#!/usr/bin/env bash
set -euo pipefail

# Ensure script is run as root (required for apt + /etc)
if [[ "$EUID" -ne 0 ]]; then
  echo "Please run as root (or use sudo)." >&2
  exit 1
fi

#set script directory
scriptdir="$(dirname "$(realpath "$0")")"

# Capture the start time (Unix timestamp)
START_TIME=$(date +%s)

# recursive replace function
replace_string_recursive() {
    local DIRECTORY="$1"
    local OLD_STRING="$2"
    local NEW_STRING="$3"

    if [ ! -d "$DIRECTORY" ]; then
        echo "Error: Directory '$DIRECTORY' does not exist."
        return 1
    fi

    echo "Starting replacement of '$OLD_STRING' with '$NEW_STRING' in '$DIRECTORY'..."
    find "$DIRECTORY" -type f -exec sed -i "s|$OLD_STRING|$NEW_STRING|g" {} +

    if [ $? -eq 0 ]; then
        echo "Replacement completed successfully."
        return 0
    else
        echo "An error occurred during replacement."
        return 1
    fi
}

# example use
# replace_string_recursive "/path/to/directory" "oldstring" "newstring"

# sqlite db replace function
replace_in_sqlite_db() {
    local DB_PATH="$1"
    local OLD_STRING="$2"
    local NEW_STRING="$3"

    # Check if the database file exists
    if [ ! -f "$DB_PATH" ]; then
        echo "Error: Database file '$DB_PATH' does not exist."
        exit 1
    fi

    echo "Starting replacement of '$OLD_STRING' with '$NEW_STRING' in '$DB_PATH'..."

    # Create a backup of the original database
    local BACKUP_PATH="${DB_PATH}.bak"
    cp "$DB_PATH" "$BACKUP_PATH"

    # Escape single quotes for SQL
    local OLD_STRING_ESC=$(printf '%s\n' "$OLD_STRING" | sed "s/'/''/g")
    local NEW_STRING_ESC=$(printf '%s\n' "$NEW_STRING" | sed "s/'/''/g")

    # Get a list of all tables in the database
    local TABLES
    TABLES=$(sqlite3 "$DB_PATH" ".tables")

    # Loop through each table
    for TABLE in $TABLES; do
        echo "Processing table: $TABLE"

        # Escape table name if it's a reserved keyword
        local ESCAPED_TABLE
        if [[ "$TABLE" =~ ^(index|group|order|table|view|database|schema|trigger|transaction|commit|rollback|savepoint|release|alter|create|drop|insert|update|delete|select|from|where|join|union|intersect|except|limit|offset|order|by|group|having|as|with|replace|cast|case|when|then|else|end|and|or|not|is|null|between|in|like|glob|match|regexp|collate|exists|unique|primary|key|foreign|references|check|constraint|default|collate|asc|desc|on|using|natural|left|right|full|outer|cross|inner)$ ]]; then
            ESCAPED_TABLE="\"$TABLE\""
        else
            ESCAPED_TABLE="$TABLE"
        fi

        # Get a list of all non-BLOB columns in the table
        sqlite3 "$DB_PATH" "PRAGMA table_info($ESCAPED_TABLE);" 2>/dev/null | awk -F'|' '
        {
            if ($3 != "BLOB") {
                print $2
            }
        }' | while read -r COLUMN; do
            if [ -n "$COLUMN" ]; then
                echo "  Processing column: $COLUMN"

                # Escape column name if it's a reserved keyword
                local ESCAPED_COLUMN
                if [[ "$COLUMN" =~ ^(index|group|order|table|view|database|schema|trigger|transaction|commit|rollback|savepoint|release|alter|create|drop|insert|update|delete|select|from|where|join|union|intersect|except|limit|offset|order|by|group|having|as|with|replace|cast|case|when|then|else|end|and|or|not|is|null|between|in|like|glob|match|regexp|collate|exists|unique|primary|key|foreign|references|check|constraint|default|collate|asc|desc|on|using|natural|left|right|full|outer|cross|inner)$ ]]; then
                    ESCAPED_COLUMN="\"$COLUMN\""
                else
                    ESCAPED_COLUMN="$COLUMN"
                fi

                # Update only rows where the column contains OLD_STRING
                # Run each update in its own connection to avoid locking issues
                sqlite3 "$DB_PATH" "
                UPDATE $ESCAPED_TABLE
                SET $ESCAPED_COLUMN = replace(CAST($ESCAPED_COLUMN AS TEXT), '$OLD_STRING_ESC', '$NEW_STRING_ESC')
                WHERE CAST($ESCAPED_COLUMN AS TEXT) LIKE '%$OLD_STRING_ESC%';
                "
            fi
        done
    done

    echo "Replacement completed in '$DB_PATH'. Original database backed up to '$BACKUP_PATH'."
}

#example usage: replace_in_sqlite_db "database.sqlite" "Europe/Amsterdam" "UTC"

get_country_from_timezone() {
    local timezone="$1"

    # Extract the region and city from the timezone (e.g., "America/New_York" -> "New_York")
    local city=$(echo "$timezone" | cut -d'/' -f2)

    # Use a predefined mapping for common cities (fallback if no better method is found)
    # This is a minimal mapping; you can expand it as needed.
    local declare -A city_to_country=(
        ["New_York"]="United States"
        ["Toronto"]="Canada"
        ["Amsterdam"]="Netherlands"
        ["London"]="United Kingdom"
        ["Tokyo"]="Japan"
        ["Paris"]="France"
        ["Berlin"]="Germany"
        ["Sydney"]="Australia"
        ["Melbourne"]="Australia"
    )

    # Check if the city exists in the mapping
    if [ -n "${city_to_country[$city]}" ]; then
        echo "${city_to_country[$city]}"
    else
        # Fallback: Try to extract country from the timezone file (less reliable)
        # This is a placeholder; actual implementation would require parsing timezone files.
        echo "Unknown"
    fi
}

oc_installapp() {
    local appid="$1"
    docker exec owncloud_server occ market:install $appid
}

pause_if_enabled() {
    if [ "$SHOULD_PAUSE" = true ]; then
        read -n 1 -s -r -p "Press any key to continue..."
        echo  # Move to a new line after keypress
    fi
}
# what this script needs to do:

