#!/usr/bin/env bash
set -euo pipefail

DOMAIN="${MAIL_DOMAIN:-mail.crabs-games.art}"
EMAIL="${ACME_EMAIL:-admin@crabs-games.art}"
REPROXY_CONTAINER="${REPROXY_CONTAINER:-reproxy}"
SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
REPROXY_SSL_DIR="${REPROXY_SSL_DIR:-/Users/vladimir/reproxy/var/ssl}"
CERTBOT_DIR="$REPROXY_SSL_DIR/certbot"
CERT_DIR="$REPROXY_SSL_DIR/certificates/acme-v02.api.letsencrypt.org-directory/$DOMAIN"
COMPOSE_FILE="$SCRIPT_DIR/docker-compose.yml"

command -v docker >/dev/null || { echo "docker is required" >&2; exit 1; }
docker info >/dev/null || { echo "docker access is required" >&2; exit 1; }

mkdir -p "$CERTBOT_DIR" "$CERT_DIR"

reproxy_was_running=0
if docker inspect -f '{{.State.Running}}' "$REPROXY_CONTAINER" 2>/dev/null | grep -qx true; then
  reproxy_was_running=1
  docker stop "$REPROXY_CONTAINER" >/dev/null
fi

restart_reproxy() {
  if [ "$reproxy_was_running" -eq 1 ]; then
    docker start "$REPROXY_CONTAINER" >/dev/null
  fi
}
trap restart_reproxy EXIT

docker run --rm \
  -p 80:80 \
  -v "$CERTBOT_DIR:/etc/letsencrypt" \
  certbot/certbot:latest \
  certonly --standalone \
  --keep-until-expiring \
  --non-interactive \
  --agree-tos \
  --email "$EMAIL" \
  --cert-name "$DOMAIN" \
  -d "$DOMAIN"

cp "$CERTBOT_DIR/live/$DOMAIN/fullchain.pem" "$CERT_DIR/$DOMAIN.crt"
cp "$CERTBOT_DIR/live/$DOMAIN/privkey.pem" "$CERT_DIR/$DOMAIN.key"

docker compose -f "$COMPOSE_FILE" up -d --force-recreate mailserver

echo "TLS certificate for $DOMAIN is installed."
echo "Check it with: openssl s_client -connect $DOMAIN:465 -servername $DOMAIN </dev/null 2>/dev/null | openssl x509 -noout -dates"