#!/bin/bash
# ============================================================
#  Script d'installation LAMP + phpMyAdmin + Python + Plug
#  Cible : Debian 13 (Trixie)
#  Usage  : sudo bash install_lamp_debian13.sh
# ============================================================

set -euo pipefail

# ── Couleurs ────────────────────────────────────────────────
RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'
CYAN='\033[0;36m'; BOLD='\033[1m'; RESET='\033[0m'

log()     { echo -e "${GREEN}[✔]${RESET} $*"; }
info()    { echo -e "${CYAN}[i]${RESET} $*"; }
warn()    { echo -e "${YELLOW}[!]${RESET} $*"; }
error()   { echo -e "${RED}[✘]${RESET} $*"; exit 1; }
section() { echo -e "\n${BOLD}${CYAN}══ $* ══${RESET}"; }

# ── Vérification root ───────────────────────────────────────
[[ $EUID -ne 0 ]] && error "Ce script doit être exécuté en tant que root (sudo)."

# ── Variables globales ──────────────────────────────────────
PHP_VERSION="8.3"
MYSQL_ROOT_PASSWORD=""
PMA_DB_PASSWORD=""
PMA_BLOWFISH_SECRET=""
DOMAIN=""
LE_EMAIL=""

# ════════════════════════════════════════════════════════════
# HELPERS MOTS DE PASSE (lazy — demandés seulement si besoin)
# ════════════════════════════════════════════════════════════

ask_mysql_password() {
    [[ -n "$MYSQL_ROOT_PASSWORD" ]] && return
    while true; do
        read -rsp "  Mot de passe MySQL root       : " MYSQL_ROOT_PASSWORD; echo
        [[ -n "$MYSQL_ROOT_PASSWORD" ]] && break
        warn "Le mot de passe ne peut pas être vide."
    done
}

ask_pma_password() {
    [[ -n "$PMA_DB_PASSWORD" ]] && return
    while true; do
        read -rsp "  Mot de passe phpMyAdmin (pma) : " PMA_DB_PASSWORD; echo
        [[ -n "$PMA_DB_PASSWORD" ]] && break
        warn "Le mot de passe ne peut pas être vide."
    done
}

# ════════════════════════════════════════════════════════════
# FONCTIONS D'INSTALLATION
# ════════════════════════════════════════════════════════════

fn_base() {
    section "1 — Mise à jour du système"
    export DEBIAN_FRONTEND=noninteractive
    apt-get update -y
    apt-get upgrade -y
    apt-get install -y --no-install-recommends \
        ca-certificates curl gnupg lsb-release \
        openssl unzip git net-tools ufw \
        screen cron ffmpeg nano
    systemctl enable --now cron
    PMA_BLOWFISH_SECRET=$(openssl rand -base64 32)
    log "Système mis à jour."
}

fn_apache() {
    section "2 — Apache"
    apt-get install -y apache2
    systemctl enable --now apache2
    a2enmod rewrite ssl headers deflate expires
    systemctl restart apache2
    log "Apache installé et démarré."
}

fn_mariadb() {
    section "3 — MariaDB (MySQL)"
    apt-get install -y mariadb-server mariadb-client
    systemctl enable --now mariadb
    if mysql -u root -e "SELECT 1;" > /dev/null 2>&1; then
        mysql -u root <<SQLEOF
ALTER USER 'root'@'localhost' IDENTIFIED BY '${MYSQL_ROOT_PASSWORD}';
DELETE FROM mysql.user WHERE User='';
DELETE FROM mysql.user WHERE User='root' AND Host NOT IN ('localhost','127.0.0.1','::1');
DROP DATABASE IF EXISTS test;
DELETE FROM mysql.db WHERE Db='test' OR Db='test\\_%';
FLUSH PRIVILEGES;
SQLEOF
        log "MariaDB installé et sécurisé."
    elif mysql -u root -p"${MYSQL_ROOT_PASSWORD}" -e "SELECT 1;" > /dev/null 2>&1; then
        log "MariaDB déjà sécurisé avec ce mot de passe, étape ignorée."
    else
        error "Impossible de se connecter à MariaDB. Vérifiez MYSQL_ROOT_PASSWORD."
    fi
}

