#!/bin/sh
set -eu
bin=${GITPOCKET_BIN:-/usr/local/bin/gitpocket}
root=${GITPOCKET_ROOT:-/srv/gitpocket}
user=${GITPOCKET_USER:-git}
port=${GITPOCKET_PORT:-3200}
conf=${GITPOCKET_NGINX:-/etc/nginx/conf.d/gitpocket-domains.conf}
webroot=/var/www/gitpocket-acme
state=/var/lib/gitpocket-domains
mkdir -p "$webroot" "$state"

domains=$(runuser -u "$user" -- "$bin" -root "$root" domains | grep -E '^[a-z0-9.-]+$' || true)

render() {
    [ -n "$domains" ] || return 0
    printf 'server {\n    listen 80;\n    listen [::]:80;\n    server_name'
    for d in $domains; do printf ' %s' "$d"; done
    printf ';\n    location /.well-known/acme-challenge/ { root %s; }\n    location / { return 301 https://$host$request_uri; }\n}\n' "$webroot"
    for d in $domains; do
        [ -f "/etc/letsencrypt/live/gitpocket-$d/fullchain.pem" ] || continue
        cat <<CONF
server {
    listen 443 ssl;
    listen [::]:443 ssl;
    http2 on;
    server_name $d;
    ssl_certificate /etc/letsencrypt/live/gitpocket-$d/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/gitpocket-$d/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;
    client_max_body_size 1m;
    add_header Strict-Transport-Security "max-age=31536000" always;
    gzip on;
    gzip_proxied any;
    gzip_vary on;
    gzip_types text/css text/plain text/javascript application/javascript image/svg+xml application/json application/xml;
    location / {
        limit_except GET HEAD { deny all; }
        proxy_pass http://127.0.0.1:$port;
        proxy_http_version 1.1;
        proxy_set_header Host \$host;
        proxy_set_header X-Forwarded-Proto https;
        proxy_set_header X-Forwarded-For \$remote_addr;
        proxy_set_header Cookie "";
    }
}
CONF
    done
}

apply() {
    next=$(mktemp)
    render > "$next"
    if [ -f "$conf" ] && cmp -s "$next" "$conf"; then
        rm -f "$next"
        return 0
    fi
    [ -f "$conf" ] && cp "$conf" "$conf.old"
    mv "$next" "$conf"
    chmod 644 "$conf"
    if nginx -t 2>/dev/null; then
        systemctl reload nginx
    else
        echo "nginx rejected $conf, restoring" >&2
        if [ -f "$conf.old" ]; then mv "$conf.old" "$conf"; else rm -f "$conf"; fi
        exit 1
    fi
}

apply
for d in $domains; do
    [ -f "/etc/letsencrypt/live/gitpocket-$d/fullchain.pem" ] && continue
    if [ -f "$state/$d" ] && [ -n "$(find "$state/$d" -mmin -60)" ]; then continue; fi
    if certbot certonly -n --quiet --webroot -w "$webroot" --cert-name "gitpocket-$d" -d "$d"; then
        rm -f "$state/$d"
    else
        touch "$state/$d"
    fi
done
apply