#!/usr/bin/env bash
set -euo pipefail

if [[ ${EUID} -ne 0 ]]; then
  echo "This script must run as root" >&2
  exit 1
fi

DOMAIN=ck.yydd.ai
WEBROOT=/var/www/cangku-bootstrap-acme
TEMP_SITE=/etc/nginx/sites-available/cangku-bootstrap-acme
TLS_ROOT=/etc/cangku-tls
EAB_FILE=${TLS_ROOT}/eab.json
ACME_SERVER=https://acme.zerossl.com/v2/DV90

DEBIAN_FRONTEND=noninteractive apt-get install -y -qq certbot >/dev/null
install -d -m 0755 "${WEBROOT}/.well-known/acme-challenge"
install -d -m 0700 "${TLS_ROOT}"

if [[ ! -f "/etc/letsencrypt/live/${DOMAIN}/fullchain.pem" ]]; then
  if [[ ! -f "${EAB_FILE}" ]]; then
    echo "Missing ${EAB_FILE}; create ZeroSSL EAB credentials and store them there with mode 0600" >&2
    exit 1
  fi
  umask 0022
  {
    printf 'server {\n'
    printf '    listen 80;\n'
    printf '    listen [::]:80;\n'
    printf '    server_name %s;\n' "${DOMAIN}"
    printf '    location /.well-known/acme-challenge/ { root %s; }\n' "${WEBROOT}"
    printf '    location / { return 404; }\n'
    printf '}\n'
  } > "${TEMP_SITE}"
  ln -sfn "${TEMP_SITE}" /etc/nginx/sites-enabled/cangku-bootstrap-acme
  nginx -t
  systemctl reload nginx
  readarray -t eab < <(python3 - "${EAB_FILE}" <<'PY'
import json
import sys

with open(sys.argv[1], encoding='utf-8') as handle:
    value = json.load(handle)
print(value['eab_kid'])
print(value['eab_hmac_key'])
PY
  )
  certbot certonly --server "${ACME_SERVER}" \
    --eab-kid "${eab[0]}" --eab-hmac-key "${eab[1]}" \
    --webroot -w "${WEBROOT}" -d "${DOMAIN}" \
    --email certs@yydd.ai --agree-tos --non-interactive --no-eff-email
  unlink "${EAB_FILE}"
  unlink /etc/nginx/sites-enabled/cangku-bootstrap-acme
  unlink "${TEMP_SITE}"
fi

systemctl enable --now certbot.timer