#!/usr/bin/env bash
# ssl/revoke -- remove a certificate and fall back to plain HTTP
set -o pipefail
SELF=$(readlink -f "${BASH_SOURCE[0]}")
NV_BASE=$(cd "$(dirname "$SELF")/../../.." && pwd)
export NV_BASE
# shellcheck source=/dev/null
. "$NV_BASE/lib/core/bootstrap.sh"

nv_require_root || exit 1
ui_header "$(t ssl_m_revoke)"

mapfile -t certs < <(find /etc/letsencrypt/live -mindepth 1 -maxdepth 1 -type d -printf '%f\n' 2>/dev/null | sort)
if [ ${#certs[@]} -eq 0 ]; then ui_info "$(t ssl_none_issued)"; exit 0; fi

ui_info "$(printf '%s ' "${certs[@]}")"
ui_blank
printf '  %s: ' "$(t site_prompt_domain)"
read -r domain || exit 130
domain=$(nv_lower "$(nv_trim "$domain")")

found=0
for c in "${certs[@]}"; do [ "$c" = "$domain" ] && found=1; done
[ "$found" = "1" ] || { ui_err "$(t ssl_revoke_missing "$domain")"; exit 2; }

ui_warn "$(t ssl_revoke_warn "$domain")"
ui_confirm_typed "$(t site_remove_confirm)" "$domain" || { ui_info "$(t pf_cancelled)"; exit 3; }

ui_step "$(t ssl_revoke_running)"
if certbot revoke --cert-name "$domain" --non-interactive >>/var/log/nhanhvps/certbot-revoke.log 2>&1 \
   || certbot delete --cert-name "$domain" --non-interactive >>/var/log/nhanhvps/certbot-revoke.log 2>&1; then
    ui_ok "$(t ssl_revoke_ok)"
else
    ui_warn "$(t ssl_revoke_partial)"
fi

if nv_site_exists "$domain"; then
    nv_site_set "$domain" ssl none
    nv_site_set "$domain" force_https 0
    site_apply_vhost "$domain" >/dev/null 2>&1 || true
fi
svc_reload nginx
nv_trace ssl-revoke "$domain"
ui_blank
ui_info "$(t ssl_revoke_note)"
exit 0
