#!/usr/bin/env bash
# 启用 api.dukanghaoke.com：扩证书 + 装 nginx 配置
set -euo pipefail

DOMAIN_API=api.dukanghaoke.com
CERT_NAME=user.dukanghaoke.com
EMAIL="${CERTBOT_EMAIL:-admin@dukanghaoke.com}"
APP_ROOT="${APP_ROOT:-/opt/dukang}"
NGINX_SRC="$APP_ROOT/deploy/nginx-dukanghaoke.conf"
NGINX_DST="/etc/nginx/sites-available/dukang"

mkdir -p /var/www/certbot/.well-known/acme-challenge
mkdir -p /var/log/nginx/dukang

echo "==> 1. 临时 HTTP 放行 api 域名（便于 http-01）"
# 先写入含 api 的 80 server，若证书尚未含 api，443 块可暂用现有证书
if [[ -f "$NGINX_SRC" ]]; then
  install -m 644 "$NGINX_SRC" "$NGINX_DST"
  ln -sfn "$NGINX_DST" /etc/nginx/sites-enabled/dukang
fi
nginx -t
systemctl reload nginx

echo "==> 2. 扩展证书加入 $DOMAIN_API"
certbot certonly --nginx \
  --cert-name "$CERT_NAME" \
  --expand \
  -d user.dukanghaoke.com \
  -d shop.dukanghaoke.com \
  -d partner.dukanghaoke.com \
  -d admin.dukanghaoke.com \
  -d api.dukanghaoke.com \
  --email "$EMAIL" \
  --agree-tos \
  --non-interactive \
  --keep-until-expiring

echo "==> 3. 重载 nginx"
nginx -t
systemctl reload nginx

echo "==> 4. 健康检查"
sleep 1
curl -sf -o /dev/null -w "api-https:%{http_code} content-type:%{content_type}\n" \
  "https://${DOMAIN_API}/api/v1/health"
curl -sf "https://${DOMAIN_API}/api/v1/health"; echo
echo "==> 完成"