#!/usr/bin/env bash
set -euo pipefail

if [[ ${EUID} -ne 0 ]]; then
  echo "This script must run as root" >&2
  exit 1
fi

DOMAIN=ck.yydd.ai
TLS_ROOT=/etc/cangku-tls
CF_CREDENTIALS=${TLS_ROOT}/cloudflare.ini

DEBIAN_FRONTEND=noninteractive apt-get install -y -qq certbot python3-certbot-dns-cloudflare >/dev/null
install -d -m 0700 "${TLS_ROOT}"

if [[ ! -f "/etc/letsencrypt/live/${DOMAIN}/fullchain.pem" ]]; then
  if [[ ! -f "${CF_CREDENTIALS}" ]]; then
    echo "Missing ${CF_CREDENTIALS}; store a scoped Cloudflare API token there with mode 0600" >&2
    exit 1
  fi
  chmod 0600 "${CF_CREDENTIALS}"
  certbot certonly --dns-cloudflare --dns-cloudflare-credentials "${CF_CREDENTIALS}" \
    -d "${DOMAIN}" --email certs@yydd.ai --agree-tos --non-interactive --no-eff-email
fi

systemctl enable --now certbot.timer