#!/bin/bash
set -euo pipefail

CMD="${SSH_ORIGINAL_COMMAND:-${1:-}}"

if [[ "$CMD" =~ ^cert-[a-zA-Z0-9._-]+$ ]]; then
    APP="${CMD#cert-}"

    # Write temporary HTTP-only config so nginx can serve ACME challenges
    cat > "/opt/hantim/docker/nginx/conf.d/$APP.conf" <<NGINXCONF
server {
    listen 80;
    listen [::]:80;
    server_name $APP www.$APP;

    location /.well-known/acme-challenge/ {
        root /var/www/certbot;
    }

    location / {
        return 444;
    }
}
NGINXCONF

    docker exec nginx nginx -t && docker exec nginx nginx -s reload
    certbot certonly --webroot -w /opt/hantim/docker/nginx/certbot/www \
        --non-interactive --agree-tos --register-unsafely-without-email \
        --cert-name "$APP" -d "$APP" -d "www.$APP"
    rm -f "/opt/hantim/docker/nginx/conf.d/$APP.conf"
    echo "Certificate issued for $APP"
    exit 0
fi

if ! [[ "$CMD" =~ ^deploy-[a-zA-Z0-9._-]+$ ]]; then
    echo "Unknown command: $CMD"
    exit 1
fi

APP="${CMD#deploy-}"
cd /opt/hantim
git pull
cd "docker/$APP"
if ! docker compose pull; then
    echo "Image not yet available for $APP — skipping. It will deploy when the app repo is first pushed."
    exit 0
fi

if [ "$APP" = "nginx" ]; then
    # Test config before applying — a bad config (e.g. missing cert) would take down all sites
    docker compose run --rm -T nginx nginx -t
fi

docker compose down --remove-orphans
docker compose up -d

if [ "$APP" = "nginx" ]; then
    docker exec nginx nginx -s reload
fi