#!/usr/bin/env bash
set -euo pipefail

DOMAIN="${MAIL_DOMAIN:-mail.crabs-games.art}"
EMAIL="${ACME_EMAIL:-admin@crabs-games.art}"
REPROXY_CONTAINER="${REPROXY_CONTAINER:-reproxy}"
SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
SSL_DIR="$SCRIPT_DIR/ssl"
COMPOSE_FILE="$SCRIPT_DIR/docker-compose.yml"

command -v docker >/dev/null || { echo "docker is required" >&2; exit 1; }
docker info >/dev/null || { echo "docker access is required" >&2; exit 1; }

mkdir -p "$SSL_DIR"

reproxy_was_running=0
if docker inspect -f '{{.State.Running}}' "$REPROXY_CONTAINER" 2>/dev/null | grep -qx true; then
  reproxy_was_running=1
  docker stop "$REPROXY_CONTAINER" >/dev/null
fi

restart_reproxy() {
  if [ "$reproxy_was_running" -eq 1 ]; then
    docker start "$REPROXY_CONTAINER" >/dev/null
  fi
}
trap restart_reproxy EXIT

docker run --rm \
  -p 80:80 \
  -v "$SSL_DIR:/etc/letsencrypt" \
  certbot/certbot:latest \
  certonly --standalone \
  --keep-until-expiring \
  --non-interactive \
  --agree-tos \
  --email "$EMAIL" \
  -d "$DOMAIN"

docker compose -f "$COMPOSE_FILE" up -d --force-recreate mailserver

echo "TLS certificate for $DOMAIN is installed."
echo "Check it with: openssl s_client -connect $DOMAIN:465 -servername $DOMAIN </dev/null 2>/dev/null | openssl x509 -noout -dates"