#!/usr/bin/env bash
set -euo pipefail

# === 由 CertCenter 生成 ===
DOMAIN="{{ domain }}"
BASE_URL="{{ base_url }}"
TOKEN="{{ token }}"
CERT_DIR="{{ cert_dir }}"
CHECK_CMD="{{ check_cmd }}"
RELOAD_CMD="{{ reload_cmd }}"
CONFIG_ID="{{ acme_config_id }}"
# ===========================

CONFIG_PARAM=""
[[ -n "${CONFIG_ID}" ]] && CONFIG_PARAM="&acme_config_id=${CONFIG_ID}"

VERSION_URL="${BASE_URL}/api/version?domain=${DOMAIN}${CONFIG_PARAM}"
FULLCHAIN_URL="${BASE_URL}/api/cert/fullchain?domain=${DOMAIN}${CONFIG_PARAM}"
PRIVATE_URL="${BASE_URL}/api/cert/private?domain=${DOMAIN}${CONFIG_PARAM}"
TMP_DIR="/tmp/cert-sync-${DOMAIN//\*/_}"
VERSION_FILE="${CERT_DIR}/.version"

mkdir -p "${CERT_DIR}" "${TMP_DIR}"
auth=(-H "Authorization: Bearer ${TOKEN}")
# -k 跳过 TLS 证书验证（CertCenter 初期可能使用自签证书）
curl_opts=(-fsSL -k --connect-timeout 5 --max-time 30)

# 1. 检查版本
REMOTE=$(curl "${curl_opts[@]}" --max-time 15 "${auth[@]}" "${VERSION_URL}")
LOCAL=$(cat "${VERSION_FILE}" 2>/dev/null || echo "0")
if [[ "${REMOTE}" == "${LOCAL}" ]]; then
    exit 0
fi

# 2. 下载证书
curl "${curl_opts[@]}" "${auth[@]}" "${FULLCHAIN_URL}" -o "${TMP_DIR}/fullchain.pem"
curl "${curl_opts[@]}" "${auth[@]}" "${PRIVATE_URL}"  -o "${TMP_DIR}/private.key"
chmod 600 "${TMP_DIR}/private.key"

# 3. 备份旧证书
cp -f "${CERT_DIR}/fullchain.pem" "${CERT_DIR}/fullchain.pem.bak" 2>/dev/null || true
cp -f "${CERT_DIR}/private.key"  "${CERT_DIR}/private.key.bak"  2>/dev/null || true

# 4. 原子替换
mv -f "${TMP_DIR}/fullchain.pem" "${CERT_DIR}/fullchain.pem"
mv -f "${TMP_DIR}/private.key"  "${CERT_DIR}/private.key"

# 5. 校验 & 重载 & 上报
HOSTNAME=$(hostname)
if ${CHECK_CMD}; then
    echo "${REMOTE}" > "${VERSION_FILE}"
    ${RELOAD_CMD}
    echo "[$(date -Is)] updated: ${DOMAIN} -> ${REMOTE}"
    curl "${curl_opts[@]}" "${auth[@]}" -X POST "${BASE_URL}/api/report?domain=${DOMAIN}&status=success&hostname=${HOSTNAME}&message=deployed+v${REMOTE}${CONFIG_PARAM}" 2>/dev/null || true
else
    mv -f "${CERT_DIR}/fullchain.pem.bak" "${CERT_DIR}/fullchain.pem" 2>/dev/null || true
    mv -f "${CERT_DIR}/private.key.bak"  "${CERT_DIR}/private.key"  2>/dev/null || true
    echo "[$(date -Is)] FAILED: ${DOMAIN}, rolled back" >&2
    curl "${curl_opts[@]}" "${auth[@]}" -X POST "${BASE_URL}/api/report?domain=${DOMAIN}&status=failed&hostname=${HOSTNAME}&message=check+failed+rolled+back${CONFIG_PARAM}" 2>/dev/null || true
    exit 1
fi