sudo apt update && sudo apt upgrade -y

# Install required packages
sudo apt install -y python3 python3-pip python3-venv postgresql postgresql-contrib git curl

# Install UV (Python package manager)
curl -LsSf https://astral.sh/uv/install.sh | sh
source ~/.bashrc

# Create database and user
sudo -u postgres createdb tuxdb
sudo -u postgres createuser tuxuser

# Set password and grant permissions
sudo -u postgres psql << EOF
ALTER USER tuxuser WITH PASSWORD 'your_secure_password_here';
GRANT ALL PRIVILEGES ON DATABASE tuxdb TO tuxuser;
ALTER DATABASE tuxdb OWNER TO tuxuser;
EOF

# Create dedicated user for running Tux
sudo useradd -r -m -s /bin/bash tux
sudo -u tux -i

# As tux user
cd ~
git clone https://github.com/allthingslinux/tux.git
cd tux

# Install dependencies
uv sync

# Create .env file
cat > .env << 'EOF'
BOT_TOKEN=your_discord_bot_token
POSTGRES_HOST=localhost
POSTGRES_PORT=5432
POSTGRES_DB=tuxdb
POSTGRES_USER=tuxuser
POSTGRES_PASSWORD=your_secure_password
ENVIRONMENT=production
DEBUG=false
EOF

# Secure permissions
chmod 600 .env

uv run db push

# Test run
uv run tux start

# Should connect to Discord
# Press Ctrl+C to stop

# As root/sudo
sudo nano /etc/systemd/system/tux.service

[Unit]
Description=Tux Discord Bot
After=network.target postgresql.service
Requires=postgresql.service

[Service]
Type=simple
User=tux
Group=tux
WorkingDirectory=/home/tux/tux
Environment=PATH=/home/tux/tux/.venv/bin:/usr/local/bin:/usr/bin:/bin
ExecStart=/home/tux/tux/.venv/bin/python -m tux
Restart=always
RestartSec=10
StandardOutput=journal
StandardError=journal
SyslogIdentifier=tux

# Security hardening
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=true
ReadWritePaths=/home/tux/tux/data /home/tux/tux/logs
ProtectKernelTunables=true
ProtectControlGroups=true

[Install]
WantedBy=multi-user.target

# Reload systemd
sudo systemctl daemon-reload

# Enable service (start on boot)
sudo systemctl enable tux

# Start service
sudo systemctl start tux

# Check status
sudo systemctl status tux

# Start
sudo systemctl start tux

# Stop
sudo systemctl stop tux

# Restart
sudo systemctl restart tux

# Status
sudo systemctl status tux

# Enable (start on boot)
sudo systemctl enable tux

# Disable (don't start on boot)
sudo systemctl disable tux

# View recent logs
sudo journalctl -u tux -n 100

# Follow logs
sudo journalctl -u tux -f

# Logs since boot
sudo journalctl -u tux -b

# Logs from last hour
sudo journalctl -u tux --since "1 hour ago"

# Search logs
sudo journalctl -u tux | grep ERROR

# As tux user
sudo -u tux -i
cd ~/tux

# Run migrations
uv run db push

# Check health
uv run db health

# Backup database
pg_dump -h localhost -U tuxuser tuxdb > backup_$(date +%Y%m%d).sql

# As tux user
sudo -u tux -i
cd ~/tux

# Pull latest changes
git pull

# Update dependencies
uv sync

# Run new migrations
uv run db push

# Exit tux user
exit

# Restart service
sudo systemctl restart tux

# Check logs
sudo journalctl -u tux -f

sudo nano /etc/logrotate.d/tux

/home/tux/tux/logs/*.log {
    daily
    rotate 30
    compress
    delaycompress
    missingok
    notifempty
    create 644 tux tux
    postrotate
        systemctl reload tux > /dev/null 2>&1 || true
    endscript
}

sudo nano /usr/local/bin/check-tux.sh

#!/bin/bash
if ! systemctl is-active --quiet tux; then
    echo "Tux is down! Restarting..."
    systemctl restart tux

    # Optional: Send alert
    # curl -X POST webhook_url -d "Tux restarted"
fi

# Check every 5 minutes
*/5 * * * * /usr/local/bin/check-tux.sh

# Install UFW
sudo apt install ufw

# Allow SSH
sudo ufw allow ssh

# Allow PostgreSQL (only if needed externally)
# sudo ufw allow 5432/tcp

# Enable firewall
sudo ufw enable

# Edit PostgreSQL config
sudo nano /etc/postgresql/15/main/postgresql.conf

# Listen only on localhost
listen_addresses = 'localhost'

# Reload
sudo systemctl reload postgresql

# Check status
sudo systemctl status tux

# Check logs
sudo journalctl -u tux -n 50

# Validate service file
systemd-analyze verify tux.service

# Test manually
sudo -u tux -i
cd ~/tux
uv run tux start

# Fix ownership
sudo chown -R tux:tux /home/tux/tux

# Fix .env permissions
sudo -u tux chmod 600 /home/tux/tux/.env

# Check PostgreSQL is running
sudo systemctl status postgresql

# Test connection
psql -h localhost -U tuxuser -d tuxdb

# Check pg_hba.conf
sudo nano /etc/postgresql/15/main/pg_hba.conf

shared_buffers = 256MB              # 25% of RAM
effective_cache_size = 1GB          # 50-75% of RAM
work_mem = 16MB
maintenance_work_mem = 128MB
max_connections = 100

sudo systemctl restart postgresql

htop                                # Interactive process viewer
free -h                             # Memory usage
df -h                               # Disk usage