#!/usr/bin/env bash
# 为杜康 runxian.top 申请 Let's Encrypt 并切换 HTTPS 配置
# 三端 H5 统一入口 user.runxian.top/{user,shop,partner}/
set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
DOMAINS=(
  user.runxian.top
  shop.runxian.top
  partner.runxian.top
  webadmin.runxian.top
  dkapi.runxian.top
)

echo "==> 检查 DNS 解析到本机..."
for d in "${DOMAINS[@]}"; do
  ip="$(dig +short "$d" @223.5.5.5 | tail -1)"
  if [[ -z "$ip" ]]; then
    echo "ERROR: $d 无 A 记录，请先在 DNS 添加指向本机公网 IP"
    exit 1
  fi
  echo "  $d -> $ip"
done

mkdir -p /var/www/certbot /var/log/nginx/dukang

echo "==> 申请证书..."
certbot certonly --webroot -w /var/www/certbot \
  --cert-name user.runxian.top \
  -d user.runxian.top \
  -d shop.runxian.top \
  -d partner.runxian.top \
  -d webadmin.runxian.top \
  -d dkapi.runxian.top \
  --non-interactive --agree-tos -m admin@runxian.top || {
  echo "certbot 失败，请确认 DNS 已生效且 80 端口可从公网访问"
  exit 1
}

echo "==> 切换 nginx HTTPS 配置..."
install -m 644 "$SCRIPT_DIR/nginx-runxian-dukang-ssl.conf" /etc/nginx/conf.d/dukang-runxian.conf
nginx -t
systemctl reload nginx

echo "==> 验证..."
for url in \
  https://user.runxian.top/user/ \
  https://user.runxian.top/shop/ \
  https://user.runxian.top/partner/ \
  https://shop.runxian.top/ \
  https://webadmin.runxian.top/ \
  https://dkapi.runxian.top/api/v1/health; do
  code="$(curl -sf -o /dev/null -w '%{http_code}' "$url" || echo fail)"
  echo "  $url -> $code"
done

echo "==> runxian.top 杜康域名 HTTPS 已启用（H5 统一入口 user.runxian.top）"