# Installa Docker su Ubuntu
apt update && apt install -y ca-certificates curl gnupg git jq
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | \
    gpg --dearmor -o /etc/apt/keyrings/docker.gpg
apt install -y docker-ce docker-ce-cli docker-compose-plugin

# Clone repository
git clone https://git.certisource.it/AdminGit2026/wms-agile.git /var/www/wms-agile

# CRITICO: imposta nome progetto (evita conflitti Docker)
echo "COMPOSE_PROJECT_NAME=wms-agile" > /var/www/wms-agile/infrastructure/.env

# Copia template per ogni servizio
for svc in auth inventory warehouse inbound outbound report ai calendar wcs network; do
    cp services/${svc}-ms/.env services/${svc}-ms/.env.production
done

# JWT_SECRET uguale per tutti (CRITICO)
JWT=$(openssl rand -hex 32)
for svc in auth inventory warehouse inbound outbound report ai calendar wcs network; do
    sed -i "s/^JWT_SECRET=.*/JWT_SECRET=${JWT}/" services/${svc}-ms/.env.production
done

# Build e start (prima volta ~15 min)
cd /var/www/wms-agile/infrastructure
COMPOSE_PROJECT_NAME=wms-agile docker compose \
    -f docker-compose.yml -f docker-compose.production.yml up -d --build

# Verifica health check (attendi ~60s per MySQL)
for port in 3081 3082 3083 3084 3085 3086 3087; do
    echo "Porta $port: $(curl -sk -o /dev/null -w '%{http_code}' http://127.0.0.1:$port/health)"
done

./infrastructure/first-install.sh \
    https://wms.tuodominio.it \
    "Nome Azienda" admin@azienda.it "Password2026!"

# Output atteso: 12/12 ✅  (tenant + admin + warehouse + 6 zone + 3 prodotti)

<VirtualHost *:443>
    ServerName wms.tuodominio.it
    SSLEngine on
    SSLCertificateFile    /etc/letsencrypt/live/wms.tuodominio.it/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/wms.tuodominio.it/privkey.pem
    ProxyPreserveHost On
    ProxyPass        / http://127.0.0.1:3080/
    ProxyPassReverse / http://127.0.0.1:3080/
    # SSE streaming AI: no buffering
    ProxyPassMatch ^/api/ai/chat$ http://127.0.0.1:3080/api/ai/chat
    Header always set Cache-Control "no-cache"
</VirtualHost>

certbot --apache -d wms.tuodominio.it
a2ensite wms-agile wms-agile-ssl && systemctl reload apache2

# 1. Auto-seed moduli WMS (15 guide operative, ~90 secondi)
POST /api/ai/knowledge/seed-wms
# → indicizza Dashboard, Inbound, Outbound, Missioni, 4PL, TMS, RAG, WCS, Rete Filiera...

# 2. Indicizza documento custom (SOP aziendale, manuale fornitore, policy)
POST /api/ai/knowledge/ingest
Content-Type: application/json
{
  "doc_id":   "sop-gdp-2026-003",
  "title":   "SOP GDP — Gestione Farmaci 2-8°C",
  "content": "Procedura operativa: i farmaci refrigerati vanno...",
  "source":  "wms://sop/gdp/003"
}

# 3. Verifica statistiche knowledge base
GET /api/ai/knowledge/stats
# → { "points_count": 36, "status": "green", "collection": "wms_kb_1" }

# Standard: pull + rebuild + sql
cd /var/www/wms-agile && git pull origin main
cd infrastructure
COMPOSE_PROJECT_NAME=wms-agile docker compose \
    -f docker-compose.yml -f docker-compose.production.yml up -d --build
./deploy-hetzner.sh --verify

# Hot-fix PHP (immediato, non persiste al restart)
docker cp services/inbound-ms/src/Services/InboundService.php \
    wms-inbound-ms:/var/www/services/inbound-ms/src/Services/
docker exec wms-inbound-ms kill -USR2 1

docker logs wms-{svc}-ms --tail=50
docker inspect wms-mysql | grep -A5 '"Health"'

# Verifica JWT_SECRET allineato
for svc in auth inventory warehouse; do
    echo -n "$svc: "; grep JWT_SECRET services/${svc}-ms/.env.production
done
# Se disallineati: riavvia TUTTI
docker restart $(docker ps --filter name=wms --format "{{.Names}}")

docker exec wms-ai-ms env | grep ANTHROPIC_API_KEY
docker logs wms-ai-ms --tail=20

