#!/usr/bin/env bash
# ssl/renew -- renew certificates and keep the registry in step
set -o pipefail
SELF=$(readlink -f "${BASH_SOURCE[0]}")
NV_BASE=$(cd "$(dirname "$SELF")/../../.." && pwd)
export NV_BASE
# shellcheck source=/dev/null
. "$NV_BASE/lib/core/bootstrap.sh"

nv_require_root || exit 1
ui_header "$(t ssl_m_renew)"

if ! nv_have certbot; then
    ui_err "$(t ssl_certbot_missing)"
    exit 1
fi

target=""
if [ $# -ge 1 ]; then
    target=$1
    nv_site_exists "$target" || { ui_err "$(t site_not_registered)"; exit 2; }
fi

ui_step "$(t ssl_renew_running)"
log=/var/log/nhanhvps/certbot-renew.log
install -d -m 0700 /var/log/nhanhvps
if [ -n "$target" ]; then
    certbot renew --cert-name "$target" --nginx --non-interactive >>"$log" 2>&1
else
    certbot renew --nginx --non-interactive >>"$log" 2>&1
fi
rc=$?

if [ "$rc" -eq 0 ]; then
    ui_ok "$(t ssl_renew_ok)"
    nv_trace ssl-renew "${target:-all}"
    # reflect reality in the registry
    for domain in $(nv_site_list); do
        if [ -r "/etc/letsencrypt/live/$domain/fullchain.pem" ]; then
            nv_site_set "$domain" ssl letsencrypt
        fi
    done
    nginx -t >/dev/null 2>&1 && svc_reload nginx
else
    ui_err "$(t ssl_renew_failed)"
    tail -n 12 "$log" | sed 's/^/    /'
    nv_log error 5103 "certbot renew failed (rc=$rc)"
fi

ui_blank
ui_info "$(t ssl_log_at "$log")"
exit "$rc"
