#!/usr/bin/env bash
set -euo pipefail

# certbot-init.sh — obtain the first Let's Encrypt certificate for the
# «Контракт-чек» edge proxy and reload nginx.
#
# Run this once on the VPS after DNS points the domain at this server and the
# certbot container is started (see DEPLOY.md).
#
# Usage:
#   chmod +x deploy/nginx/certbot-init.sh
#   ./deploy/nginx/certbot-init.sh your-domain.example.com admin@example.com

DOMAIN="${1:-}"
EMAIL="${2:-}"

if [[ -z "$DOMAIN" || -z "$EMAIL" ]]; then
  echo "Usage: $0 <domain> <email>"
  exit 1
fi

# The certbot container in docker-compose mounts these directories.
# It must be running so certbot can write the webroot challenge response.
CERTBOT_WEBROOT=/var/www/certbot
LE_DIR=/etc/letsencrypt

docker compose --profile edge run --rm --entrypoint "certbot certonly \
  --webroot \
  --webroot-path ${CERTBOT_WEBROOT} \
  --agree-tos \
  --no-eff-email \
  --email ${EMAIL} \
  -d ${DOMAIN} \
  --non-interactive" certbot

# Reload nginx so it picks up the new certificate.
docker compose --profile edge exec nginx nginx -s reload

echo "Certificate issued for ${DOMAIN}. Nginx reloaded."