#!/bin/sh
set -eu

SERVER_IP="${1:?SERVER_IP is required}"
REMOTE_DIR="${2:-/opt/caiwuxitong}"
CERTBOT_DIR="/opt/caiwuxitong-certbot"
CERT_NAME="caiwuxitong-ip"
NGINX_SITE="/etc/nginx/sites-available/caiwuxitong"
WEBROOT="/var/www/letsencrypt"

if [ "$(id -u)" -ne 0 ]; then
    echo "setup-https.sh must run as root" >&2
    exit 1
fi

if [ "$SERVER_IP" != "118.196.84.79" ]; then
    echo "Refusing to configure an unexpected server IP: $SERVER_IP" >&2
    exit 1
fi

test -f "$REMOTE_DIR/host-nginx-http.conf"
test -f "$REMOTE_DIR/host-nginx.conf"
curl -fsS -o /dev/null http://127.0.0.1:18088/

export DEBIAN_FRONTEND=noninteractive
apt-get update
apt-get install -y --no-install-recommends nginx python3-venv ca-certificates

install -d -m 755 "$WEBROOT/.well-known/acme-challenge"
install -m 644 "$REMOTE_DIR/host-nginx-http.conf" "$NGINX_SITE"
ln -sfn "$NGINX_SITE" /etc/nginx/sites-enabled/caiwuxitong
rm -f /etc/nginx/sites-enabled/default
nginx -t
systemctl enable --now nginx
systemctl reload nginx

if [ ! -x "$CERTBOT_DIR/bin/certbot" ]; then
    python3 -m venv "$CERTBOT_DIR"
    "$CERTBOT_DIR/bin/pip" install \
        --disable-pip-version-check \
        --no-cache-dir \
        --timeout 180 \
        --index-url https://pypi.org/simple \
        'certbot==5.4.0'
fi

"$CERTBOT_DIR/bin/certbot" --version

if [ ! -s "/etc/letsencrypt/live/$CERT_NAME/fullchain.pem" ]; then
    "$CERTBOT_DIR/bin/certbot" certonly \
        --non-interactive \
        --agree-tos \
        --register-unsafely-without-email \
        --preferred-profile shortlived \
        --webroot \
        --webroot-path "$WEBROOT" \
        --ip-address "$SERVER_IP" \
        --cert-name "$CERT_NAME"
fi

install -m 644 "$REMOTE_DIR/host-nginx.conf" "$NGINX_SITE"
nginx -t
systemctl reload nginx

cat > /usr/local/sbin/caiwuxitong-certbot-deploy-hook <<'EOF'
#!/bin/sh
set -eu
nginx -t
systemctl reload nginx
EOF
chmod 700 /usr/local/sbin/caiwuxitong-certbot-deploy-hook

cat > /etc/systemd/system/caiwuxitong-certbot-renew.service <<EOF
[Unit]
Description=Renew CaiWuXiTong short-lived IP certificate
After=network-online.target nginx.service

[Service]
Type=oneshot
ExecStart=$CERTBOT_DIR/bin/certbot renew --quiet --deploy-hook /usr/local/sbin/caiwuxitong-certbot-deploy-hook
EOF

cat > /etc/systemd/system/caiwuxitong-certbot-renew.timer <<'EOF'
[Unit]
Description=Check CaiWuXiTong IP certificate renewal every 8 hours

[Timer]
OnCalendar=*-*-* 00,08,16:15:00
RandomizedDelaySec=30m
Persistent=true

[Install]
WantedBy=timers.target
EOF

systemctl daemon-reload
systemctl enable --now caiwuxitong-certbot-renew.timer

curl -fsS -o /dev/null "https://$SERVER_IP/"
openssl x509 -in "/etc/letsencrypt/live/$CERT_NAME/fullchain.pem" -noout -subject -issuer -dates
systemctl list-timers caiwuxitong-certbot-renew.timer --no-pager
echo "HTTPS_READY=https://$SERVER_IP"