#!/bin/bash
set -euo pipefail
umask 022
cat > /etc/sysconfig/prometheus <<'EOF'
OPTIONS="--config.file=/etc/prometheus/prometheus.yml --storage.tsdb.path=/var/lib/prometheus --web.listen-address=127.0.0.1:9090"
EOF
cat > /etc/prometheus/prometheus.yml <<'EOF'
global:
  scrape_interval: 15s
scrape_configs:
  - job_name: servers
    static_configs:
      - targets: ['192.168.100.2:9100']
        labels: {host: hq-srv}
      - targets: ['192.168.0.2:9100']
        labels: {host: br-srv}
EOF
cat > /etc/grafana/provisioning/datasources/exam.yaml <<'EOF'
apiVersion: 1
datasources:
  - name: Prometheus
    uid: exam-prometheus
    type: prometheus
    access: proxy
    url: http://127.0.0.1:9090
    isDefault: true
EOF
mkdir -p /var/lib/grafana/dashboards
cat > /etc/grafana/provisioning/dashboards/exam.yaml <<'EOF'
apiVersion: 1
providers:
  - name: Exam
    type: file
    options:
      path: /var/lib/grafana/dashboards
EOF
python3 - <<'PY'
import json
from pathlib import Path
panels=[]
queries=[('CPU usage', '100 * (1 - avg by(host) (rate(node_cpu_seconds_total{mode="idle"}[2m])))', 'percent'),
         ('Memory used', 'node_memory_MemTotal_bytes - node_memory_MemAvailable_bytes', 'bytes'),
         ('Root filesystem used', 'node_filesystem_size_bytes{mountpoint="/"} - node_filesystem_avail_bytes{mountpoint="/"}', 'bytes')]
for i,(title,expr,unit) in enumerate(queries):
    panels.append({'id':i+1,'title':title,'type':'timeseries','gridPos':{'x':0,'y':i*8,'w':24,'h':8},
                   'datasource':{'type':'prometheus','uid':'exam-prometheus'},
                   'targets':[{'expr':expr,'legendFormat':'{{host}}','refId':'A'}],
                   'fieldConfig':{'defaults':{'unit':unit},'overrides':[]}})
Path('/var/lib/grafana/dashboards/exam.json').write_text(json.dumps({'uid':'exam-servers','title':'HQ and BR servers','schemaVersion':39,'panels':panels,'refresh':'15s','time':{'from':'now-30m','to':'now'}}))
PY
cat > /etc/grafana/grafana.ini <<'EOF'

[server]
http_addr = 127.0.0.1
http_port = 3000
domain = mon.au-team.irpo
root_url = http://mon.au-team.irpo/
[security]
admin_user = admin
admin_password = P@ssw0rd
EOF
cat > /etc/httpd2/conf/sites-available/mon.conf <<'EOF'
<VirtualHost *:80>
 ServerName mon.au-team.irpo
 ErrorDocument 403 "Monitoring is restricted to HQ networks"
 ProxyPreserveHost On
 ProxyPass / http://127.0.0.1:3000/
 ProxyPassReverse / http://127.0.0.1:3000/
 <Location />
  Require ip 192.168.100.0/27 192.168.200.0/27 192.168.99.0/29 127.0.0.1
 </Location>
</VirtualHost>
EOF
ln -sf ../sites-available/mon.conf /etc/httpd2/conf/sites-enabled/mon.conf
# Keep the original application the default virtual host for ISP upstream traffic.
cat > /etc/httpd2/conf/sites-enabled/000-web.conf <<'EOF'
<VirtualHost *:80>
 ServerName hq-srv.au-team.irpo
 DocumentRoot /var/www/html
</VirtualHost>
EOF
ln -sf ../mods-available/proxy.load /etc/httpd2/conf/mods-enabled/proxy.load
ln -sf ../mods-available/proxy_http.load /etc/httpd2/conf/mods-enabled/proxy_http.load
grep -qxF 'address=/mon.au-team.irpo/192.168.100.2' /etc/dnsmasq.conf || echo 'address=/mon.au-team.irpo/192.168.100.2' >> /etc/dnsmasq.conf
chmod 644 /etc/prometheus/prometheus.yml /etc/grafana/provisioning/{datasources,dashboards}/exam.yaml /var/lib/grafana/dashboards/exam.json
chmod 755 /var/lib/grafana/dashboards
systemctl enable --now prometheus-node_exporter prometheus grafana-server
systemctl restart prometheus grafana-server dnsmasq httpd2
runuser -u grafana -- grafana cli --homepath /usr/share/grafana --config /etc/grafana/grafana.ini \
    --configOverrides 'cfg:default.paths.data=/var/lib/grafana cfg:default.paths.logs=/var/log/grafana' \
    admin reset-admin-password 'P@ssw0rd'