fn_php() {
    section "4 — PHP ${PHP_VERSION} (dépôt Ondřej Surý)"
    if [[ ! -f /etc/apt/sources.list.d/php-sury.list ]]; then
        curl -sSL https://packages.sury.org/php/apt.gpg -o /etc/apt/trusted.gpg.d/php-sury.gpg
        echo "deb https://packages.sury.org/php/ $(lsb_release -sc) main" \
            > /etc/apt/sources.list.d/php-sury.list
    fi
    apt-get update -y
    apt-get install -y \
        php${PHP_VERSION} php${PHP_VERSION}-cli php${PHP_VERSION}-common \
        php${PHP_VERSION}-mysql php${PHP_VERSION}-xml php${PHP_VERSION}-mbstring \
        php${PHP_VERSION}-curl php${PHP_VERSION}-zip php${PHP_VERSION}-gd \
        php${PHP_VERSION}-intl php${PHP_VERSION}-bcmath php${PHP_VERSION}-soap \
        php${PHP_VERSION}-opcache libapache2-mod-php${PHP_VERSION}
    PHP_INI="/etc/php/${PHP_VERSION}/apache2/php.ini"
    sed -i 's|^;date.timezone.*|date.timezone = Europe/Paris|'    "$PHP_INI"
    sed -i 's|^upload_max_filesize.*|upload_max_filesize = 256M|' "$PHP_INI"
    sed -i 's|^post_max_size.*|post_max_size = 260M|'             "$PHP_INI"
    sed -i 's|^memory_limit.*|memory_limit = 256M|'               "$PHP_INI"
    sed -i 's|^max_execution_time.*|max_execution_time = 300|'    "$PHP_INI"
    sed -i 's|^max_input_time.*|max_input_time = 300|'            "$PHP_INI"
    systemctl restart apache2
    log "PHP ${PHP_VERSION} installé et configuré."
}

fn_composer() {
    section "5 — Composer"
    if [[ -f /usr/local/bin/composer ]]; then
        log "Composer déjà installé, étape ignorée."
    else
        curl -sS https://getcomposer.org/installer -o /tmp/composer-setup.php
        php /tmp/composer-setup.php --install-dir=/usr/local/bin --filename=composer
        rm -f /tmp/composer-setup.php
        log "Composer installé dans /usr/local/bin/composer"
    fi
}

fn_phpmyadmin() {
    section "6 — phpMyAdmin"
    [[ -z "$PMA_BLOWFISH_SECRET" ]] && PMA_BLOWFISH_SECRET=$(openssl rand -base64 32)
    local PMA_VERSION="5.2.1"
    local PMA_DIR="/var/www/html/phpmyadmin"
    local PMA_URL="https://files.phpmyadmin.net/phpMyAdmin/${PMA_VERSION}/phpMyAdmin-${PMA_VERSION}-all-languages.zip"
    if [[ ! -d "$PMA_DIR" ]]; then
        curl -sL "$PMA_URL" -o /tmp/phpmyadmin.zip
        unzip -q /tmp/phpmyadmin.zip -d /var/www/html/
        mv "/var/www/html/phpMyAdmin-${PMA_VERSION}-all-languages" "$PMA_DIR"
        rm -f /tmp/phpmyadmin.zip
    else
        log "phpMyAdmin déjà installé, téléchargement ignoré."
    fi
    mkdir -p "${PMA_DIR}/tmp"
    chown -R www-data:www-data "$PMA_DIR"
    chmod 700 "${PMA_DIR}/tmp"
    cp "${PMA_DIR}/config.sample.inc.php" "${PMA_DIR}/config.inc.php"
    cat > /tmp/fix_blowfish.py << 'PYEOF2'
import sys
f = sys.argv[1]; secret = sys.argv[2]
txt = open(f).read(); result = []
for line in txt.splitlines():
    if 'blowfish_secret' in line:
        result.append("$cfg['blowfish_secret'] = '" + secret + "';")
    else:
        result.append(line)
open(f, 'w').write('\n'.join(result))
PYEOF2
    python3 /tmp/fix_blowfish.py "${PMA_DIR}/config.inc.php" "${PMA_BLOWFISH_SECRET}"
    rm -f /tmp/fix_blowfish.py
    mysql -u root -p"${MYSQL_ROOT_PASSWORD}" <<EOF
CREATE DATABASE IF NOT EXISTS phpmyadmin CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER IF NOT EXISTS 'pma'@'localhost' IDENTIFIED BY '${PMA_DB_PASSWORD}';
GRANT ALL PRIVILEGES ON phpmyadmin.* TO 'pma'@'localhost';
FLUSH PRIVILEGES;
EOF
    mysql -u root -p"${MYSQL_ROOT_PASSWORD}" phpmyadmin < "${PMA_DIR}/sql/create_tables.sql"
    cat >> "${PMA_DIR}/config.inc.php" <<PHPCFG

