#!/usr/bin/env bash
set -euo pipefail

ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
ENV_FILE="${ROOT_DIR}/.env.prod"
CERTBOT_EMAIL=""

usage() {
    cat <<EOF
Usage: $(basename "$0") --email you@example.com

Obtain or renew Let's Encrypt certificates for CLEARNET_DOMAIN using the webroot
challenge. Nginx must be running and serving /.well-known/acme-challenge/ from
deploy/certbot/www.

Environment is read from .env.prod (CLEARNET_DOMAIN).
EOF
}

while [[ $# -gt 0 ]]; do
    case "$1" in
        --email)
            CERTBOT_EMAIL="$2"
            shift 2
            ;;
        -h | --help)
            usage
            exit 0
            ;;
        *)
            echo "Unknown option: $1" >&2
            usage >&2
            exit 1
            ;;
    esac
done

if [[ ! -f "$ENV_FILE" ]]; then
    echo "Missing ${ENV_FILE}" >&2
    exit 1
fi

# shellcheck disable=SC1090
set -a
source "$ENV_FILE"
set +a

if [[ -z "${CLEARNET_DOMAIN:-}" ]]; then
    echo "CLEARNET_DOMAIN is not set in .env.prod" >&2
    exit 1
fi

if [[ -z "$CERTBOT_EMAIL" ]]; then
    echo "Pass --email for Let's Encrypt registration." >&2
    usage >&2
    exit 1
fi

mkdir -p "${ROOT_DIR}/deploy/certbot/www" "${ROOT_DIR}/deploy/certs"

docker run --rm \
    -v "${ROOT_DIR}/deploy/certbot/www:/var/www/certbot" \
    -v "${ROOT_DIR}/deploy/certs:/etc/letsencrypt" \
    certbot/certbot certonly \
    --webroot \
    -w /var/www/certbot \
    -d "$CLEARNET_DOMAIN" \
    --email "$CERTBOT_EMAIL" \
    --agree-tos \
    --non-interactive

if [[ ! -f "${ROOT_DIR}/deploy/certs/live/${CLEARNET_DOMAIN}/fullchain.pem" ]]; then
    echo "Expected certificates at deploy/certs/live/${CLEARNET_DOMAIN}" >&2
    exit 1
fi

echo "Certificates issued at deploy/certs/live/${CLEARNET_DOMAIN}"
echo "Reload nginx: docker compose --env-file .env.prod -f docker-compose.prod.yml exec nginx nginx -s reload"