#!/usr/bin/env bash
# Parked alias: nginx 301 from parked apex+www to the canonical storefront.
# SSL is issued separately via ssl.sh (certbot --nginx) so the cert is in
# certbot's auto-renewal list.
set -euo pipefail

HOST="${1:-}"
CANONICAL="${2:-}"

if [[ -z "$HOST" || -z "$CANONICAL" ]]; then
  echo "usage: park.sh <parked-host> <canonical-host>" >&2
  exit 1
fi

if [[ ! "$HOST" =~ ^[a-z0-9.-]+$ || ! "$CANONICAL" =~ ^[a-z0-9.-]+$ ]]; then
  echo "invalid host" >&2
  exit 1
fi

NGINX_AVAILABLE="/etc/nginx/sites-available/$HOST"
NGINX_ENABLED="/etc/nginx/sites-enabled/$HOST"
SSL_DIR="/etc/nginx/ssl/$HOST"
LIST_FILE="/opt/websites-agent/parked-hosts.txt"

mkdir -p "$SSL_DIR" /opt/websites-agent /var/www/certbot

if [[ ! -f "$SSL_DIR/fullchain.pem" || ! -f "$SSL_DIR/privkey.pem" ]]; then
  openssl req -x509 -nodes -newkey rsa:2048 -days 825 \
    -keyout "$SSL_DIR/privkey.pem" \
    -out "$SSL_DIR/fullchain.pem" \
    -subj "/CN=$HOST" \
    -addext "subjectAltName=DNS:$HOST,DNS:www.$HOST" \
    >/dev/null 2>&1
  echo "origin self-signed cert created: $SSL_DIR"
fi

# If certbot already issued a live cert, prefer it.
LE_LIVE="/etc/letsencrypt/live/$HOST"
if [[ -f "$LE_LIVE/fullchain.pem" && -f "$LE_LIVE/privkey.pem" ]]; then
  CERT="$LE_LIVE/fullchain.pem"
  KEY="$LE_LIVE/privkey.pem"
else
  CERT="$SSL_DIR/fullchain.pem"
  KEY="$SSL_DIR/privkey.pem"
fi

cat >"$NGINX_AVAILABLE" <<NGINX
server {
    listen 80;
    listen [::]:80;
    server_name ${HOST} www.${HOST};

    location /.well-known/acme-challenge/ {
        root /var/www/certbot;
    }

    location / {
        return 301 https://${CANONICAL}\$request_uri;
    }
}

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    server_name ${HOST} www.${HOST};

    ssl_certificate ${CERT};
    ssl_certificate_key ${KEY};

    return 301 https://${CANONICAL}\$request_uri;
}
NGINX

ln -sfn "$NGINX_AVAILABLE" "$NGINX_ENABLED"
nginx -t
systemctl reload nginx

touch "$LIST_FILE"
if ! grep -qxF "$HOST" "$LIST_FILE" 2>/dev/null; then
  echo "$HOST" >>"$LIST_FILE"
fi

echo "park ok: $HOST → https://$CANONICAL (apex+www)"