#!/usr/bin/env bash
set -euo pipefail

if [[ $# -lt 2 ]]; then
  echo "Usage: $0 <domain> <email>" >&2
  exit 1
fi

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
PROJECT_DIR="$(cd "${SCRIPT_DIR}/.." && pwd)"
DOMAIN="$1"
EMAIL="$2"
LE_LIVE_DIR="${PROJECT_DIR}/letsencrypt/live"
BOOTSTRAP_DIR="${LE_LIVE_DIR}/current"
LE_RENEWAL_DIR="${PROJECT_DIR}/letsencrypt/renewal"
LE_RENEWAL_CONF="${LE_RENEWAL_DIR}/${DOMAIN}.conf"

cd "${PROJECT_DIR}"

mkdir -p "${BOOTSTRAP_DIR}" "${LE_RENEWAL_DIR}"

if [[ ! -f "${BOOTSTRAP_DIR}/fullchain.pem" || ! -f "${BOOTSTRAP_DIR}/privkey.pem" ]]; then
  openssl req -x509 -nodes -newkey rsa:2048 -days 1 \
    -keyout "${BOOTSTRAP_DIR}/privkey.pem" \
    -out "${BOOTSTRAP_DIR}/fullchain.pem" \
    -subj "/CN=${DOMAIN}"
fi

docker compose up -d proxy

docker compose --profile certbot run --rm certbot certonly \
  --webroot \
  --webroot-path /var/www/certbot \
  --domain "${DOMAIN}" \
  --email "${EMAIL}" \
  --agree-tos \
  --no-eff-email

rm -f "${BOOTSTRAP_DIR}/fullchain.pem" "${BOOTSTRAP_DIR}/privkey.pem"
"${PROJECT_DIR}/scripts/update-active-cert-links.sh" "${DOMAIN}"
docker compose exec proxy nginx -s reload