#formatting variables:
green='\033[0;32m'
cyan='\033[0;36m'
cyanbold='\033[1;36m'
greenbold='\033[1;32m'
nc='\033[0m'
underline='\033[4m'

# Public IP (tries multiple services)
publicip="$(curl -fsS https://api.ipify.org || curl -fsS https://ifconfig.me || echo "UNKNOWN")"

# Local IP (first non-loopback)
localip="$(hostname -I | awk '{print $1}')"

# request all install parameters needed from user

# Selection menu for external access method
echo "--------------------------------------------------------"
echo -e "${cyan}Select your external access method:${nc}"
echo ""
echo "1. Public DNS - You will need to purchase a domain name from a DNS provider and configure it."
echo "2. Local DNS, Local IP - All local devices must use $localip as their DNS. Remote devices must use WireGuard VPN."
echo "3. Local DNS, Public IP - All local devices must use $localip as their DNS. Remote devices must use $publicip as their DNS, you must forward port 53 to $localip"
echo ""

while true; do
    read -p "Enter your choice (1-3): " external_access_method
    case "$external_access_method" in
        (1|2|3)
            echo "Selected option: $external_access_method"
            break
            ;;
        (*)
            echo "Invalid choice. Please enter 1, 2, or 3."
            ;;
    esac
done


# ---- User input ----
read -rp "Admin email: " adminemail < /dev/tty
read -rsp "Admin password: " adminpass < /dev/tty
echo
read -rp "Timezone (e.g. Europe/Amsterdam): " timezone < /dev/tty
read -rp "Domain (e.g. example.com): " domain < /dev/tty



# Prompt the user to set the pause behavior (defaults to true)
echo -e "${cyan}pause prompts${nc} will ask you to finish configuration for each application as the script goes."
echo "disabling these means you'll have to do this after the script finishes, but allows you to run the script unattended."
read -p "Enable pause prompts? [Y/n] " -n 1 -r
echo  # Move to a new line
if [[ $REPLY =~ ^[Nn]$ ]]; then
    SHOULD_PAUSE=false
else
    SHOULD_PAUSE=true
fi




if [ "$external_access_method" -eq 1 ]; then
    # Verify DNS records
    echo -e "${cyan}Verifying DNS records...${nc}"
    echo ""

    # Check A record
    echo -e "${cyan}Checking A record for @...${nc}"
    a_record_check=$(dig +short A "$domain" @8.8.8.8 2>/dev/null | grep -c "^$publicip$" || echo "0")
    if [ "$a_record_check" -eq 0 ]; then
        echo -e "${cyan}Warning: A record for @ is not set or not pointing to $publicip${nc}"
    else
        echo -e "${cyan}A record for @ is correctly set to $publicip${nc}"
    fi

    # Check CNAME record
    echo -e "${cyan}Checking CNAME record for *...${nc}"
    cname_record_check=$(dig +short CNAME "*.$domain" @8.8.8.8 2>/dev/null | grep -c "$domain\.$" || echo "0")
    if [ "$cname_record_check" -eq 0 ]; then
        echo -e "${cyan}Warning: CNAME record for * is not set or not pointing to @${nc}"
    else
        echo -e "${cyan}CNAME record for * is correctly set to @${nc}"
    fi

    echo "--------------------------------------------------------"
    echo -e "please double-check your ${cyan}DNS records${nc} to ensure they are set. the following dns records need to be set:"
    echo ""
    echo "|name         |type       |value      "
    echo "|@            |A          |$publicip  "
    echo "|*            |CNAME      |@          "
    echo ""
    echo -e "once you've done this, press any key to ${underline}continue${nc}"
    pause_if_enabled
fi
# Ask about static public IP if using public DNS
if [ "$external_access_method" -eq 1 ]; then


    while true; do
        read -p "Do you have a static public IP address? (yes/no): " static_ip_answer
        case "$static_ip_answer" in
            ([yY]|[yY][eE][sS])
                static_public_ip="yes"
                break
                ;;
            ([nN]|[nN][oO])
                static_public_ip="no"
                break
                ;;
            (*)
                echo "Please answer with 'yes' or 'no'."
                ;;
        esac
    done

    # Store this information for later use
    echo "Static public IP setting: $static_public_ip"
fi



# generate random passwords for DB hosts and other secrets

# ---- Random generators ----
rand_hex() { openssl rand -hex 24; }
rand_b64() { openssl rand -base64 32; }

ownclouddbpass="$(rand_hex)"
ownclouddbrootpass="$(rand_hex)"
convertxJWT="$(rand_hex)"
bookstackkey="$(rand_b64)"        # base64 as requested
bookstackdbpass="$(rand_hex)"
bookstackdbrootpass="$(rand_hex)"
onlyofficeJWT="$(rand_hex)"

# install docker
echo "Updating apt and installing prerequisites..."
apt update
apt install -y ca-certificates curl git openssl curl gawk coreutils grep jq sqlite3 iso-codes net-tools

echo "Setting up Docker GPG key..."
install -m 0755 -d /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/ubuntu/gpg \
  -o /etc/apt/keyrings/docker.asc
chmod a+r /etc/apt/keyrings/docker.asc

echo "Adding Docker apt repository..."
. /etc/os-release

cat > /etc/apt/sources.list.d/docker.sources <<EOF
Types: deb
URIs: https://download.docker.com/linux/ubuntu
Suites: ${UBUNTU_CODENAME:-$VERSION_CODENAME}
Components: stable
Signed-By: /etc/apt/keyrings/docker.asc
EOF

echo "Updating apt and installing Docker..."
apt update
apt install -y \
  docker-ce \
  docker-ce-cli \
  containerd.io \
  docker-buildx-plugin \
  docker-compose-plugin 

echo "Docker installation complete."
docker --version

# install dockge
mkdir -p  /opt/dockge
cd /opt/dockge

# Download your compose.yaml
curl "https://dockge.kuma.pet/compose.yaml?port=5001&stacksPath=%2Fopt%2Fstacks" --output compose.yaml

# write configuration to compose files
mkdir -p /opt/files
cp -r $scriptdir/stacks /opt
cp -r $scriptdir/setup /opt/files
chmod -R 775 /opt/stacks
chmod -R 775 /opt/files


cd /opt/stacks
git clone https://github.com/trantienloi2404/youtube-downloader.git downloader

