF

    # Keep a reference copy in the instance directory
    sudo cp "$NGINX_CONFIG" "$INSTANCE_DIR/nginx.conf"
    log_message "SUCCESS" "NGINX configuration created: $NGINX_CONFIG"
    if [[ -n "$TRUSTED_PROXIES" ]]; then
        log_message "INFO" "  Configured trusted proxies: $TRUSTED_PROXIES"
    else
        log_message "INFO" "  No trusted proxies configured - real client IP detection may be limited"
    fi
}

reload_nginx() {
    log_message "INFO" "Testing and reloading NGINX..."

    if ! sudo nginx -t 2>&1 | tee "$INSTANCE_DIR/nginx-test.log"; then
        fail_with_remediation "NGINX configuration test failed" \
            "NGINX rejected the configuration. Check the test output above.
1. Review the generated config: $NGINX_CONFIG
2. Look for port conflicts or syntax errors
3. Restore the backup if the default site was disabled
4. Manual test: sudo nginx -t"
    fi

    # Reload according to init system
    case "${INIT_SYSTEM:-systemd}" in
        "systemd")
            sudo systemctl reload nginx 2>/dev/null || sudo systemctl restart nginx
            ;;
        "openrc")
            sudo rc-service nginx reload 2>/dev/null || sudo rc-service nginx restart
            ;;
        "sysvinit")
            sudo service nginx reload 2>/dev/null || sudo service nginx restart
            ;;
        *)
            sudo nginx -s reload 2>/dev/null || true
            ;;
    esac

    log_message "SUCCESS" "NGINX reloaded with Wallarm configuration"
}

# ==============================================================================
# DEPLOYMENT VERIFICATION
# ==============================================================================

verify_deployment() {
    log_message "INFO" "Verifying native Wallarm deployment..."

    # Test ingress port
    log_message "INFO" "Testing ingress port $INGRESS_PORT..."
    if ! check_port_available "$INGRESS_PORT"; then
        log_message "SUCCESS" "Ingress port $INGRESS_PORT is in use (as expected)"
    else
        log_message "WARNING" "Ingress port $INGRESS_PORT appears available (NGINX may not be listening)"
    fi

    # Test health check endpoint
    log_message "INFO" "Testing health check endpoint..."
    local health_check_url="http://localhost:$INGRESS_PORT/health"
    if curl -sf --connect-timeout 5 "$health_check_url" >/dev/null 2>&1; then
        log_message "SUCCESS" "Health check endpoint responsive"
    else
        log_message "WARNING" "Health check endpoint not responsive (may need time to start)"
        sleep 5
        if curl -sf --connect-timeout 5 "$health_check_url" >/dev/null 2>&1; then
            log_message "SUCCESS" "Health check endpoint now responsive"
        else
            log_message "WARNING" "Health check endpoint still not responsive (check nginx config)"
        fi
    fi

    # Test handshake through filtering node
    log_message "INFO" "Testing handshake through filtering node to upstream..."
    local test_url="http://localhost:$INGRESS_PORT/"
    if curl -sfI --connect-timeout 10 "$test_url" >/dev/null 2>&1; then
        log_message "SUCCESS" "Handshake successful: filtering node can reach upstream"
    else
        log_message "WARNING" "Handshake failed (upstream may not be responding)"
        log_message "INFO" "Checking if upstream is directly reachable..."
        if timeout 5 bash -c "cat < /dev/null > /dev/tcp/$UPSTREAM_IP/$UPSTREAM_PORT" 2>/dev/null; then
            log_message "ERROR" "Upstream is reachable but filtering node cannot proxy"
            echo -e "${YELLOW}Possible NGINX configuration issue. Check:${NC}"
            echo -e "1. NGINX error log: sudo tail -50 /var/log/nginx/error.log"
            echo -e "2. NGINX config: $NGINX_CONFIG"
        else
            log_message "WARNING" "Upstream server is not reachable (as previously warned)"
        fi
    fi

    # Check Wallarm module status endpoint
    log_message "INFO" "Checking Wallarm module status..."
    if curl -sf --connect-timeout 5 "http://127.0.0.8/wallarm-status" >/dev/null 2>&1; then
        log_message "SUCCESS" "Wallarm module is active (wallarm-status responsive)"
    else
        log_message "WARNING" "wallarm-status not responsive (module may need more time or a restart)"
    fi

    # Check node registration file
    if [ -f "/opt/wallarm/etc/wallarm/node.yaml" ]; then
        log_message "SUCCESS" "Node is registered (node.yaml present)"
    else
        log_message "WARNING" "node.yaml not found - node may not be registered with the cloud"
    fi

    log_message "SUCCESS" "Deployment verification completed"
    echo -e "\n${GREEN}${BOLD}Verification Summary:${NC}"
    echo -e "  ${GREEN}✓${NC} NGINX + Wallarm module installed"
    echo -e "  ${GREEN}✓${NC} Ingress port: $INGRESS_PORT"
    echo -e "  ${GREEN}✓${NC} Upstream: $UPSTREAM_IP:$UPSTREAM_PORT"
    echo -e "  ${GREEN}✓${NC} Cloud region: $CLOUD_REGION ($API_HOST)"
}

