#!/usr/bin/env bash
# Issue / renew Let's Encrypt cert for a storefront apex (+ www) via nginx plugin.
set -euo pipefail

HOST="${1:-}"

if [[ -z "$HOST" ]]; then
  echo "usage: ssl.sh <host>" >&2
  exit 1
fi

if [[ ! "$HOST" =~ ^[a-z0-9.-]+$ ]]; then
  echo "invalid host: $HOST" >&2
  exit 1
fi

NGINX_AVAILABLE="/etc/nginx/sites-available/$HOST"
NGINX_ENABLED="/etc/nginx/sites-enabled/$HOST"
LOG_DIR="/var/log/websites"
mkdir -p "$LOG_DIR"
LOG="$LOG_DIR/ssl-$HOST.log"
exec >>"$LOG" 2>&1

echo "==== $(date -u +%Y-%m-%dT%H:%M:%SZ) ssl start: $HOST ===="

if [[ ! -f "$NGINX_AVAILABLE" && ! -f "$NGINX_ENABLED" ]]; then
  echo "missing nginx site for $HOST (run provision first)"
  exit 1
fi

if ! command -v certbot >/dev/null 2>&1; then
  echo "certbot not installed"
  exit 1
fi

certbot --nginx -d "$HOST" -d "www.$HOST" \
  --non-interactive --agree-tos --register-unsafely-without-email --redirect

echo "==== $(date -u +%Y-%m-%dT%H:%M:%SZ) ssl ok: $HOST ===="