#adminemail
replace_string_recursive "/opt/stacks" "?adminemail?" $adminemail > /dev/null
#adminpass
replace_string_recursive "/opt/stacks" "?adminpass?" $adminpass > /dev/null
#timezone
replace_string_recursive "/opt/stacks" "?timezone?" $timezone > /dev/null
#domain
replace_string_recursive "/opt/stacks" "?domain?" $domain > /dev/null
#publicip
replace_string_recursive "/opt/stacks" "?publicip?" $publicip > /dev/null
#localip
replace_string_recursive "/opt/stacks" "?localip?" $localip > /dev/null
#ownclouddbpass
replace_string_recursive "/opt/stacks" "?ownclouddbpass?" $ownclouddbpass > /dev/null
#ownclouddbrootpass
replace_string_recursive "/opt/stacks" "?ownclouddbrootpass?" $ownclouddbrootpass > /dev/null
#convertxJWT
replace_string_recursive "/opt/stacks" "?convertxJWT?" $convertxJWT > /dev/null
#bookstackkey
replace_string_recursive "/opt/stacks" "?bookstackkey?" $bookstackkey > /dev/null
replace_string_recursive "/opt/stacks" "?bookstackdbpass?" $bookstackdbpass > /dev/null
#bookstackdbrootpass
replace_string_recursive "/opt/stacks" "?bookstackdbrootpass?" $bookstackdbrootpass > /dev/null
#onlyofficeJWT
replace_string_recursive "/opt/stacks" "?onlyofficeJWT?" $onlyofficeJWT > /dev/null

#domain
replace_string_recursive "/opt/files" "?domain?" $domain > /dev/null
#publicip
replace_string_recursive "/opt/files" "?publicip?" $publicip > /dev/null
#localip
replace_string_recursive "/opt/files" "?localip?" $localip > /dev/null
#adminemail
replace_string_recursive "/opt/files" "?adminemail?" $adminemail > /dev/null

# install mailcow to /opt/stacks/mailcow so it shows up in dockge
umask 0022
#cd /opt/stacks
#git clone https://github.com/mailcow/mailcow-dockerized mailcow
#cd /opt/stacks/mailcow
#bash ./generate_config.sh < /dev/tty

#disable stub listener

echo "DNSStubListener=no" | tee -a /etc/systemd/resolved.conf
systemctl restart systemd-resolved
sleep 5
systemctl restart docker
sleep 5


# up dockge
cd /opt/dockge
docker compose up -d

echo -e "${cyan}Dockge${nc} has been installed and launched. go to http://$localip:5001 and configure your username and password, then press any key to continue"
pause_if_enabled

# call replacements for nginx db
replace_in_sqlite_db "/opt/stacks/npm/data/database.sqlite" "<domain>" $domain > /dev/null
replace_in_sqlite_db "/opt/stacks/npm/data/database.sqlite" "<localip>" $localip > /dev/null
replace_in_sqlite_db "/opt/stacks/npm/data/database.sqlite" "<publicip>" $publicip > /dev/null

cd /opt/stacks/npm
docker compose up -d

echo -e "${cyan}Nginx Proxy Manager${nc} has been installed and launched. go to http://$localip:81 and configure your username and password, then press any key to continue"
pause_if_enabled
echo ""
echo -e "Multiple applications will now be installed in quick succession without continuous user prompting."
echo -e "when each application is installed, you will see an output providing you the url to verify it is online"
echo -e "do not worry if you miss it, you will be reminded later"
echo -e "you can skip verifying as the script runs, and take a short coffee break here."
echo -e "the script will continue automatically in 30 seconds"
sleep 30

cd /opt/stacks/dozzle
docker compose up -d
echo -e "${cyan}dozzle${nc} has been launched from http://dozzle.$domain, verify it is online, do not worry if the UI gives a time-out error, this is due to docker being busy while this script runs."

cd /opt/stacks/convertx
docker compose up -d
echo -e "${cyan}convertx${nc} has been launched from http://convert.$domain, verify it is online"

cd /opt/stacks/it-tools
docker compose up -d
echo -e "${cyan}it-tools${nc} has been launched from http://tools.$domain, verify it is online"

cd /opt/stacks/onlyoffice
docker compose up -d
echo -e "${cyan}onlyoffice${nc} has been launched from http://office.$domain, verify it is online"

#owncloud
# todo: use OC config commands to install addons and configure onlyoffice
cd /opt/stacks/owncloud
docker compose up -d
echo "awaiting owncloud boot"
sleep 40
oc_installapp bookmarks
oc_installapp calendar
oc_installapp camerarawpreviews
oc_installapp checksum
oc_installapp contacts
oc_installapp drawio
oc_installapp extract
oc_installapp files_3dviewer
oc_installapp files_clipboard
oc_installapp files_textviewer
oc_installapp gallery
oc_installapp metadata
oc_installapp music
oc_installapp notes
oc_installapp onlyoffice
oc_installapp tasks

docker exec owncloud_server occ config:app:set onlyoffice DocumentServerUrl --value="https://office.$domain/"
docker exec owncloud_server occ config:app:set onlyoffice jwt_secret --value="$onlyofficeJWT"
docker restart owncloud_server
echo -e "${cyan}owncloud${nc} has been launched from http://cloud.$domain, check if it is online and working, it may take a bit to launch. 502 error = still starting"

cd /opt/stacks/site
docker compose up -d
echo -e "${cyan}site${nc} has been launched from http://www.$domain, verify it is online"

cd /opt/stacks/vaultwarden
docker compose up -d
echo -e "${cyan}vaultwarden${nc} has been launched from http://vault.$domain, verify it is online"

#pihole
cd /opt/stacks/pihole
docker compose up -d
echo -e "${cyan}pihole${nc} has been launched from http://dns.$domain, to use pihole as your DNS provider, set your DNS to $localip in your router for DHCP and on your device for any device with a static ip. Currently, the DNS is configured to use the joindns4.eu DNS, which *also* has built-in adblocking."

