install.sh

#!/usr/bin/env bash
#
# TransferCLI installer
# Usage:
#   curl -fsSL https://raw.githubusercontent.com/codingsecurity/transfercli/main/install.sh | sudo bash
#
# Optional env vars:
#   TC_DOMAIN          - domain for nginx+HTTPS (e.g. files.example.com)
#   TC_EMAIL           - email for Let's Encrypt (required with TC_DOMAIN)
#   TC_ADMIN_USER      - basic auth username (default: admin)
#   TC_ADMIN_PASSWORD  - basic auth password (default: random 16 chars)
#   TC_PORT_UPLOAD     - transfer.sh listen port (default: 8081)
#   TC_PORT_ADMIN      - admin panel listen port (default: 8082)
#   TC_PURGE_DAYS      - auto-purge after N days (default: 30)
#   TC_TITLE           - admin panel title (default: TransferCLI)
#   TC_REPO            - install source (default: codingsecurity/transfercli)
#   TC_VERSION         - release tag (default: latest, source build fallback)

set -euo pipefail

# ---------- config ----------
REPO="${TC_REPO:-codingsecurity/transfercli}"
VERSION="${TC_VERSION:-main}"
PORT_UPLOAD="${TC_PORT_UPLOAD:-8081}"
PORT_ADMIN="${TC_PORT_ADMIN:-8082}"
PURGE_DAYS="${TC_PURGE_DAYS:-30}"
ADMIN_USER="${TC_ADMIN_USER:-admin}"
ADMIN_PASSWORD="${TC_ADMIN_PASSWORD:-}"
TITLE="${TC_TITLE:-TransferCLI}"
DOMAIN="${TC_DOMAIN:-}"
EMAIL="${TC_EMAIL:-}"

TRANSFERSH_VERSION="v1.6.1"

# ---------- helpers ----------
log()  { printf '\033[1;34m[*]\033[0m %s\n' "$*"; }
ok()   { printf '\033[1;32m[+]\033[0m %s\n' "$*"; }
warn() { printf '\033[1;33m[!]\033[0m %s\n' "$*"; }
err()  { printf '\033[1;31m[x]\033[0m %s\n' "$*" >&2; exit 1; }

require_root() {
    [ "$(id -u)" -eq 0 ] || err "Must run as root. Try: sudo $0"
}

detect_os() {
    [ -f /etc/os-release ] || err "Cannot detect OS (no /etc/os-release)"
    . /etc/os-release
    case "$ID" in
        debian|ubuntu) ;;
        *) err "Unsupported OS: $ID. Currently supports Debian/Ubuntu." ;;
    esac
}

detect_arch() {
    case "$(uname -m)" in
        x86_64)  echo amd64 ;;
        aarch64) echo arm64 ;;
        armv7l)  echo arm ;;
        *) err "Unsupported arch: $(uname -m)" ;;
    esac
}

install_pkgs() {
    log "Installing prerequisites..."
    export DEBIAN_FRONTEND=noninteractive
    apt-get update -qq
    apt-get install -y curl tar openssl apache2-utils >/dev/null
    if [ -n "$DOMAIN" ]; then
        apt-get install -y nginx certbot python3-certbot-nginx >/dev/null
    fi
}

ensure_user() {
    if ! id transfercli >/dev/null 2>&1; then
        log "Creating transfercli system user..."
        useradd -r -s /usr/sbin/nologin -d /var/lib/transfercli transfercli
    fi
}

download_transfersh() {
    local arch
    arch=$(detect_arch)
    local url="https://github.com/dutchcoders/transfer.sh/releases/download/${TRANSFERSH_VERSION}/transfersh-${TRANSFERSH_VERSION}-linux-${arch}"
    log "Downloading transfer.sh ${TRANSFERSH_VERSION} (${arch})..."
    mkdir -p /opt/transfercli
    curl -fsSL "$url" -o /opt/transfercli/transfersh
    chmod +x /opt/transfercli/transfersh
    ok "transfer.sh installed: $(/opt/transfercli/transfersh version 2>&1 | head -1 || true)"
}

download_admin() {
    local arch
    arch=$(detect_arch)
    local release_url="https://github.com/${REPO}/releases/latest/download/transfercli-admin-linux-${arch}"

    log "Downloading TransferCLI admin binary..."
    if curl -fsSL --head "$release_url" >/dev/null 2>&1; then
        curl -fsSL "$release_url" -o /opt/transfercli/transfercli-admin
        chmod +x /opt/transfercli/transfercli-admin
        ok "transfercli-admin installed from release"
        return
    fi

    warn "No prebuilt binary available, building from source..."
    if ! command -v go >/dev/null 2>&1; then
        log "Installing Go..."
        apt-get install -y golang-go >/dev/null
    fi

    local tmp
    tmp=$(mktemp -d)
    trap "rm -rf $tmp" EXIT
    curl -fsSL "https://github.com/${REPO}/archive/${VERSION}.tar.gz" | tar -xz -C "$tmp" --strip-components=1
    (cd "$tmp/admin" && go build -o /opt/transfercli/transfercli-admin main.go)
    ok "transfercli-admin built from source"
}

create_dirs() {
    log "Creating directories..."
    mkdir -p /var/lib/transfercli/uploads /var/lib/transfercli/temp /etc/transfercli
    chown -R transfercli:transfercli /var/lib/transfercli
    chmod 700 /etc/transfercli
}

write_env_files() {
    log "Writing config files..."
    cat > /etc/transfercli.env <<EOF
# transfer.sh backend config (auto-generated by TransferCLI)
TC_PORT_UPLOAD=${PORT_UPLOAD}
PURGE_DAYS=${PURGE_DAYS}
PURGE_INTERVAL=24
EOF

    cat > /etc/transfercli-admin.env <<EOF
# TransferCLI admin panel config (auto-generated)
TC_LISTEN=127.0.0.1:${PORT_ADMIN}
TC_UPLOADS_DIR=/var/lib/transfercli/uploads
TC_ENV_FILE=/etc/transfercli.env
TC_SERVICE_NAME=transfercli
TC_TITLE=${TITLE}
EOF
}

write_systemd_units() {
    log "Installing systemd units..."
    cat > /etc/systemd/system/transfercli.service <<EOF
[Unit]
Description=TransferCLI upload server (transfer.sh)
After=network.target

