#!/bin/bash
set -euo pipefail

CMD="${SSH_ORIGINAL_COMMAND:-${1:-}}"

if [[ "$CMD" =~ ^cert-[a-zA-Z0-9._-]+$ ]]; then
    APP="${CMD#cert-}"

    # Write temporary HTTP-only config so nginx can serve ACME challenges
    cat > "/opt/hantim/docker/nginx/conf.d/$APP.conf" <<NGINXCONF
server {
    listen 80;
    listen [::]:80;
    server_name $APP www.$APP;

    location /.well-known/acme-challenge/ {
        root /var/www/certbot;
    }

    location / {
        return 444;
    }
}
NGINXCONF

    trap 'rm -f "/opt/hantim/docker/nginx/conf.d/$APP.conf"' EXIT
    docker exec nginx nginx -t && docker exec nginx nginx -s reload
    certbot certonly --webroot -w /opt/hantim/docker/nginx/certbot/www \
        --non-interactive --agree-tos --register-unsafely-without-email \
        --cert-name "$APP" -d "$APP" -d "www.$APP"
    rm -f "/opt/hantim/docker/nginx/conf.d/$APP.conf"
    trap - EXIT
    echo "Certificate issued for $APP"
    exit 0
fi

if [ "$CMD" = "provision" ]; then
    cd /opt/hantim
    git pull
    bash scripts/configure.sh
    exit 0
fi

if ! [[ "$CMD" =~ ^deploy-[a-zA-Z0-9._-]+$ ]]; then
    echo "Unknown command: $CMD"
    exit 1
fi

APP="${CMD#deploy-}"
cd /opt/hantim
git pull

# Re-exec so the running script reflects any changes just pulled
if [ -z "${DEPLOY_REEXEC:-}" ]; then
    export DEPLOY_REEXEC=1
    exec /opt/hantim/scripts/deploy.sh
fi

# Generate .env from bws if this service declares .env.keys
if [ -f "docker/$APP/.env.keys" ] && [ -f /etc/bws-token ]; then
    export BWS_ACCESS_TOKEN
    BWS_ACCESS_TOKEN=$(cat /etc/bws-token)
    env_content=""
    while IFS= read -r line || [ -n "$line" ]; do
        [ -z "$line" ] && continue
        [[ "$line" = \#* ]] && continue
        var_name="${line%%=*}"
        secret_id="${line#*=}"
        value=$(bws secret get "$secret_id" | jq -r .value)
        if [ -z "$value" ]; then
            echo "ERROR: Secret '$secret_id' not found in bws."
            echo "  Check that the secret exists and the machine account has access."
            exit 1
        fi
        env_content="${env_content}${var_name}=${value}"$'\n'
    done < "docker/$APP/.env.keys"
    if [ -n "$env_content" ]; then
        echo "Writing .env for $APP"
        printf "%s" "$env_content" > "docker/$APP/.env"
        chmod 600 "docker/$APP/.env"
    fi
fi

cd "docker/$APP"
if grep -q '^\s*build:' compose.yml 2>/dev/null; then
    docker compose build
else
    if ! docker compose pull; then
        echo "Image not yet available for $APP — skipping. It will deploy when the app repo is first pushed."
        exit 0
    fi
fi

if [ "$APP" = "nginx" ]; then
    # Issue certs for any new domains (brief nginx downtime while certbot binds port 80)
    missing_certs=false
    for conf in /opt/hantim/docker/nginx/conf.d/*.*.conf; do
        cert_name=$(basename "$conf" .conf)
        if [ ! -d "/etc/letsencrypt/live/$cert_name" ]; then
            missing_certs=true
            break
        fi
    done
    if [ "$missing_certs" = true ]; then
        docker stop nginx 2>/dev/null || true
        trap 'docker start nginx 2>/dev/null || true' EXIT
        for conf in /opt/hantim/docker/nginx/conf.d/*.*.conf; do
            cert_name=$(basename "$conf" .conf)
            if [ ! -d "/etc/letsencrypt/live/$cert_name" ]; then
                domains=$(grep -oP 'server_name\s+\K[^;]+' "$conf" | tr ' ' '\n' | sort -u)
                domain_args=""
                for d in $domains; do
                    domain_args="$domain_args -d $d"
                done
                echo "Issuing cert for $cert_name..."
                certbot certonly --standalone --non-interactive --agree-tos \
                    --register-unsafely-without-email --cert-name "$cert_name" $domain_args
            fi
        done
        trap - EXIT
    fi
    # Test config before applying — a bad config would take down all sites
    docker compose run --rm -T nginx nginx -t
fi

docker compose up -d --remove-orphans

if [ "$APP" = "nginx" ]; then
    docker exec nginx nginx -s reload
fi