cd /opt/stacks/wireguard
docker compose up -d
echo -e "${cyan}wireguard${nc} has been launched from http://vpn.$domain, verify it is online"

cd /opt/stacks/downloader
echo "bringing up downloader, this may take a while."
echo ""
echo -e "recap of all available services up to now:"
echo -e "${cyan}owncloud${nc} has been launched from http://cloud.$domain, check if it is online and working."
echo -e "${cyan}vaultwarden${nc} has been launched from http://vault.$domain, verify it is online"
echo -e "${cyan}site${nc} has been launched from http://www.$domain, verify it is online"
echo -e "${cyan}onlyoffice${nc} has been launched from http://tools.$domain, verify it is online"
echo -e "${cyan}it-tools${nc} has been launched from http://tools.$domain, verify it is online"
echo -e "${cyan}wireguard${nc} has been launched from http://vpn.$domain, verify it is online"
echo -e "${cyan}convertx${nc} has been launched from http://convert.$domain, verify it is online"
echo -e "${cyan}dozzle${nc} has been launched from http://dozzle.$domain, verify it is online, do not worry if the UI gives a time-out error, this is due to docker being busy while this script runs."
echo -e "${cyan}Nginx Proxy Manager${nc} has been installed, configured and launched from http://proxy.$domain"
echo -e "${cyan}Dockge${nc} has been installed, configured and launched from http://docker.$domain"
echo -e "${cyan}pihole${nc} has been launched from http://dns.$domain, to use pihole as your DNS provider, set your DNS to $localip in your router for DHCP and on your device for any device with a static ip. Currently, the DNS is configured to use the joindns4.eu DNS, which *also* has built-in adblocking."
echo ""
echo "you may have to go to settings > additional in owncloud and click "save" for the onlyoffice server settings."
# docker compose up -d  > /dev/null
# echo -e "${cyan}downloader${nc} has been launched from http://download.$domain, verify it is online"


#bookstack
cd /opt/stacks/bookstack
docker compose up -d
echo -e "${cyan}bookstack${nc} has been launched from http://docs.$domain, verify it is online (this may take a bit) and log in with email 'admin@admin.com' and password 'password', then reset this account to use $adminemail and your password. afterwards, press any key to continue"
pause_if_enabled

#browser
cd /opt/stacks/browser
docker compose up -d
echo -e "${cyan}filebrowser${nc} has been launched from http://browser.$domain, head to dockge (http://docker.$domain), open the filebrowser stack and check the logs for the initial admin password. make sure to change this in filebrowser's config, then press any key to continue"
pause_if_enabled

#jellyfin
cd /opt/stacks/jellyfin
docker compose up -d
mkdir /opt/stacks/jellyfin/media/shows
mkdir /opt/stacks/jellyfin/media/movies
echo -e "${cyan}jellyfin${nc} has launched from http://video.$domain, perform the initial setup and press any key to continue"
pause_if_enabled

#uptimekuma
cd /opt/stacks/kuma
docker compose up -d
echo -e "${cyan}uptime kuma${nc} has been launched from http://status.$domain, perform the initial setup, choosing embedded mariaDB, then press any key to continue"
pause_if_enabled


#dashboard
replace_in_sqlite_db "/opt/stacks/dashboard/config/www/app.sqlite" "<domain>" $domain
cd /opt/stacks/dashboard
docker compose up -d
echo -e "${cyan}dashboard${nc} has been launched from http://dash.$domain, verify it is online, check that its entries work and press any button to continue"
pause_if_enabled


cat >/opt/stacks/setup/npmcertlist.txt <<EOF 
browser.$domain
cloud.$domain
convert.$domain
dash.$domain
dns.$domain
docker.$domain
docs.$domain
download.$domain
dozzle.$domain
office.$domain
proxy.$domain
status.$domain
tools.$domain
vault.$domain
video.$domain
vpn.$domain
www.$domain
test.$domain
temp.$domain
$domain
llm.$domain
mail.$domain
private.$domain
site.$domain

Add any other subdomains you want to use.
EOF

# Write PiHole config (only for options 2 and 3)
if [ "$external_access_method" -eq 2 ] || [ "$external_access_method" -eq 3 ]; then
    echo "Writing PiHole configuration..."

    # Use public IP for option 3, local IP for option 2
    if [ "$external_access_method" -eq 3 ]; then
        dns_ip="$publicip"
    else
        dns_ip="$localip"
    fi

    cat >/opt/stacks/pihole/dns/02-wildcard.conf <<EOF
address=/$domain/$dns_ip
address=/.$domain/$dns_ip
EOF
    chmod -R 775 /opt
    docker exec pihole pihole-FTL --config misc.etc_dnsmasq_d true
    docker restart pihole
fi
# Enable DHCP on PiHole for options 2 and 3
if [ "$external_access_method" -eq 2 ] || [ "$external_access_method" -eq 3 ]; then
    echo "Configuring DHCP on PiHole..."
    echo "Gathering network information..."

    # Get network information with error checking
    gateway=$(ip route | awk '/default/ {print $3}' || echo "ERROR")
    interface=$(ip route | awk '/default/ {print $5}' || echo "ERROR")
    netmask=$(ifconfig $interface | awk '/netmask/ {print $4}' 2>/dev/null || echo "ERROR")
    localip=$(hostname -I | awk '{print $1}' || echo "ERROR")

    if [[ "$gateway" == "ERROR" || "$interface" == "ERROR" || "$netmask" == "ERROR" || "$localip" == "ERROR" ]]; then
        echo "Error: Failed to get network information"
        exit 1
    fi

    echo "  Gateway: $gateway"
    echo "  Interface: $interface"
    echo "  Netmask: $netmask"
    echo "  Local IP: $localip"

    # Function to convert IP to binary string with error checking
    ip_to_bin() {
        local ip=$1
        local a b c d

        # Validate IP format
        if ! [[ $ip =~ ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$ ]]; then
            echo "Error: Invalid IP format '$ip'" >&2
            return 1
        fi

        IFS=. read -r a b c d <<< "$ip"

