#!/usr/bin/env bash
set -euo pipefail

DOMAIN="${1:-91tvikun.icu}"
WWW_DOMAIN="${2:-www.${DOMAIN}}"
WEBROOT="/var/www/campus-express-site"
CONF_FILE="/etc/nginx/conf.d/campus-express-miniapp.conf"
CERT_DIR="/etc/nginx/ssl/${DOMAIN}"

install_pkg() {
  if command -v dnf >/dev/null 2>&1; then
    dnf install -y --disablerepo=docker-ce-stable "$@" || dnf install -y "$@"
  else
    yum install -y --disablerepo=docker-ce-stable "$@" || yum install -y "$@"
  fi
}

install_pkg curl socat openssl

mkdir -p "${WEBROOT}/.well-known/acme-challenge" "${CERT_DIR}"

if [ ! -x "${HOME}/.acme.sh/acme.sh" ]; then
  curl https://get.acme.sh | sh -s email="admin@${DOMAIN}"
fi

"${HOME}/.acme.sh/acme.sh" --set-default-ca --server letsencrypt
"${HOME}/.acme.sh/acme.sh" --issue -d "${DOMAIN}" -d "${WWW_DOMAIN}" -w "${WEBROOT}" --keylength 2048 --force
"${HOME}/.acme.sh/acme.sh" --install-cert -d "${DOMAIN}" \
  --key-file "${CERT_DIR}/privkey.pem" \
  --fullchain-file "${CERT_DIR}/fullchain.pem" \
  --reloadcmd "systemctl reload nginx"

bash "$(dirname "$0")/write-https-nginx.sh" "${DOMAIN}" "${WWW_DOMAIN}"

if command -v firewall-cmd >/dev/null 2>&1 && systemctl is-active --quiet firewalld; then
  firewall-cmd --permanent --add-service=https
  firewall-cmd --reload
fi

nginx -t
systemctl reload nginx