$ErrorActionPreference = "Stop"

function Log($msg) { Write-Host "[$(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')] $msg" }

# === 由 CertCenter 生成 ===
$Domain    = "{{ domain }}"
$BaseUrl   = "{{ base_url }}"
$Token     = "{{ token }}"
$CertDir   = "{{ cert_dir }}"
$CheckCmd  = "{{ check_cmd }}"
$ReloadCmd = "{{ reload_cmd }}"
$ConfigId  = "{{ acme_config_id }}"
# ===========================

$EncodedDomain = [System.Uri]::EscapeDataString($Domain)
$ConfigParam = if ($ConfigId) { "&acme_config_id=$ConfigId" } else { "" }
$TmpDir      = "$env:TEMP\cert-sync-$($Domain -replace '[*\.]','_')"
$VersionFile = "$CertDir\.version"

New-Item -ItemType Directory -Force -Path $CertDir, $TmpDir | Out-Null
$headers = @{ Authorization = "Bearer $Token" }

# 跳过 TLS 证书验证（CertCenter 初期可能使用自签证书）
[System.Net.ServicePointManager]::ServerCertificateValidationCallback = { $true }

Log "开始同步证书: $Domain"
Log "配置目录: $CertDir, 配置ID: $(if ($ConfigId) { $ConfigId } else { '无' })"

# 1. 检查版本
Log "检查远程版本..."
try {
    $remote = (Invoke-WebRequest -Uri "$BaseUrl/api/version?domain=$EncodedDomain$ConfigParam" -Headers $headers -UseBasicParsing -SkipCertificateCheck).Content.Trim()
} catch {
    Log "错误: 无法获取远程版本 - $_"
    exit 1
}
$local = if (Test-Path $VersionFile) { (Get-Content $VersionFile).Trim() } else { "0" }
Log "远程版本: $remote, 本地版本: $local"
if ($remote -eq $local) {
    Log "版本一致，跳过更新"
    exit 0
}

# 2. 下载证书
Log "版本不一致，开始下载证书..."
try {
    Invoke-WebRequest -Uri "$BaseUrl/api/cert/fullchain?domain=$EncodedDomain$ConfigParam" -Headers $headers -OutFile "$TmpDir\fullchain.pem" -UseBasicParsing -SkipCertificateCheck
    Invoke-WebRequest -Uri "$BaseUrl/api/cert/private?domain=$EncodedDomain$ConfigParam"   -Headers $headers -OutFile "$TmpDir\private.key"   -UseBasicParsing -SkipCertificateCheck
} catch {
    Log "错误: 下载证书失败 - $_"
    exit 1
}
Log "证书下载完成"

# 3. 备份旧证书
Copy-Item "$CertDir\fullchain.pem" "$CertDir\fullchain.pem.bak" -ErrorAction SilentlyContinue
Copy-Item "$CertDir\private.key"   "$CertDir\private.key.bak"   -ErrorAction SilentlyContinue
Log "旧证书已备份"

# 4. 原子替换
Move-Item "$TmpDir\fullchain.pem" "$CertDir\fullchain.pem" -Force
Move-Item "$TmpDir\private.key"   "$CertDir\private.key"   -Force
Log "证书文件已替换"

# 5. 校验 & 重载 & 上报
$HostName = $env:COMPUTERNAME
try {
    Log "执行校验命令: $CheckCmd"
    Invoke-Expression $CheckCmd
    Log "校验通过，执行重载: $ReloadCmd"
    $remote | Out-File -NoNewline -Encoding ascii $VersionFile
    Invoke-Expression $ReloadCmd
    Log "更新成功: $Domain -> v$remote"
    try { Invoke-WebRequest -Uri "$BaseUrl/api/report?domain=$EncodedDomain&status=success&hostname=$HostName&message=deployed+v$remote$ConfigParam" -Headers $headers -Method POST -UseBasicParsing -SkipCertificateCheck | Out-Null } catch {}
} catch {
    Log "错误: 校验失败，回滚证书 - $_"
    Move-Item "$CertDir\fullchain.pem.bak" "$CertDir\fullchain.pem" -Force -ErrorAction SilentlyContinue
    Move-Item "$CertDir\private.key.bak"   "$CertDir\private.key"   -Force -ErrorAction SilentlyContinue
    Log "已回滚到旧证书"
    try { Invoke-WebRequest -Uri "$BaseUrl/api/report?domain=$EncodedDomain&status=failed&hostname=$HostName&message=check+failed+rolled+back$ConfigParam" -Headers $headers -Method POST -UseBasicParsing -SkipCertificateCheck | Out-Null } catch {}
    exit 1
}