        # Convert each octet to binary with error checking
        local bin_a=$(printf "%08d" "$(echo "obase=2; $a" | bc)")
        local bin_b=$(printf "%08d" "$(echo "obase=2; $b" | bc)")
        local bin_c=$(printf "%08d" "$(echo "obase=2; $c" | bc)")
        local bin_d=$(printf "%08d" "$(echo "obase=2; $d" | bc)")

        echo "${bin_a}${bin_b}${bin_c}${bin_d}"
    }

    # Function to convert binary string to IP with error checking
    bin_to_ip() {
        local bin=$1

        # Validate binary string length
        if [ ${#bin} -ne 32 ]; then
            echo "Error: Invalid binary string length (expected 32, got ${#bin})" >&2
            return 1
        fi

        local octet1=${bin:0:8}
        local octet2=${bin:8:8}
        local octet3=${bin:16:8}
        local octet4=${bin:24:8}

        # Convert each octet with error checking
        local ip1=$(echo "ibase=2; $octet1" | bc)
        local ip2=$(echo "ibase=2; $octet2" | bc)
        local ip3=$(echo "ibase=2; $octet3" | bc)
        local ip4=$(echo "ibase=2; $octet4" | bc)

        echo "$ip1.$ip2.$ip3.$ip4"
    }

    # Function to add a number to an IP address (returns IP string)
    add_to_ip() {
        local ip=$1
        local num=$2

        # Convert IP to binary
        local bin_ip=$(ip_to_bin "$ip" || return 1)

        # Split the IP into 4 octets (8 bits each)
        local octet1=${bin_ip:0:8}
        local octet2=${bin_ip:8:8}
        local octet3=${bin_ip:16:8}
        local octet4=${bin_ip:24:8}

        # Convert octets to decimal
        local dec1=$((2#$octet1))
        local dec2=$((2#$octet2))
        local dec3=$((2#$octet3))
        local dec4=$((2#$octet4))

        # Add the number to the last octet
        dec4=$((dec4 + num))

        # Handle overflow
        if [ $dec4 -gt 255 ]; then
            dec4=$((dec4 - 256))
            dec3=$((dec3 + 1))
        fi

        # Handle overflow in third octet
        if [ $dec3 -gt 255 ]; then
            dec3=$((dec3 - 256))
            dec2=$((dec2 + 1))
        fi

        # Handle overflow in second octet (unlikely in our use case)
        if [ $dec2 -gt 255 ]; then
            dec2=$((dec2 - 256))
            dec1=$((dec1 + 1))
        fi

        # Convert back to binary
        octet1=$(printf "%08d" "$(echo "obase=2; $dec1" | bc)")
        octet2=$(printf "%08d" "$(echo "obase=2; $dec2" | bc)")
        octet3=$(printf "%08d" "$(echo "obase=2; $dec3" | bc)")
        octet4=$(printf "%08d" "$(echo "obase=2; $dec4" | bc)")

        # Convert back to IP
        bin_to_ip "${octet1}${octet2}${octet3}${octet4}"
    }

    # Function to subtract a number from an IP address (returns IP string)
    subtract_from_ip() {
        local ip=$1
        local num=$2

        # Convert IP to binary
        local bin_ip=$(ip_to_bin "$ip" || return 1)

        # Split the IP into 4 octets (8 bits each)
        local octet1=${bin_ip:0:8}
        local octet2=${bin_ip:8:8}
        local octet3=${bin_ip:16:8}
        local octet4=${bin_ip:24:8}

        # Convert octets to decimal
        local dec1=$((2#$octet1))
        local dec2=$((2#$octet2))
        local dec3=$((2#$octet3))
        local dec4=$((2#$octet4))

        # Subtract the number from the last octet
        dec4=$((dec4 - num))

        # Handle underflow
        if [ $dec4 -lt 0 ]; then
            dec4=$((dec4 + 256))
            dec3=$((dec3 - 1))
        fi

        # Handle underflow in third octet
        if [ $dec3 -lt 0 ]; then
            dec3=$((dec3 + 256))
            dec2=$((dec2 - 1))
        fi

        # Handle underflow in second octet (unlikely in our use case)
        if [ $dec2 -lt 0 ]; then
            dec2=$((dec2 + 256))
            dec1=$((dec1 - 1))
        fi

        # Convert back to binary
        octet1=$(printf "%08d" "$(echo "obase=2; $dec1" | bc)")
        octet2=$(printf "%08d" "$(echo "obase=2; $dec2" | bc)")
        octet3=$(printf "%08d" "$(echo "obase=2; $dec3" | bc)")
        octet4=$(printf "%08d" "$(echo "obase=2; $dec4" | bc)")

        # Convert back to IP
        bin_to_ip "${octet1}${octet2}${octet3}${octet4}"
    }

    # Function to compare two IP addresses (returns 0 if ip1 <= ip2, 1 if ip1 > ip2)
    compare_ips() {
        local ip1=$1
        local ip2=$2

        # Convert IPs to their components
        IFS=. read -r a1 b1 c1 d1 <<< "$ip1"
        IFS=. read -r a2 b2 c2 d2 <<< "$ip2"

        # Compare each octet in order
        if [ "$a1" -lt "$a2" ]; then return 0; fi
        if [ "$a1" -gt "$a2" ]; then return 1; fi

        if [ "$b1" -lt "$b2" ]; then return 0; fi
        if [ "$b1" -gt "$b2" ]; then return 1; fi

        if [ "$c1" -lt "$c2" ]; then return 0; fi
        if [ "$c1" -gt "$c2" ]; then return 1; fi

        if [ "$d1" -le "$d2" ]; then return 0; fi
        return 1
    }

    # Function to check if an IP is within a range
    is_ip_in_range() {
        local ip=$1
        local start=$2
        local end=$3

        compare_ips "$ip" "$start"
        local ip_ge_start=$?

        compare_ips "$ip" "$end"
        local ip_le_end=$?

        if [ "$ip_ge_start" -eq 0 ] && [ "$ip_le_end" -eq 0 ]; then
            return 0  # in range
        else
            return 1  # out of range
        fi
    }

    # Calculate network and broadcast addresses using binary operations
    echo "Calculating network and broadcast addresses..."
    gateway_bin=$(ip_to_bin "$gateway" || exit 1)
    netmask_bin=$(ip_to_bin "$netmask" || exit 1)
    localip_bin=$(ip_to_bin "$localip" || exit 1)

