#!/usr/bin/env bash
# 为 api.lingshivip.cn 申请 DNS 证书并启用 HTTPS
set -euo pipefail
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
SSL_DIR="/etc/nginx/ssl/api.lingshivip.cn"
NGINX_CONF="/etc/nginx/conf.d/dukang-lingshivip.conf"

mkdir -p "$SSL_DIR" /var/www/certbot/.well-known/acme-challenge

echo "==> 1. 发起 DNS 验证（需先在 DNSPod 添加 TXT 记录）"
~/.acme.sh/acme.sh --issue -d api.lingshivip.cn --dns \
  --yes-I-know-dns-manual-mode-enough-go-ahead-please \
  --server letsencrypt || true

echo ""
echo "请在 DNSPod 添加上述 TXT 记录后，执行："
echo "  $0 --renew"
echo ""

if [[ "${1:-}" != "--renew" ]]; then
  exit 0
fi

echo "==> 2. 继续 DNS 验证并签发证书"
~/.acme.sh/acme.sh --renew -d api.lingshivip.cn --yes-I-know-dns-manual-mode-enough-go-ahead-please

echo "==> 3. 安装证书到 nginx 目录"
install -m 644 ~/.acme.sh/api.lingshivip.cn_ecc/fullchain.cer "$SSL_DIR/fullchain.cer"
install -m 600 ~/.acme.sh/api.lingshivip.cn_ecc/api.lingshivip.cn.key "$SSL_DIR/api.lingshivip.cn.key"

echo "==> 4. 更新 nginx 并重载"
cp "$SCRIPT_DIR/nginx-lingshivip.conf" "$NGINX_CONF"
python3 - <<'PY'
from pathlib import Path
p = Path("/etc/nginx/conf.d/dukang-lingshivip.conf")
text = p.read_text()
old = """    location / {
        proxy_pass http://127.0.0.1:8090;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Connection "";
    }
}

# API 独立域名 HTTPS"""
new = """    location / {
        return 301 https://$host$request_uri;
    }
}

# API 独立域名 HTTPS"""
if old not in text:
    raise SystemExit("nginx api http redirect patch failed")
p.write_text(text.replace(old, new, 1))
PY

nginx -t
systemctl reload nginx

echo "==> 5. 健康检查"
curl -sf -o /dev/null -w "api-https:%{http_code}\n" https://api.lingshivip.cn/api/v1/health
echo "==> api.lingshivip.cn HTTPS 已启用"