#!/usr/bin/env bash
# ssl/issue -- obtain a Let's Encrypt certificate for a registered site
set -o pipefail
SELF=$(readlink -f "${BASH_SOURCE[0]}")
NV_BASE=$(cd "$(dirname "$SELF")/../../.." && pwd)
export NV_BASE
# shellcheck source=/dev/null
. "$NV_BASE/lib/core/bootstrap.sh"

nv_require_root || exit 1
ui_header "$(t mod_ssl_issue)"

if ! nv_have certbot; then
    ui_step "$(t ssl_installing_certbot)"
    pkg_install certbot || { nv_fail 5101 "$(t ssl_certbot_failed)"; exit 1; }
fi

if [ $# -ge 1 ]; then domain=$1; else
    ui_info "$(nv_site_list | paste -sd' ' -)"
    printf '  %s: ' "$(t site_prompt_domain)"
    read -r domain || exit 130
fi
domain=$(nv_lower "$(nv_trim "$domain")")

nv_site_exists "$domain" || { ui_err "$(t site_not_registered)"; exit 2; }

email=$(nv_site_get "$domain" ssl_email "")
if [ -z "$email" ]; then
    printf '  %s: ' "$(t site_prompt_email)"
    read -r email || exit 130
    email=$(nv_trim "$email")
fi

if [ -n "$email" ] && ! nv_valid_email "$email"; then
    ui_err "$(t ssl_bad_email)"
    exit 2
fi

args=(certonly --webroot -w "$(nv_site_get "$domain" root_path "/home/$domain/public_html")" \
      -d "$domain" -d "www.$domain" --non-interactive --agree-tos --keep-until-expiring)
if [ -n "$email" ]; then args+=(-m "$email"); else args+=(--register-unsafely-without-email); fi

ui_step "$(t ssl_requesting "$domain")"
if certbot "${args[@]}" >/tmp/nhanhvps-certbot.log 2>&1; then
    nv_site_set "$domain" ssl letsencrypt
    [ -n "$email" ] && nv_site_set "$domain" ssl_email "$email"
    nv_trace ssl-issue "$domain"
    # regenerate from the registry so the TLS block is ours, not certbot's edit
    site_apply_vhost "$domain" || ui_warn "$(t ssl_vhost_regen_failed)"
    ui_ok "$(t ssl_issued "$domain")"
    svc_reload nginx
else
    ui_err "$(t ssl_failed)"
    tail -n 15 /tmp/nhanhvps-certbot.log | sed 's/^/    /'
    nv_log error 5102 "certbot failed for $domain"
    exit 1
fi
ui_blank
exit 0