# File: /etc/cron.d/wms-ai-autolearn
0 3 * * * root curl -s -X POST http://127.0.0.1:3087/api/ai/knowledge/auto-learn \
    -H "X-API-Key: YOUR_API_KEY" >> /var/log/wms-ai-autolearn.log 2>&1

# Trigger manuale (es. dopo import dati massivo)
curl -s -X POST http://127.0.0.1:3087/api/ai/knowledge/auto-learn \
    -H "X-API-Key: YOUR_API_KEY" | python3 -m json.tool
# Risposta attesa: {"success":true,"data":{"indexed":5,"total":5}}

-- wms_inventory_db
CREATE TABLE cycle_counts (
    id INT AUTO_INCREMENT PRIMARY KEY,
    tenant_id INT NOT NULL,
    code VARCHAR(30) UNIQUE,
    type ENUM('full','zone','spot') DEFAULT 'full',
    zone_id INT NULL,              -- NULL = full warehouse
    status ENUM('planned','in_progress','completed','cancelled'),
    scheduled_date DATE,
    completed_at TIMESTAMP NULL,
    operator_id INT NULL,
    notes TEXT NULL,
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
);

CREATE TABLE cycle_count_lines (
    id INT AUTO_INCREMENT PRIMARY KEY,
    cycle_count_id INT NOT NULL,
    product_id INT NOT NULL,
    bin_code VARCHAR(30),
    expected_qty DECIMAL(12,2),    -- sistema
    counted_qty DECIMAL(12,2) NULL, -- operatore
    variance DECIMAL(12,2) NULL,
    counted_at TIMESTAMP NULL,
    FOREIGN KEY (cycle_count_id) REFERENCES cycle_counts(id)
);

WMS App ──→ wcs-ms (REST API) ──→ Mosquitto (MQTT broker) ──→ AGV/PLC
   ↑                                        │
   └────── SSE events ◄─── subscribe ◄──────┘

# Verifica MQTT broker
docker logs wms-mosquitto --tail=20
# Test publish
docker exec wms-mosquitto mosquitto_pub -t "wms/agv/AGV-01/status" \
    -m '{"battery":85,"state":"idle","zone":"PICK-A"}'
# WCS health
curl -s http://127.0.0.1:3089/health | python3 -m json.tool

# CRITICO: proxy_http_version 1.1 SOLO nei location SSE
# A livello server block causa 405 per tutti i POST!
location ~ ^/api/realtime {
    proxy_pass http://warehouse_service;
    proxy_http_version 1.1;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header Connection '';
    proxy_buffering off;
    proxy_cache off;
    proxy_read_timeout 130s;
    chunked_transfer_encoding on;
}

// Strategia: cache-first per shell, network-only per API
const CACHE_NAME = 'wms-op-v2';
const SHELL_ASSETS = [
    '/operator.html', '/mobile.html',
    '/css/mobile.css', '/js/mobile.js',
    '/js/api.js',
    'https://cdnjs.cloudflare.com/.../all.min.css'
];

# Backup completo tutti i 7 DB WMS
for db in wms_auth_db wms_inventory_db wms_warehouse_db wms_inbound_db wms_outbound_db wms_report_db wms_agile_db; do
    docker exec wms-mysql mysqldump -u wms_user -pWmsAgile2026! $db | \
        gzip > /backup/wms/${db}_$(date +%Y%m%d_%H%M).sql.gz
done
# Retention: 30 giorni
find /backup/wms -name "*.sql.gz" -mtime +30 -delete

# Snapshot Qdrant
curl -X POST http://127.0.0.1:6333/snapshots
# Copia snapshot dal volume Docker
docker cp wms-qdrant:/qdrant/snapshots/ /backup/wms/qdrant/

# 1. Restore database
gunzip -c /backup/wms/wms_inventory_db_20260325.sql.gz | \
    docker exec -i wms-mysql mysql -u wms_user -pWmsAgile2026! wms_inventory_db
# 2. Restart tutti i container
cd /var/www/wms-agile/infrastructure
COMPOSE_PROJECT_NAME=wms-agile docker compose \
    -f docker-compose.yml -f docker-compose.production.yml up -d
# 3. Re-indicizza RAG (i dati DB sono aggiornati, i vector devono seguire)
curl -X POST http://127.0.0.1:3087/api/ai/knowledge/auto-learn \
    -H "X-API-Key: YOUR_API_KEY"
curl -X POST http://127.0.0.1:3087/api/ai/knowledge/seed-wms \
    -H "X-API-Key: YOUR_API_KEY"