#!/usr/bin/env bash
set -euo pipefail
ROOT="$(cd "$(dirname "$0")" && pwd)"
PORTAL="$ROOT/portal"

sudo cp "$ROOT/apache-panaf-portal.conf" /etc/apache2/conf-available/panaf-portal.conf
sudo a2enconf panaf-portal
sudo a2enmod rewrite

# Apache ProtectHome=read-only blocks writes under /home — allow portal uploads
sudo mkdir -p /etc/systemd/system/apache2.service.d
sudo tee /etc/systemd/system/apache2.service.d/panaf-write.conf >/dev/null <<EOF
[Service]
ReadWritePaths=$PORTAL
EOF

# Uploads must be writable by the Apache user
sudo chown -R www-data:www-data "$PORTAL/assets/uploads"
sudo find "$PORTAL/assets/uploads" -type d -exec chmod 775 {} \;
sudo find "$PORTAL/assets/uploads" -type f -exec chmod 664 {} \;

sudo systemctl daemon-reload
sudo apache2ctl configtest
sudo systemctl restart apache2
echo "OK — open http://localhost/panaf/portal/tps.html"
echo "Uploads writable under $PORTAL/assets/uploads"