#!/bin/bash
# Issue SSL certificates via certbot webroot through the nginx container.
#
# This script ONLY issues certs. It does not touch the real nginx confs.
# Nginx must be running (even with minimal config) to serve ACME challenges.
#
# Provisioning order:
#   1. Start nginx with no app confs (just security-headers.inc)
#   2. Run this script to issue certs
#   3. Start all app containers (so upstreams are resolvable)
#   4. Copy app confs into conf.d and reload nginx
#
# For adding a cert to a running server, apps are already up — just run
# this script, add the conf, and reload nginx.
#
# Usage: ./issue-cert.sh <domain> [domain...]
# Example: ./issue-cert.sh nextcloud.timothykim.net git.timothykim.net
set -euo pipefail

CONF_DIR="/opt/argento/docker/nginx/conf.d"
WEBROOT="/opt/argento/docker/nginx/certbot/www"

if [ $# -eq 0 ]; then
    echo "Usage: $0 <domain> [domain...]"
    exit 1
fi

mkdir -p "$WEBROOT"

for domain in "$@"; do
    echo "=== Issuing cert for $domain ==="

    # Write temporary HTTP-only config
    cat > "$CONF_DIR/$domain.tmp.conf" <<NGINXCONF
server {
    listen 80;
    listen [::]:80;
    server_name $domain;
    location /.well-known/acme-challenge/ { root /var/www/certbot; }
    location / { return 444; }
}
NGINXCONF

    trap 'rm -f "$CONF_DIR/$domain.tmp.conf"' EXIT
    docker exec nginx nginx -t
    docker exec nginx nginx -s reload

    certbot certonly --webroot -w "$WEBROOT" \
        --non-interactive --agree-tos -m timothykim@fastmail.fm \
        --cert-name "$domain" -d "$domain"

    rm -f "$CONF_DIR/$domain.tmp.conf"
    trap - EXIT

    echo "Certificate issued for $domain"
done

echo "=== Done ==="