#!/usr/bin/env bash
# runxian.top 裸域名申请 Let's Encrypt 并启用 HTTPS
set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
DOMAIN=runxian.top
EMAIL="${CERTBOT_EMAIL:-admin@runxian.top}"

echo "==> 检查 DNS: $DOMAIN"
ip="$(dig +short "$DOMAIN" A @223.5.5.5 | tail -1)"
if [[ -z "$ip" ]]; then
  echo "ERROR: $DOMAIN 无 A 记录，请先在 DNS 添加指向本机公网 IP（当前服务器: $(curl -sf ifconfig.me || echo unknown)）"
  exit 1
fi
echo "  $DOMAIN -> $ip"

mkdir -p /var/www/certbot /var/log/nginx/dukang

# 若尚未有证书，先部署仅 HTTP 的配置以便 ACME 校验
if [[ ! -f /etc/letsencrypt/live/runxian.top/fullchain.pem ]]; then
  echo "==> 临时 HTTP 配置（用于 ACME）..."
  cat > /etc/nginx/conf.d/dukang-runxian-apex.conf <<'EOF'
server {
    listen 80;
    server_name runxian.top;
    root /opt/dukang-haoke/public;
    index index.html;
    location ^~ /.well-known/acme-challenge/ {
        root /var/www/certbot;
        default_type "text/plain";
    }
    location ~ ^/MP_verify_.*\.txt$ {
        default_type text/plain;
        access_log off;
    }
    location / {
        try_files $uri $uri/ =404;
    }
}
EOF
  nginx -t
  systemctl reload nginx
fi

echo "==> 申请证书..."
certbot certonly --webroot -w /var/www/certbot \
  --cert-name runxian.top \
  -d runxian.top \
  --non-interactive --agree-tos -m "$EMAIL"

echo "==> 切换 HTTPS 配置..."
install -m 644 "$SCRIPT_DIR/nginx-runxian-apex.conf" /etc/nginx/conf.d/dukang-runxian-apex.conf
nginx -t
systemctl reload nginx

echo "==> 验证..."
code="$(curl -sf -o /dev/null -w '%{http_code}' "https://$DOMAIN/MP_verify_ayPJ4CQqbUcec3jX.txt" || echo fail)"
echo "  https://$DOMAIN/MP_verify_ayPJ4CQqbUcec3jX.txt -> $code"
echo "==> runxian.top HTTPS 已启用"