# ==============================================================================
# MAIN FUNCTION
# ==============================================================================

main() {
    clear
    echo -e "${BLUE}${BOLD}"
    echo "╔══════════════════════════════════════════════════════════════╗"
    echo "║       WALLARM DEPLOYMENT SCRIPT (Native) - V1.0              ║"
    echo "║      Filtering Node Deployment Without Docker               ║"
    echo "╚══════════════════════════════════════════════════════════════╝${NC}"
    echo -e "\n${YELLOW}Starting deployment at: $(date)${NC}"

    # Initialize logging
    local log_dir="${HOME:-.}/logs"
    if [ ! -d "$log_dir" ]; then
        if ! mkdir -p "$log_dir"; then
            echo -e "${YELLOW}Cannot create log directory $log_dir, falling back to current directory...${NC}"
            log_dir="."
        fi
    fi

    LOG_FILE="$log_dir/wallarm-deployment-native.log"
    if ! : > "$LOG_FILE"; then
        echo -e "${RED}Cannot create log file at $LOG_FILE${NC}"
        echo -e "${YELLOW}Falling back to current directory...${NC}"
        LOG_FILE="./wallarm-deployment-native.log"
        : > "$LOG_FILE" 2>/dev/null || true
    fi
    if ! chmod 644 "$LOG_FILE" 2>/dev/null; then
        echo -e "${YELLOW}Warning: Could not set permissions on log file${NC}"
    fi

    log_message "INFO" "=== Wallarm Native Deployment Started ==="

    if [ "$INSECURE_SSL" = "1" ]; then
        log_message "WARNING" "SSL certificate validation is DISABLED (insecure). Set WALLARM_INSECURE_SSL=0 to enable validation."
    fi

    # Phase 1: Verify preflight check
    log_message "INFO" "=== PHASE 1: PREFLIGHT CHECK VERIFICATION ==="
    verify_preflight_check

    # Phase 2: Configuration collection
    log_message "INFO" "=== PHASE 2: CONFIGURATION COLLECTION ==="
    select_cloud_region
    collect_configuration

    # Phase 3: Native installation (all-in-one installer)
    log_message "INFO" "=== PHASE 3: WALLARM NATIVE INSTALLATION ==="
    install_wallarm_native

    # Phase 4: NGINX configuration
    log_message "INFO" "=== PHASE 4: NGINX CONFIGURATION ==="
    resolve_port_conflict "$INGRESS_PORT"
    create_nginx_config
    reload_nginx

    # Phase 5: Verification
    log_message "INFO" "=== PHASE 5: VERIFICATION ==="
    verify_deployment

    # Success message
    log_message "SUCCESS" "=== WALLARM NATIVE DEPLOYMENT COMPLETED SUCCESSFULLY ==="
    echo -e "\n${GREEN}${BOLD}╔══════════════════════════════════════════════════════════════╗${NC}"
    echo -e "${GREEN}${BOLD}║        WALLARM FILTERING NODE DEPLOYMENT SUCCESSFUL          ║${NC}"
    echo -e "${GREEN}${BOLD}╚══════════════════════════════════════════════════════════════╝${NC}"
    echo -e "\n${CYAN}The Wallarm filtering node is now active and protecting your application.${NC}"
    echo -e "${YELLOW}Full deployment log: $LOG_FILE${NC}"
    echo -e "${YELLOW}Instance directory: $INSTANCE_DIR${NC}"
    echo -e "\n${GREEN}To stop the node:${NC} sudo systemctl stop nginx"
    echo -e "${GREEN}To restart:${NC} sudo systemctl restart nginx"
    echo -e "${GREEN}To view logs:${NC} sudo tail -f /var/log/nginx/error.log"
    echo -e "${GREEN}Node status:${NC} curl http://127.0.0.8/wallarm-status"
    echo -e "\n${MAGENTA}${BOLD}Deployment completed successfully!${NC}"
    echo -e "\n${YELLOW}Important next steps:${NC}"
    echo -e "1. Monitor sync status in Wallarm Console"
    echo -e "2. Test attack detection with safe test: curl http://localhost:$INGRESS_PORT/?wallarm_test=1"
    echo -e "3. Review logs periodically: sudo tail -50 /var/log/nginx/error.log"
    echo -e "4. Switch to block mode after validation: sudo ./native/wallarm-ct-reconfigure.sh"
}

# ==============================================================================
# SCRIPT EXECUTION
# ==============================================================================

# Ensure we're in bash
if [ -z "$BASH_VERSION" ]; then
    echo "Error: This script must be run with bash" >&2
    exit 1
fi

# Run main function
main "$@"