#!/usr/bin/env bash
# Install Spark SNI vhosts into the shared host nginx (do not replace nginx.conf).
set -euo pipefail

ROOT="$(cd "$(dirname "$0")" && pwd)"
HOST_DIR="$ROOT/host"
BACKUP="/root/nginx-backup-$(date +%Y%m%d%H%M%S)"
DOMAINS=(sparkapi.wyrs365.com sparkim.wyrs365.com sparkr.wyrs365.com)

cert_ok() {
  [[ -f "/etc/letsencrypt/live/$1/fullchain.pem" ]]
}

all_certs_ok() {
  local d
  for d in "${DOMAINS[@]}"; do
    cert_ok "$d" || return 1
  done
}

install_acme_domain() {
  local d=$1
  mkdir -p /var/www/certbot
  cat > "/etc/nginx/conf.d/spark-acme-${d}.conf" <<EOF
server {
    listen 80;
    listen [::]:80;
    server_name ${d};

    location /.well-known/acme-challenge/ {
        root /var/www/certbot;
    }

    location / {
        return 404;
    }
}
EOF
  nginx -t
  systemctl reload nginx
}

issue_missing_certs() {
  local d
  for d in "${DOMAINS[@]}"; do
    if cert_ok "$d"; then
      continue
    fi
    install_acme_domain "$d"
    certbot certonly --webroot -w /var/www/certbot \
      --non-interactive --agree-tos --keep-until-expiring \
      -d "$d"
    rm -f "/etc/nginx/conf.d/spark-acme-${d}.conf"
  done
}

rewrite_http_443() {
  local f
  for f in /etc/nginx/conf.d/*.conf; do
    case "$(basename "$f")" in
      sparkapi.conf|sparkr.conf|sparkmessenger.conf|spark-acme.conf|00-spark-http.conf) continue ;;
      spark-acme-*|sparkmessenger-acme.conf) continue ;;
    esac
    if grep -qE 'listen[[:space:]]+127\.0\.0\.1:8443' "$f"; then
      continue
    fi
    if grep -qE 'listen[[:space:]]+443[[:space:]]+ssl' "$f"; then
      sed -i \
        -e 's/listen 443 ssl;/listen 127.0.0.1:8443 ssl proxy_protocol;/' \
        -e 's/listen \[::\]:443 ssl;/listen [::1]:8443 ssl proxy_protocol;/' \
        "$f"
    fi
  done
}

install_sni() {
  rewrite_http_443
  rm -f /etc/nginx/conf.d/spark-acme.conf
  rm -f /etc/nginx/conf.d/spark-acme-*.conf
  rm -f /etc/nginx/conf.d/sparkmessenger-acme.conf
  cp "$HOST_DIR/00-spark-http.conf" /etc/nginx/conf.d/00-spark-http.conf
  cp "$HOST_DIR/sparkapi.conf" /etc/nginx/conf.d/sparkapi.conf
  cp "$HOST_DIR/sparkr.conf" /etc/nginx/conf.d/sparkr.conf
  if [[ -f "$HOST_DIR/sparkmessenger.conf" ]] && cert_ok sparkmessenger.wyrs365.com; then
    cp "$HOST_DIR/sparkmessenger.conf" /etc/nginx/conf.d/sparkmessenger.conf
  fi
  cp "$HOST_DIR/spark-sni.conf" /etc/nginx/stream.d/spark-sni.conf
  mkdir -p /etc/letsencrypt/renewal-hooks/deploy
  cat > /etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh <<'HOOK'
#!/bin/sh
systemctl reload nginx
HOOK
  chmod +x /etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh
  if grep -RInE 'listen[[:space:]]+(\[::\]:)?443[[:space:]]+ssl' /etc/nginx/conf.d; then
    echo "http still binds public 443" >&2
    exit 1
  fi
  nginx -t
  systemctl reload nginx
}

mkdir -p "$BACKUP"
cp -a /etc/nginx "$BACKUP/nginx"
echo "backup $BACKUP"

if ! all_certs_ok; then
  issue_missing_certs
fi

if ! all_certs_ok; then
  echo "certificates missing" >&2
  exit 1
fi

install_sni
echo "nginx sni ready"