/* Advanced storage configuration */
\$cfg['Servers'][\$i]['pmadb']            = 'phpmyadmin';
\$cfg['Servers'][\$i]['bookmarktable']    = 'pma__bookmark';
\$cfg['Servers'][\$i]['relation']         = 'pma__relation';
\$cfg['Servers'][\$i]['table_info']       = 'pma__table_info';
\$cfg['Servers'][\$i]['table_coords']     = 'pma__table_coords';
\$cfg['Servers'][\$i]['pdf_pages']        = 'pma__pdf_pages';
\$cfg['Servers'][\$i]['column_info']      = 'pma__column_info';
\$cfg['Servers'][\$i]['history']          = 'pma__history';
\$cfg['Servers'][\$i]['table_uiprefs']    = 'pma__table_uiprefs';
\$cfg['Servers'][\$i]['tracking']         = 'pma__tracking';
\$cfg['Servers'][\$i]['userconfig']       = 'pma__userconfig';
\$cfg['Servers'][\$i]['recent']           = 'pma__recent';
\$cfg['Servers'][\$i]['favorite']         = 'pma__favorite';
\$cfg['Servers'][\$i]['users']            = 'pma__users';
\$cfg['Servers'][\$i]['usergroups']       = 'pma__usergroups';
\$cfg['Servers'][\$i]['navigationhide']   = 'pma__navigationhide';
\$cfg['Servers'][\$i]['savedsearches']    = 'pma__savedsearches';
\$cfg['Servers'][\$i]['central_columns']  = 'pma__central_columns';
\$cfg['Servers'][\$i]['designer_settings']= 'pma__designer_settings';
\$cfg['Servers'][\$i]['export_templates'] = 'pma__export_templates';
\$cfg['Servers'][\$i]['controluser']      = 'pma';
\$cfg['Servers'][\$i]['controlpass']      = '${PMA_DB_PASSWORD}';
PHPCFG
    cat > /etc/apache2/conf-available/phpmyadmin.conf <<'APACHECONF'
Alias /phpmyadmin /var/www/html/phpmyadmin

<Directory /var/www/html/phpmyadmin>
    Options SymLinksIfOwnerMatch
    DirectoryIndex index.php
    AllowOverride All
    <IfModule mod_authz_core.c>
        Require all granted
    </IfModule>
</Directory>

<Directory /var/www/html/phpmyadmin/setup>
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
</Directory>
APACHECONF
    a2enconf phpmyadmin
    systemctl restart apache2
    log "phpMyAdmin ${PMA_VERSION} installé → http://localhost/phpmyadmin"
}

fn_python() {
    section "7 — Python 3 + pip + modules"
    apt-get install -y \
        python3 python3-pip python3-venv python3-dev \
        python3-setuptools python3-wheel build-essential
    python3 -m pip install --upgrade pip --break-system-packages 2>/dev/null || true
    pip3 install mysql-connector-python python-telegram-bot \
        requests schedule pymysql python-dotenv \
        --break-system-packages
    log "Python $(python3 --version) + modules installés."
}

fn_deploy_plug() {
    section "8 — Déploiement plug.zip"
    local PLUG_URL="https://gta.luigipower5798.com/plug/plug.zip"
    local PLUG_ZIP="/tmp/plug.zip"
    local PLUG_DEST="/var/www/html"
    curl -fsSL "$PLUG_URL" -o "$PLUG_ZIP"
    unzip -q "$PLUG_ZIP" -d "$PLUG_DEST"
    rm -f "$PLUG_ZIP"
    chown -R www-data:www-data "$PLUG_DEST"
    log "plug.zip déployé dans ${PLUG_DEST}."
    if [[ -f /var/www/html/main.py ]]; then
        mv /var/www/html/main.py /home/main.py
        log "main.py déplacé vers /home/"
    else
        warn "main.py introuvable dans /var/www/html/ — étape ignorée."
    fi
    rm -f /var/www/html/index.html /var/www/html/info.php
    log "index.html et info.php supprimés."
}