    # Calculate network address (bitwise AND of gateway and netmask)
    network_bin=""
    for i in {0..31}; do
        if [ "${gateway_bin:$i:1}" = "1" ] && [ "${netmask_bin:$i:1}" = "1" ]; then
            network_bin="${network_bin}1"
        else
            network_bin="${network_bin}0"
        fi
    done

    # Calculate broadcast address (bitwise OR of network and inverted netmask)
    broadcast_bin=""
    for i in {0..31}; do
        if [ "${netmask_bin:$i:1}" = "0" ]; then
            broadcast_bin="${broadcast_bin}1"
        else
            broadcast_bin="${broadcast_bin}${network_bin:$i:1}"
        fi
    done

    network_address=$(bin_to_ip "$network_bin" || exit 1)
    broadcast_address=$(bin_to_ip "$broadcast_bin" || exit 1)
    echo "  Network Address: $network_address"
    echo "  Broadcast Address: $broadcast_address"

    # Calculate DHCP start: network_address + 10
    echo "Calculating DHCP range..."
    dhcp_start=$(add_to_ip "$network_address" 10 || exit 1)
    echo "  Initial DHCP start: $dhcp_start"

    # Ensure DHCP start is not before network+1
    network_plus_1=$(add_to_ip "$network_address" 1 || exit 1)
    echo "  Network+1: $network_plus_1"

    if compare_ips "$dhcp_start" "$network_plus_1"; then
        # dhcp_start <= network_plus_1, so we need to adjust
        echo "  Adjusting DHCP start to network+1: $network_plus_1"
        dhcp_start="$network_plus_1"
    fi

    # Calculate DHCP end: dhcp_start + 100
    dhcp_end=$(add_to_ip "$dhcp_start" 100 || exit 1)
    echo "  Initial DHCP end: $dhcp_end"

    # Ensure DHCP end is not after broadcast-1
    broadcast_minus_1=$(subtract_from_ip "$broadcast_address" 1 || exit 1)
    echo "  Broadcast-1: $broadcast_minus_1"

    if ! compare_ips "$dhcp_end" "$broadcast_minus_1"; then
        # dhcp_end > broadcast_minus_1, so we need to adjust
        echo "  Adjusting DHCP end to broadcast-1: $broadcast_minus_1"
        dhcp_end="$broadcast_minus_1"
    fi

    # Exclude local IP from range
    if is_ip_in_range "$localip" "$dhcp_start" "$dhcp_end"; then
        echo "Local IP $localip is in DHCP range. Adjusting..."
        # For simplicity, move the start up by 1
        new_dhcp_start=$(add_to_ip "$localip" 1 || exit 1)
        if compare_ips "$new_dhcp_start" "$dhcp_end"; then
            echo "  Adjusting DHCP start to $new_dhcp_start"
            dhcp_start="$new_dhcp_start"
        else
            echo "  Cannot adjust DHCP start without making it exceed end"
            # Try moving the end down by 1 instead
            new_dhcp_end=$(subtract_from_ip "$localip" 1 || exit 1)
            if ! compare_ips "$dhcp_start" "$new_dhcp_end"; then
                echo "  Cannot adjust DHCP range without excluding valid IPs"
            else
                echo "  Adjusting DHCP end to $new_dhcp_end"
                dhcp_end="$new_dhcp_end"
            fi
        fi
    fi

    # Validate DHCP range
    if [ -z "$dhcp_start" ] || [ -z "$dhcp_end" ]; then
        echo "Error: Invalid DHCP range calculated. DHCP start or end is empty. Aborting."
        exit 1
    fi

    echo "--- DHCP Configuration Summary ---"
    echo "  DHCP Range: $dhcp_start to $dhcp_end"
    echo "  Router: $gateway"
    echo "  Netmask: $netmask"
    echo "----------------------------------"

    # Apply the DHCP configuration
    echo "Applying DHCP configuration..."
    docker exec pihole pihole-FTL --config dhcp.start "$dhcp_start" || {
        echo "Error: Failed to set DHCP start"
        exit 1
    }
    docker exec pihole pihole-FTL --config dhcp.end "$dhcp_end" || {
        echo "Error: Failed to set DHCP end"
        exit 1
    }
    docker exec pihole pihole-FTL --config dhcp.router "$gateway" || {
        echo "Error: Failed to set DHCP router"
        exit 1
    }
    docker exec pihole pihole-FTL --config dhcp.netmask "$netmask" || {
        echo "Error: Failed to set DHCP netmask"
        exit 1
    }
    docker exec pihole pihole-FTL --config dhcp.active true || {
        echo "Error: Failed to enable DHCP"
        exit 1
    }

    # Restart PiHole to apply changes
    echo "Restarting PiHole to apply changes..."
    docker restart pihole || {
        echo "Error: Failed to restart PiHole"
        exit 1
    }
    echo "DHCP configuration applied successfully."
fi

# Generate post-install tasks file
echo "Generating post-install tasks file..."
tasks_file="/opt/files/post-install.txt"

# Start with common header
cat > "$tasks_file" <<EOF
POST-INSTALL TASKS FOR YOUR HOME CLOUD
=====================================
Generated: $(date)
Timezone: $timezone
Local IP: $localip
Public IP: $publicip
Domain: $domain

IMPORTANT: Follow these tasks in order as some services depend on others being configured first.

EOF

# Initialize section counter
section=1

# 1. DDNS Configuration (only for public DNS with non-static IP)
if [ "$external_access_method" -eq 1 ] && [ "$static_public_ip" != "yes" ]; then
    cat >> "$tasks_file" <<EOF

$section. CONFIGURE DDNS
------------------------

RECOMMENDED FREE DDNS PROVIDERS
1. DuckDNS (https://www.duckdns.org) - Simple and free
2. No-IP (https://www.noip.com) - Free tier with monthly confirmation
3. Dynu (https://www.dynu.com) - Free with multiple domain options
4. FreeDNS (https://freedns.afraid.org) - Free subdomains available

IMPORTANT NOTES
1. Ensure your router has a public IP address (not behind CGNAT)
2. For Linux systems, verify ddclient is running properly
3. For routers, check the DDNS status in the admin panel
4. Test your configuration by pinging your new DDNS hostname
5. Some providers require periodic confirmation to maintain free service

