#!/usr/bin/env bash
# Install Spark SNI vhosts into the shared host nginx (do not replace nginx.conf).
set -euo pipefail

ROOT="$(cd "$(dirname "$0")" && pwd)"
HOST_DIR="$ROOT/host"
BACKUP="/root/nginx-backup-$(date +%Y%m%d%H%M%S)"

need_certs() {
  [[ -f /etc/letsencrypt/live/sparkapi.wyrs365.com/fullchain.pem ]] \
    && [[ -f /etc/letsencrypt/live/sparkim.wyrs365.com/fullchain.pem ]]
}

install_acme() {
  mkdir -p /var/www/certbot
  cp "$HOST_DIR/spark-acme.conf" /etc/nginx/conf.d/spark-acme.conf
  nginx -t
  systemctl reload nginx
}

issue_certs() {
  certbot certonly --webroot -w /var/www/certbot \
    --non-interactive --agree-tos --keep-until-expiring \
    -d sparkapi.wyrs365.com
  certbot certonly --webroot -w /var/www/certbot \
    --non-interactive --agree-tos --keep-until-expiring \
    -d sparkim.wyrs365.com
}

rewrite_http_443() {
  local f
  for f in /etc/nginx/conf.d/*.conf; do
    case "$(basename "$f")" in
      sparkapi.conf|spark-acme.conf) continue ;;
    esac
    if grep -qE 'listen[[:space:]]+127\.0\.0\.1:8443' "$f"; then
      continue
    fi
    if grep -qE 'listen[[:space:]]+443[[:space:]]+ssl' "$f"; then
      sed -i \
        -e 's/listen 443 ssl;/listen 127.0.0.1:8443 ssl proxy_protocol;/' \
        -e 's/listen \[::\]:443 ssl;/listen [::1]:8443 ssl proxy_protocol;/' \
        "$f"
    fi
  done
}

install_sni() {
  rewrite_http_443
  rm -f /etc/nginx/conf.d/spark-acme.conf
  cp "$HOST_DIR/00-spark-http.conf" /etc/nginx/conf.d/00-spark-http.conf
  cp "$HOST_DIR/sparkapi.conf" /etc/nginx/conf.d/sparkapi.conf
  cp "$HOST_DIR/spark-sni.conf" /etc/nginx/stream.d/spark-sni.conf
  mkdir -p /etc/letsencrypt/renewal-hooks/deploy
  cat > /etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh <<'HOOK'
#!/bin/sh
systemctl reload nginx
HOOK
  chmod +x /etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh
  if grep -RInE 'listen[[:space:]]+(\[::\]:)?443[[:space:]]+ssl' /etc/nginx/conf.d; then
    echo "http still binds public 443" >&2
    exit 1
  fi
  nginx -t
  systemctl reload nginx
}

mkdir -p "$BACKUP"
cp -a /etc/nginx "$BACKUP/nginx"
echo "backup $BACKUP"

if ! need_certs; then
  install_acme
  issue_certs
fi

if ! need_certs; then
  echo "certificates missing" >&2
  exit 1
fi

install_sni
echo "nginx sni ready"