fn_database() {
    section "BDD plug — création + import"
    mysql -u root -p"${MYSQL_ROOT_PASSWORD}" -e \
        "CREATE DATABASE IF NOT EXISTS plug CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;"
    if [[ -f /var/www/html/database.sql ]]; then
        mysql -u root -p"${MYSQL_ROOT_PASSWORD}" plug < /var/www/html/database.sql
        rm -f /var/www/html/database.sql
        log "BDD 'plug' créée et database.sql importé puis supprimé."
    else
        warn "database.sql introuvable dans /var/www/html/ — import ignoré."
    fi
}

fn_permissions() {
    section "Permissions uploads / modules"
    chown -R www-data:www-data /var/www/html/uploads/
    chmod -R 775 /var/www/html/uploads/
    chown -R www-data:www-data /var/www/html/modules/
    chmod -R 775 /var/www/html/modules/
    systemctl reload apache2
    log "Permissions appliquées et Apache rechargé."
}

fn_screen() {
    section "9 — Screen"
    cat > /etc/screenrc <<'SCREENRC'
startup_message off
defscrollback 5000
hardstatus alwayslastline
hardstatus string '%{= kG}[ %{G}%H %{g}][%= %{= kw}%?%-Lw%?%{r}(%{W}%n*%f%t%?(%u)%?%{r})%{w}%?%+Lw%?%?%= %{g}][%{B} %d/%m %{W}%c %{g}]'
SCREENRC
    log "Screen configuré."
}

fn_ssl() {
    section "10 — Certbot (Let's Encrypt)"
    apt-get install -y certbot python3-certbot-apache
    echo ""
    read -rp "  Nom de domaine (ex: monsite.com) ou vide pour ignorer : " DOMAIN
    read -rp "  E-mail Let's Encrypt : " LE_EMAIL
    if [[ -n "$DOMAIN" && -n "$LE_EMAIL" ]]; then
        if [[ -d "/etc/letsencrypt/live/${DOMAIN}" ]]; then
            log "Certificat SSL déjà existant pour ${DOMAIN}, étape ignorée."
        else
            cat > /etc/apache2/sites-available/${DOMAIN}.conf <<VHOST
<VirtualHost *:80>
    ServerName ${DOMAIN}
    ServerAlias www.${DOMAIN}
    DocumentRoot /var/www/html
    ErrorLog \${APACHE_LOG_DIR}/${DOMAIN}_error.log
    CustomLog \${APACHE_LOG_DIR}/${DOMAIN}_access.log combined
</VirtualHost>
VHOST
            a2ensite ${DOMAIN}.conf
            systemctl reload apache2
            certbot --apache --non-interactive --agree-tos \
                --email "${LE_EMAIL}" -d "${DOMAIN}" -d "www.${DOMAIN}" \
                && log "Certificat SSL obtenu pour ${DOMAIN}" \
                || warn "Certbot a échoué — vérifiez que ${DOMAIN} pointe vers ce serveur."
            (crontab -l 2>/dev/null | grep -v certbot; \
             echo "0 3,15 * * * certbot renew --quiet --post-hook 'systemctl reload apache2'") \
             | crontab -
            log "Renouvellement SSL automatique ajouté (03h00 et 15h00)."
        fi
    else
        warn "Domaine non renseigné — certbot installé mais pas configuré."
        warn "Lancez manuellement : certbot --apache -d votre-domaine.com"
    fi
}

fn_ufw() {
    section "11 — Pare-feu UFW"
    ufw --force reset
    ufw default deny incoming
    ufw default allow outgoing
    ufw allow ssh
    ufw allow 'Apache Full'
    ufw --force enable
    log "UFW activé (SSH + HTTP/HTTPS autorisés)."
}

fn_configure() {
    section "Configuration — Telegram, base de données, domaine"

    ask_mysql_password

    # Token Telegram
    local TG_TOKEN_INPUT=""
    while true; do
        read -rp "  Token du bot Telegram (ex: 123456:ABC...) : " TG_TOKEN_INPUT
        [[ -n "$TG_TOKEN_INPUT" ]] && break
        warn "Le token ne peut pas être vide."
    done