--------------------------------------------------------------------------------
OPTION 1: CONFIGURING DDNS ON HOME ROUTERS
--------------------------------------------------------------------------------

ASUS ROUTERS
------------
1. Log in to your router's admin panel at http://$gateway
2. Navigate to WAN > DDNS
3. Select your DDNS provider (No-IP or ASUS DDNS)
4. Enter your DDNS hostname
5. Provide your DDNS credentials
6. Click Apply to save settings

TP-LINK ROUTERS
---------------
1. Log in to your router's admin panel at http://$gateway
2. Navigate to Advanced > Network > Dynamic DNS
3. Select your DDNS provider (No-IP or TP-Link DDNS)
4. Enter your DDNS hostname
5. Provide your DDNS credentials
6. Click Save to apply settings

--------------------------------------------------------------------------------
OPTION 2: CONFIGURING DDNS ON YOUR SERVER USING DDCLIENT
--------------------------------------------------------------------------------

1. INSTALL DDCLIENT
-------------------
  sudo apt update && sudo apt install ddclient

2. CONFIGURE DDCLIENT
----------------------
Edit the configuration file:
  sudo nano /etc/ddclient/ddclient.conf

For DuckDNS:
  protocol=duckdns
  use=web
  server=www.duckdns.org
  login=your_duckdns_token
  password=
  yourDDNSdomain.duckdns.org

For No-IP:
  protocol=noip
  use=web
  server=dynupdate.no-ip.com
  login=your_noip_username
  password=your_noip_password
  yourDDNSdomain.ddns.net

3. RESTART DDCLIENT
-------------------
  sudo systemctl restart ddclient
  sudo systemctl enable ddclient

4. VERIFY CONFIGURATION
-----------------------
  sudo tail -n 20 /var/log/syslog | grep ddclient

EOF
    section=$((section + 1))
fi

# 2. PiHole Configuration (for local DNS methods)
if [ "$external_access_method" -eq 2 ] || [ "$external_access_method" -eq 3 ]; then
    cat >> "$tasks_file" <<EOF

$section. CONFIGURE PIHOLE
--------------------------
--------------------------------------------------------------------------------
1. DISABLING DHCP ON YOUR ROUTER
--------------------------------------------------------------------------------

your pihole is configured as a DHCP server, because of this, we want to disable the router's internal DHCP server.

ASUS ROUTERS:
-------------
1. Log in to router admin (http://$gateway)
2. Navigate to LAN > DHCP Server
3. Set "Enable the DHCP Server" to "No"
4. Click "Apply" to save changes

TP-LINK ROUTERS:
---------------
1. Log in to router admin (http://$gateway)
2. Go to Advanced > Network > DHCP Server
3. Toggle DHCP Server to "Disable"
4. Click "Save" to apply


--------------------------------------------------------------------------------
2. CONFIGURING STATIC IPS WITH CUSTOM DNS ($localip or $publicip)
--------------------------------------------------------------------------------

use $publicip if you are forwarding port 53, or $localip if not.
if you use $localip, the device will not have DNS outside of your local network.

you only need to do this for devices that have a static ip address, devices that get their ip assigned via DHCP (which is default for most devices, especially wireless ones) get their DNS address from the router.

WINDOWS:
--------
1. Open Network Settings (Win+I > Network & Internet)
2. Select your connection (Wi-Fi/Ethernet)
3. Click "Hardware properties" > "Edit" next to DNS
4. Set manual DNS to $localip or $publicip
5. Save changes

MACOS:
------
1. Open System Preferences > Network
2. Select your connection
3. Click "Advanced" > DNS tab
4. Add $localip or $publicip to DNS servers
5. Click "OK" > "Apply"

LINUX (NETWORK MANAGER):
------------------------
1. Edit connection settings:
   nm-connection-editor
2. Select your connection
3. Go to IPv4/IPv6 settings
4. Set DNS to $localip or $publicip
5. Save and restart connection

ANDROID:
--------
1. Open Wi-Fi settings
2. Long-press your network > Modify network
3. Enable "Advanced options"
4. Set IP to static
5. Enter DNS as $localip or $publicip

IOS:
----
1. Open Wi-Fi settings
2. Tap (i) next to your network
3. Configure DNS > Manual
4. Add $localip or $publicip
5. Save changes

EOF
    section=$((section + 1))
fi

# 5. Router Configuration (for public DNS)
if [ "$external_access_method" -eq 1 ]; then
    cat >> "$tasks_file" <<EOF

$section. CONFIGURE PIHOLE IN YOUR ROUTER
-----------------------------------------
ASUS ROUTERS:
-------------
1. Log in to router admin (http://$gateway)
2. Navigate to LAN > DHCP Server
3. Under "DNS Server", enter $localip
4. Click "Apply" to save

TP-LINK ROUTERS:
---------------
1. Log in to router admin (http://$gateway)
2. Go to Advanced > Network > DHCP Server
3. Set "Primary DNS" to $localip
4. Click "Save" to apply

GENERAL NOTES:
--------------
- Changes affect all DHCP clients
- Some routers allow multiple DNS servers (comma-separated)
- Restart devices to receive new DNS settings
- after waiting up to 4 hours for changes to propagate: Verify DNS propagation with: nslookup $domain

EOF
    section=$((section + 1))
fi

if [ "$SHOULD_PAUSE" -eq "false" ]; then
# 3. Nginx and Dockge Pre-Configuration
cat >> "$tasks_file" <<EOF

$section. NGINX AND DOCKGE PRE-CONFIGURATION
-------------------------------------------

NGINX:
------
go to http://$localip:81 and make the admin account

DOCKGE:
-------
go to http://$localip:5001 and make  the admin account

FILEBROWSER:
------------
log into http://$localip:5001, go to the "browser" stack, in the console output, it should list the randomly generated admin password

log into http://browser.$domain using username "admin" and the randomly generated password

reset the password to your own password and change the username if desired.

EOF
section=$((section + 1))
fi

# 4. Certificate Configuration
if [ "$external_access_method" -eq 1 ]; then
    # Public DNS method - Let's Encrypt
    cat >> "$tasks_file" <<EOF

$section. CONFIGURE CERTIFICATES USING LET'S ENCRYPT
---------------------------------------------------
Make sure your DNS records are properly configured before proceeding.

