#!/usr/bin/env bash
# 续部署：m.runxian.top 统一入口 + SSL 扩展 + nginx 切换
set -euo pipefail

APP_ROOT="${APP_ROOT:-/opt/dukang-haoke}"
CERT_NAME="${CERT_CERT_NAME:-user.runxian.top}"
CERT_DIR="/etc/letsencrypt/live/${CERT_NAME}"

cd "$APP_ROOT"

echo "==> 1. PM2 重启（H5 dist 已含 /user|shop|partner/ 路径）"
pm2 restart dukang-api dukang-h5-user dukang-h5-shop dukang-h5-partner dukang-admin-web
pm2 save

echo "==> 2. 临时 ACME：m.runxian.top:80"
cat > /etc/nginx/conf.d/dukang-m-acme-temp.conf <<'EOF'
server {
    listen 80;
    server_name m.runxian.top;
    location ^~ /.well-known/acme-challenge/ {
        root /var/www/certbot;
        default_type "text/plain";
    }
    location / { return 404; }
}
EOF
nginx -t
systemctl reload nginx

echo "==> 3. 扩展证书 SAN：加入 m.runxian.top"
certbot certonly --webroot -w /var/www/certbot \
  --expand --cert-name "$CERT_NAME" \
  -d user.runxian.top \
  -d shop.runxian.top \
  -d partner.runxian.top \
  -d webadmin.runxian.top \
  -d dkapi.runxian.top \
  -d m.runxian.top \
  --non-interactive --agree-tos -m admin@runxian.top

echo "==> 4. 安装 nginx HTTPS 配置"
install -m 644 "$APP_ROOT/deploy/nginx-runxian-dukang-ssl.conf" /etc/nginx/conf.d/dukang-runxian.conf
sed -i "s|/etc/letsencrypt/live/m.runxian.top/|${CERT_DIR}/|g" /etc/nginx/conf.d/dukang-runxian.conf

if ! grep -q nginx-deploy-webhook /etc/nginx/conf.d/dukang-runxian.conf; then
  sed -i '/server_name dkapi.runxian.top;/a\    include /opt/dukang-haoke/deploy/nginx-deploy-webhook.conf;' \
    /etc/nginx/conf.d/dukang-runxian.conf
fi

rm -f /etc/nginx/conf.d/dukang-m-acme-temp.conf
nginx -t
systemctl reload nginx

echo "==> 5. 更新 USER_H5_URL"
ENV_FILE="$APP_ROOT/server/dukang-api/.env"
if grep -q '^USER_H5_URL=' "$ENV_FILE"; then
  sed -i 's|^USER_H5_URL=.*|USER_H5_URL=https://m.runxian.top/user|' "$ENV_FILE"
else
  echo 'USER_H5_URL=https://m.runxian.top/user' >> "$ENV_FILE"
fi
pm2 restart dukang-api

echo "==> 6. 验证"
for url in \
  "https://m.runxian.top/user/" \
  "https://m.runxian.top/shop/" \
  "https://m.runxian.top/partner/" \
  "https://user.runxian.top/" \
  "https://dkapi.runxian.top/api/v1/health"; do
  code="$(curl -sk -o /dev/null -w '%{http_code}' "$url" || echo fail)"
  echo "  $url -> $code"
done

echo "==> m.runxian.top 部署完成"