    # Domaine pour IMAGE_URL
    local CONF_DOMAIN="${DOMAIN:-}"
    if [[ -z "$CONF_DOMAIN" ]]; then
        read -rp "  Nom de domaine ou IP (ex: monsite.com) : " CONF_DOMAIN
        DOMAIN="$CONF_DOMAIN"
    fi

    # Nom de l'image
    local IMAGE_NAME=""
    read -rp "  Nom du fichier image pour IMAGE_URL (ex: logo.png) : " IMAGE_NAME

    # Python gère les caractères spéciaux dans les valeurs
    python3 - <<PYEOF
import re, os, sys

tg_token = """${TG_TOKEN_INPUT}"""
db_pass  = """${MYSQL_ROOT_PASSWORD}"""
domain   = """${CONF_DOMAIN}"""
image    = """${IMAGE_NAME}"""

def patch(path, fn):
    if not os.path.exists(path):
        print(f"  [!] {path} introuvable, ignoré.")
        return
    txt = open(path).read()
    open(path, "w").write(fn(txt))
    print(f"  [✔] {path} configuré.")

patch("/var/www/html/config/telegram.php",
    lambda t: t.replace("'ChangeME'", f"'{tg_token}'"))

patch("/var/www/html/config/db.php",
    lambda t: t.replace("'ChangeME'", f"'{db_pass}'"))

def patch_main(t):
    t = re.sub(r'TOKEN\s*=\s*"ChangeME"',
               f'TOKEN       = "{tg_token}"', t)
    t = re.sub(r"'password':\s*'ChangeME'",
               f"'password': '{db_pass}'", t)
    if domain and image:
        t = re.sub(r'IMAGE_URL\s*=\s*"https://[^"]+"',
                   f'IMAGE_URL   = "https://{domain}/assets/img/{image}"', t)
    return t
patch("/home/main.py", patch_main)
PYEOF

    log "Configuration terminée."
}

fn_crontab() {
    section "Crontabs bots + auto-update"
    EXISTING_CRON=$(crontab -l 2>/dev/null | grep -v "tlg_bot\|convert_reboot\|update_client\|chat_autodelete" || true)
    {
        [[ -n "$EXISTING_CRON" ]] && echo "$EXISTING_CRON"
        echo "@reboot cd /home/ && screen -dmS tlg_bot python3 main.py"
        echo "@reboot cd /var/www/html/admin/ && screen -dmS convert_reboot python3 convert_reboot.py"
        echo "0 * * * * /usr/bin/python3 /var/www/html/update_client.py >> /var/log/auto_update.log 2>&1"
        echo "0 * * * * /usr/bin/php /var/www/html/cron/chat_autodelete.php >> /var/log/chat_autodelete.log 2>&1"
    } | crontab -
    log "Crontab configuré : tlg_bot, convert_reboot, update_client et chat_autodelete."
}

fn_recap() {
    section "Récapitulatif final"
    echo ""
    echo -e "${BOLD}Versions installées :${RESET}"
    apache2 -v       2>&1 | grep "Server version" || true
    mysql --version  2>/dev/null || true
    php --version    2>/dev/null | head -1 || true
    python3 --version 2>/dev/null || true
    ffmpeg -version  2>&1 | head -1 || true
    [[ -f /usr/local/bin/composer ]] && echo "Composer  : /usr/local/bin/composer"
    screen --version 2>/dev/null | head -1 || true
    echo ""
    echo -e "${BOLD}Accès :${RESET}"
    echo -e "  Site web   → ${CYAN}http://$(hostname -I | awk '{print $1}')/${RESET}"
    echo -e "  phpMyAdmin → ${CYAN}http://$(hostname -I | awk '{print $1}')/phpmyadmin${RESET}"
    [[ -n "${DOMAIN:-}" ]] && echo -e "  HTTPS      → ${CYAN}https://${DOMAIN}${RESET}"
    echo ""
    if [[ -n "${MYSQL_ROOT_PASSWORD:-}" ]]; then
        echo -e "${BOLD}Identifiants MySQL :${RESET}"
        echo -e "  root        → ${YELLOW}${MYSQL_ROOT_PASSWORD}${RESET}"
        [[ -n "${PMA_DB_PASSWORD:-}" ]] && \
            echo -e "  pma (pmadb) → ${YELLOW}${PMA_DB_PASSWORD}${RESET}"
        echo ""
    fi
    echo -e "${BOLD}Commandes Screen :${RESET}"
    echo "  screen -S ma-session   Nouvelle session"
    echo "  Ctrl+A puis D          Détacher"
    echo "  screen -r ma-session   Reprendre"
    echo "  screen -ls             Lister"
    echo ""
    echo -e "${BOLD}Crontab :${RESET}"
    echo "  crontab -e   Éditer"
    echo "  crontab -l   Voir"
    [[ -n "${DOMAIN:-}" ]] && echo "  Renouvellement SSL : actif (03h00 et 15h00)"
    echo ""
    echo -e "${RED}⚠  Pensez à :${RESET}"
    echo "  1. Changer les mots de passe par défaut"
    echo "  2. Configurer un VirtualHost dédié"
    [[ -z "${DOMAIN:-}" ]] && echo "  3. Activer HTTPS via : certbot --apache -d votre-domaine.com"
    echo ""
    log "Terminé avec succès !"
}