# Step 1:
go to proxy.?domain? and log in with your admin account

# Step 2:
go to the "Certificates" tab and click Add Certificate > Let's Encrypt via HTTP

# Step 3: 
copy the contents of the "npmcertlist.txt" file into the domain names field.
copy one line at a time if using ctrl+c/ctrl+v, be sure to press enter between each line.

if you make use of clickpaste (or any tool that allows you to paste by simulating keyboard input), you can use that to paste the entire list in one go

or you can type the entire list manually

# Step 4:
hit "save" and wait.

# Step 5:
go to the Hosts > proxy hosts tab and go through each of the hosts

# Step 6: 
repeat for each host: 
>go to the SSL tab
>select your certificate
>enable force SSL
in the case of owncloud you may also want to enable HTTP/2 
then hit save.

once you've done this for all your sites, your entire cloud is now running with SSL encryption.

EOF
else
    # Local DNS methods - Self-signed certs
    cat >> "$tasks_file" <<EOF

$section. CONFIGURE CERTIFICATES USING GENCERTS.SH
------------------------------------------------
run the gencerts.sh script, this will generate the certs for you and put them in a folder inside browser.$domain which should now be reachable over http

on http://$localip:81, log in, go to certificates > add certificate > custom

fill in your main domain as the Name

for the certificate key, use the wildcard.key file
for the certificate, use the wildcard.crt file
for the intermediate certificate, use the intermediate.crt file


because this certificate is not backed by a public certificate authority like letsencrypt, you have to manually trust the root cert on each device you want to use the cloud on, or deal with "certificate untrusted" warnings.

below are guides for doing this:


windows:

download and double-click rootCA.pfx
select "Local Machine" and click next, password is empty.
choose "place all certificates in the following store" and choose "Trusted Root Certification Authorities"
click finish and confirm with "yes" if prompted.

macOS:

download and double-click rootCA.pfx
if prompted for a password, leave it blank and click yes
open Keychain Access (applications/utilities/keychain access)
locate the imported rootCA.pfx certificate in the login or system keychains.
double-click the certificate, expand the "trust" section and set "When using this certificate" to "always trust"

Linux:

download the rootCA.crt file
copy rootCA.crt to /usr/local/share/ca-certificates/ using the following command from the directory rootCA.crt is in, or by using your file manager.
sudo cp rootCA.crt /usr/local/share/ca-certificates/

then update the CA store by rebooting or running the following command:
sudo update-ca-certificates

android:

download rootCA.crt to your device
open settings > security > encryption & credentials > install a certificate
select rootCA.crt and set a Name
reboot if prompted

IOS:

download rootCA.crt to your device
open the file in safari and tap "install"
go to settings > general > VPN & Device management > configuration profile and install the certificate
enable full trust in settings > general > about > certificate trust settings

OWNCLOUD:

for owncloud's onlyoffice integration, you'll have to disable certificate validation in the settings menu. 


now that you've set your DNS correctly and trusted the cert, you should be able to visit all of your sites via https://dash.$domain 

the certificate is valid for 10 years, after which you can generate a new one with gencerts.sh
EOF
fi
section=$((section + 1))



# 6. Service Configurations
if [ "$SHOULD_PAUSE" -eq "false" ]; then
cat >> "$tasks_file" <<EOF

$section. CONFIGURE SERVICES
---------------------------
Complete the initial setup for these services:

JELLYFIN:
log into https://video.$domain and run through the first-time setup.


BOOKSTACK:
<include_content_here: instructions for initial BookStack setup including admin account creation>

EOF
section=$((section + 1))
fi
# 7. Uptime Kuma Configuration (last since it depends on DNS and HTTPS)
cat >> "$tasks_file" <<EOF

$section. CONFIGURE UPTIME KUMA
---------------------------

MONITORING:
-----------
# Step 1:
head to status.?domain? and log in.

# Step 2:
click on "Add New Monitor"

# Step 2.5 (optional):
Set monitor type to "Group", friendly name to the group name and retries to 10. 
repeat this for any groups you want, for example: Frontend and Backend

# Step 3:
use the following settings:
type: HTTP(s)
Friendly Name: Name of your service (for example: Cloud)
url: the URL for the site (for example: https://cloud.?domain?)
Retries: 10
certificate expiry notification: on
cachebuster: on
group: optionally set this to the group you want

leave all the other settings as default

# Step 4:
repeat step 3 for every service, for an easy list of URLs, go to proxy.?domain? and log in, you can see the list of proxy hosts which is also all of your URLs. 

# Step 5 (optional):
make a status page, instructions in Uptime Kuma - status page.txt


STATUS PAGE:
------------
# Step 1: 
log in to status.?domain and click on "Status Pages" in the top right.

# Step 2:
make a new status page, Name it whatever you want and use slug "default"

# Step 3: add all of the monitors you want to the page.

# step 4: add a description if you'd like. 


this status page is available at status.?domain?/status

any other status pages you make are available at status.?domain?/status/<slug>


EOF

# Add footer with additional information
cat >> "$tasks_file" <<EOF

ADDITIONAL INFORMATION
======================

ACCESS URLs:
- PiHole Admin: http://$localip/admin
- Nginx Proxy Manager: http://$localip:81
<include_content_here: list all other service URLs>

IMPORTANT NOTES:
- Your local network is: $network_address/$netmask
- Your broadcast address is: $broadcast_address
<include_content_here: any other important notes>

EOF

# Output success message
echo "Post-install tasks file generated: $tasks_file"
echo "Please follow the tasks in order as some services depend on others!"
echo "if you are using public DNS with a static ip, you can also already access this from http://browser.$domain, if you are using local DNS, you will need to do additional configuration"
echo "you can open this file on this machine using the command 'sudo nano $tasks_file'"
echo ""
echo "for your convenience, the tasks file will be copied to the current user's home directory"
cp $tasks_file ~/post-install.txt
# Capture the end time (Unix timestamp)
END_TIME=$(date +%s)

# Calculate the elapsed time
ELAPSED_TIME=$((END_TIME - START_TIME))
echo "Script took $ELAPSED_TIME seconds to complete."
echo "please reboot before further use"