$ErrorActionPreference = "Stop"

# === CertCenter 一键部署脚本 ===
# 域名: {{ domain }}
# 服务器: {{ server_name }}
# 生成时间: 由 CertCenter 管理后台生成

$Domain      = "{{ domain }}"
$DeployScript = "C:\cert\deploy-$($Domain -replace '[*\.]','_').ps1"
$DownloadUrl  = "{{ download_url }}"
$AdminToken   = "{{ admin_token }}"
$LogFile      = "C:\cert\cert-deploy.log"

Write-Host "=== CertCenter 证书自动部署安装 ===" -ForegroundColor Cyan
Write-Host "域名: $Domain"
Write-Host ""

# 跳过 TLS 证书验证
[System.Net.ServicePointManager]::ServerCertificateValidationCallback = { $true }

# 1. 下载部署脚本
Write-Host "[1/4] 下载部署脚本..." -ForegroundColor Yellow
New-Item -ItemType Directory -Force -Path "C:\cert" | Out-Null
Invoke-WebRequest -Uri $DownloadUrl -Headers @{Authorization="Bearer $AdminToken"} -OutFile $DeployScript -UseBasicParsing -SkipCertificateCheck
Write-Host "      已保存到: $DeployScript"

# 2. 首次执行
Write-Host "[2/4] 首次执行部署脚本..." -ForegroundColor Yellow
try {
    & powershell -ExecutionPolicy Bypass -File $DeployScript
    Write-Host "      首次部署成功" -ForegroundColor Green
} catch {
    Write-Host "      ⚠ 首次执行异常（可能是证书尚未申请），不影响计划任务设置" -ForegroundColor DarkYellow
}

# 3. 写入计划任务
Write-Host "[3/4] 配置计划任务（每小时执行一次）..." -ForegroundColor Yellow
$TaskName = "CertDeploy-$($Domain -replace '[*\.]','_')"
$Action  = New-ScheduledTaskAction -Execute "powershell.exe" -Argument "-ExecutionPolicy Bypass -File `"$DeployScript`""
$Trigger = New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Hours 1)
Register-ScheduledTask -TaskName $TaskName -Action $Action -Trigger $Trigger -Force | Out-Null
Write-Host "      已创建计划任务: $TaskName"

# 4. 验证
Write-Host "[4/4] 验证计划任务..." -ForegroundColor Yellow
$task = Get-ScheduledTask -TaskName $TaskName -ErrorAction SilentlyContinue
if ($task) {
    Write-Host "      ✓ 计划任务已生效 (状态: $($task.State))" -ForegroundColor Green
} else {
    Write-Host "      ✗ 计划任务设置失败，请手动创建" -ForegroundColor Red
}

Write-Host ""
Write-Host "=== 安装完成 ===" -ForegroundColor Cyan
Write-Host "日志文件: $LogFile"
Write-Host "查看日志: Get-Content $LogFile -Tail 50"
Write-Host "手动执行: powershell -ExecutionPolicy Bypass -File `"$DeployScript`""
Write-Host "查看任务: Get-ScheduledTask -TaskName '$TaskName'"