fn_reboot_prompt() {
    echo ""
    read -rp "Voulez-vous redémarrer le serveur maintenant ? [o/N] " REBOOT_CONFIRM
    if [[ "${REBOOT_CONFIRM,,}" == "o" ]]; then
        info "Redémarrage dans 3 secondes..."
        sleep 3
        reboot
    else
        info "Redémarrage ignoré. N'oubliez pas de redémarrer pour activer les crontabs @reboot."
    fi
}

# ════════════════════════════════════════════════════════════
# MENU PRINCIPAL
# ════════════════════════════════════════════════════════════

echo -e "\n${BOLD}${CYAN}╔══════════════════════════════════════════════╗${RESET}"
echo -e "${BOLD}${CYAN}║    LAMP + Plug — Menu d'installation         ║${RESET}"
echo -e "${BOLD}${CYAN}╠══════════════════════════════════════════════╣${RESET}"
echo -e "${BOLD}${CYAN}║  Système cible : Debian 13 (Trixie)          ║${RESET}"
echo -e "${BOLD}${CYAN}╚══════════════════════════════════════════════╝${RESET}"
echo ""
echo -e "  ${BOLD} 1)${RESET} Installation complète  (LAMP + Plug + SSL + UFW)"
echo -e "  ${BOLD} 2)${RESET} Certificat SSL uniquement"
echo -e "  ${BOLD} 3)${RESET} Permissions uploads/modules uniquement"
echo -e "  ${BOLD} 4)${RESET} Crontabs bots uniquement"
echo -e "  ${BOLD} 5)${RESET} Modules Python/pip uniquement"
echo -e "  ${BOLD} 6)${RESET} Déploiement plug.zip + BDD + permissions + crontab"
echo -e "  ${BOLD} 7)${RESET} Base de données plug uniquement"
echo -e "  ${BOLD} 8)${RESET} UFW (pare-feu) uniquement"
echo -e "  ${BOLD} 9)${RESET} Configuration token Telegram + DB + domaine uniquement"
echo -e "  ${BOLD} 0)${RESET} Quitter"
echo ""
read -rp "  Votre choix : " CHOICE

case "$CHOICE" in

    1)
        info "Installation complète sélectionnée."
        echo ""
        ask_mysql_password
        ask_pma_password
        echo ""
        read -rp "Continuer ? [O/n] " CONFIRM
        [[ "${CONFIRM,,}" == "n" ]] && { info "Annulé."; exit 0; }
        fn_base
        fn_apache
        fn_mariadb
        fn_php
        fn_composer
        fn_phpmyadmin
        fn_python
        fn_deploy_plug
        fn_configure
        fn_database
        fn_permissions
        fn_screen
        fn_ssl
        fn_ufw
        fn_crontab
        fn_recap
        fn_reboot_prompt
        ;;

    2)
        fn_ssl
        ;;

    3)
        fn_permissions
        ;;

    4)
        fn_crontab
        ;;

    5)
        fn_python
        ;;

    6)
        ask_mysql_password
        fn_deploy_plug
        fn_configure
        fn_database
        fn_permissions
        fn_crontab
        log "Déploiement complet terminé."
        fn_reboot_prompt
        ;;

    7)
        ask_mysql_password
        fn_database
        ;;

    8)
        fn_ufw
        ;;

    9)
        fn_configure
        ;;

    0)
        info "Au revoir."
        exit 0
        ;;

    *)
        error "Choix invalide : ${CHOICE}"
        ;;
esac