[Service]
Type=simple
User=transfercli
Group=transfercli
WorkingDirectory=/var/lib/transfercli
EnvironmentFile=-/etc/transfercli.env
ExecStart=/opt/transfercli/transfersh --listener 127.0.0.1:${PORT_UPLOAD} --force-https --provider local --basedir /var/lib/transfercli/uploads --temp-path /var/lib/transfercli/temp
Restart=on-failure
RestartSec=5

[Install]
WantedBy=multi-user.target
EOF

    cat > /etc/systemd/system/transfercli-admin.service <<EOF
[Unit]
Description=TransferCLI admin panel
After=network.target transfercli.service

[Service]
Type=simple
User=transfercli
Group=transfercli
WorkingDirectory=/var/lib/transfercli
EnvironmentFile=-/etc/transfercli-admin.env
ExecStart=/opt/transfercli/transfercli-admin
Restart=on-failure
RestartSec=5

[Install]
WantedBy=multi-user.target
EOF
}

setup_sudoers() {
    cat > /etc/sudoers.d/transfercli <<'EOF'
transfercli ALL=(ALL) NOPASSWD: /bin/systemctl restart transfercli
EOF
    chmod 440 /etc/sudoers.d/transfercli
    visudo -cf /etc/sudoers.d/transfercli >/dev/null
}

setup_htpasswd() {
    if [ -z "$ADMIN_PASSWORD" ]; then
        ADMIN_PASSWORD=$(openssl rand -base64 18 | tr -d '/+=' | cut -c1-16)
    fi
    htpasswd -cbB /etc/transfercli/.htpasswd "$ADMIN_USER" "$ADMIN_PASSWORD" 2>/dev/null
    chown root:transfercli /etc/transfercli/.htpasswd
    chmod 640 /etc/transfercli/.htpasswd
}

setup_nginx() {
    [ -n "$DOMAIN" ] || return 0
    [ -n "$EMAIL" ] || err "TC_EMAIL required when TC_DOMAIN is set"

    log "Configuring nginx for ${DOMAIN}..."
    cat > /etc/nginx/sites-available/transfercli <<EOF
server {
    listen 80;
    server_name ${DOMAIN};

    access_log off;
    client_max_body_size 0;
    proxy_request_buffering off;
    proxy_buffering off;
    proxy_read_timeout 3600s;
    proxy_send_timeout 3600s;

    location /admin/ {
        auth_basic "${TITLE} admin";
        auth_basic_user_file /etc/transfercli/.htpasswd;
        proxy_pass http://127.0.0.1:${PORT_ADMIN};
        proxy_set_header Host \$host;
        proxy_set_header X-Forwarded-Proto \$scheme;
    }

    location / {
        proxy_pass http://127.0.0.1:${PORT_UPLOAD};
        proxy_set_header Host \$host;
        proxy_set_header X-Forwarded-Proto \$scheme;
    }
}
EOF
    ln -sf /etc/nginx/sites-available/transfercli /etc/nginx/sites-enabled/transfercli
    nginx -t
    systemctl reload nginx

    log "Obtaining Let's Encrypt certificate..."
    certbot --nginx -d "$DOMAIN" -m "$EMAIL" --agree-tos --non-interactive --redirect
}

start_services() {
    log "Starting services..."
    systemctl daemon-reload
    systemctl enable --now transfercli transfercli-admin
    sleep 2
    systemctl is-active transfercli >/dev/null || err "transfercli service failed to start. Check: journalctl -u transfercli"
    systemctl is-active transfercli-admin >/dev/null || err "transfercli-admin service failed. Check: journalctl -u transfercli-admin"
}

print_summary() {
    local base
    if [ -n "$DOMAIN" ]; then
        base="https://${DOMAIN}"
    else
        base="http://<server-ip>:${PORT_UPLOAD}"
    fi
    cat <<EOF

$(printf '\033[1;32m')╔════════════════════════════════════════╗
║     ✓ TransferCLI installed successfully  ║
╚════════════════════════════════════════╝$(printf '\033[0m')

  Upload:      ${base}
  Admin:       ${base}/admin/
  Username:    ${ADMIN_USER}
  Password:    ${ADMIN_PASSWORD}

  Config:      /etc/transfercli.env, /etc/transfercli-admin.env
  Data:        /var/lib/transfercli/uploads
  Logs:        journalctl -u transfercli, journalctl -u transfercli-admin

  Try it:
    curl -T hello.txt ${base}/hello.txt

$(if [ -z "$DOMAIN" ]; then printf '%s\n' "  Note: No domain set. For HTTPS + nginx reverse proxy, re-run with:"; printf '%s\n' "    TC_DOMAIN=files.example.com TC_EMAIL=me@example.com bash install.sh"; fi)

EOF
}

# ---------- main ----------
main() {
    require_root
    detect_os
    install_pkgs
    ensure_user
    download_transfersh
    download_admin
    create_dirs
    write_env_files
    write_systemd_units
    setup_sudoers
    setup_htpasswd
    start_services
    setup_nginx
    print_summary
}

main "$@"