#!/usr/bin/env bash
# exdev.co.kr — HTTP(80) 유지 + HTTPS(443) Let's Encrypt 인증서 발급
#
# 사전: docker compose up -d frontend (80 포트 동작, /.well-known/acme-challenge/ 노출)
# 사용: ./scripts/setup-exdev-https.sh [--email you@example.com] [--domain exdev.co.kr]
#       ./scripts/setup-exdev-https.sh --self-signed   # 로컬/테스트용 자체 서명
set -euo pipefail

ROOT="$(cd "$(dirname "$0")/.." && pwd)"
cd "$ROOT"

DOMAIN="${DOMAIN:-exdev.co.kr}"
EMAIL="${CERTBOT_EMAIL:-}"
SELF_SIGNED=false
SSL_DIR="${SSL_CERT_DIR:-$ROOT/docker/nginx/ssl}"
WEBROOT="${CERTBOT_WEBROOT_DIR:-$ROOT/docker/nginx/certbot-webroot}"
LE_DIR="$ROOT/docker/nginx/letsencrypt"

while [[ $# -gt 0 ]]; do
  case "$1" in
    --email) EMAIL="$2"; shift 2 ;;
    --domain) DOMAIN="$2"; shift 2 ;;
    --self-signed) SELF_SIGNED=true; shift ;;
    -h|--help)
      echo "Usage: $0 [--email E] [--domain D] [--self-signed]"
      exit 0
      ;;
    *) echo "Unknown option: $1" >&2; exit 1 ;;
  esac
done

mkdir -p "$SSL_DIR" "$WEBROOT" "$LE_DIR"
chmod 755 "$SSL_DIR" "$WEBROOT"

link_certs() {
  ln -sf "../letsencrypt/live/$DOMAIN/fullchain.pem" "$SSL_DIR/fullchain.pem"
  ln -sf "../letsencrypt/live/$DOMAIN/privkey.pem" "$SSL_DIR/privkey.pem"
}

if [[ "$SELF_SIGNED" == true ]]; then
  echo "[setup-https] self-signed certificate for $DOMAIN"
  openssl req -x509 -nodes -days 825 -newkey rsa:2048 \
    -keyout "$SSL_DIR/privkey.pem" \
    -out "$SSL_DIR/fullchain.pem" \
    -subj "/CN=$DOMAIN"
else
  if [[ -z "$EMAIL" ]]; then
    echo "[setup-https] ERROR: --email required for Let's Encrypt (or use --self-signed)" >&2
    exit 1
  fi
  echo "[setup-https] certbot webroot — domain=$DOMAIN email=$EMAIL"
  docker run --rm \
    -v "$WEBROOT:/var/www/certbot" \
    -v "$LE_DIR:/etc/letsencrypt" \
    certbot/certbot certonly --webroot -w /var/www/certbot \
    -d "$DOMAIN" --email "$EMAIL" --agree-tos --non-interactive --keep-until-expiring
  link_certs
fi

echo "[setup-https] restarting frontend (443 enable)..."
docker compose up -d --force-recreate frontend

echo ""
echo "Done."
echo "  HTTP:  http://${DOMAIN}/"
echo "  HTTPS: https://${DOMAIN}/"
echo ""
echo "Renew (cron monthly):"
echo "  docker run --rm -v \"$WEBROOT:/var/www/certbot\" -v \"$LE_DIR:/etc/letsencrypt\" \\"
echo "    certbot/certbot renew && docker compose exec frontend nginx -s reload"