#!/usr/bin/env bash
set -euo pipefail

ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
ENV_FILE="${ROOT_DIR}/.env.prod"

cd "$ROOT_DIR"

if [[ ! -f "$ENV_FILE" ]]; then
    echo "Missing ${ENV_FILE}" >&2
    exit 1
fi

mkdir -p "${ROOT_DIR}/deploy/certbot/www" "${ROOT_DIR}/deploy/certs"

docker run --rm \
    -v "${ROOT_DIR}/deploy/certbot/www:/var/www/certbot" \
    -v "${ROOT_DIR}/deploy/certs:/etc/letsencrypt" \
    certbot/certbot renew \
    --webroot \
    -w /var/www/certbot

docker compose --env-file "$ENV_FILE" -f docker-compose.prod.yml exec nginx nginx -s reload

echo "Certificate renewal complete; nginx reloaded."