#!/usr/bin/env bash

#####################################################
# Created by Afiniel for Yiimpool use
#
# This script configures NGINX with SSL
# domain of a YiiMP pool installation.
#####################################################

# Load configuration files
source /etc/functions.sh
source /etc/yiimpool.conf
source $STORAGE_ROOT/yiimp/.yiimp.conf
source $HOME/Yiimpoolv1/yiimp_single/.wireguard.install.cnf

set -eu -o pipefail

function print_error {
	read line file <<<$(caller)
	echo "An error occurred in line $line of file $file:" >&2
	sed "${line}q;d" "$file" >&2
}
trap print_error ERR

if [[ ("$wireguard" == "true") ]]; then
	source $STORAGE_ROOT/yiimp/.wireguard.conf
fi

print_header "SSL Certificate Setup"
print_status "Requesting SSL certificate for ${DomainName}..."

# Create directory for Let's Encrypt verification
print_status "Creating ACME challenge directory..."
sudo mkdir -p /var/www/_letsencrypt
sudo chown www-data /var/www/_letsencrypt

# Request SSL certificate
print_status "Obtaining SSL certificate..."
hide_output sudo certbot certonly --webroot -d "${DomainName}" --register-unsafely-without-email -w /var/www/_letsencrypt -n --agree-tos --force-renewal

# Check if certificate was obtained successfully
if sudo [ -f /etc/letsencrypt/live/"$DomainName"/fullchain.pem ]; then
	print_status "Configuring certificate auto-renewal..."
	sudo mkdir -p /etc/letsencrypt/renewal-hooks/post/
	echo '#!/bin/bash\nnginx -t && systemctl reload nginx' | sudo -E tee /etc/letsencrypt/renewal-hooks/post/nginx-reload.sh >/dev/null 2>&1
	sudo chmod a+x /etc/letsencrypt/renewal-hooks/post/nginx-reload.sh

	print_status "Removing previous SSL configuration..."
	sudo rm -f /etc/nginx/sites-available/${DomainName}.conf

	print_status "Installing new SSL configuration..."
	echo '#####################################################
# Source Generated by nginxconfig.io
# Updated by afiniel for crypto use...
#####################################################

# NGINX Simple DDoS Defense
limit_conn_zone $binary_remote_addr zone=conn_limit_per_ip:10m;
limit_conn conn_limit_per_ip 80;
limit_req zone=req_limit_per_ip burst=80 nodelay;
limit_req_zone $binary_remote_addr zone=req_limit_per_ip:40m rate=5r/s;
server {
	listen 443 ssl http2;
	listen [::]:443 ssl http2;
	server_name '"${DomainName}"';
	set $base "/var/www/'"${DomainName}"'/html";
	root $base/web;

	# SSL Configuration
	ssl_certificate /etc/letsencrypt/live/'"${DomainName}"'/fullchain.pem;
	ssl_certificate_key /etc/letsencrypt/live/'"${DomainName}"'/privkey.pem;
	ssl_trusted_certificate /etc/letsencrypt/live/'"${DomainName}"'/chain.pem;
	# security
	include yiimpool/security.conf;
	# logging
	access_log '"${STORAGE_ROOT}"'/yiimp/site/log/'"${DomainName}"'.app.access.log;
	error_log '"${STORAGE_ROOT}"'/yiimp/site/log/'"${DomainName}"'.app.error.log warn;
	# index.php
	index index.php;
	# index.php fallback
	location / {
		try_files $uri $uri/ /index.php?$args;
	}
	location @rewrite {
		rewrite ^/(.*)$ /index.php?r=$1;
	}
	# handle .php
	location ~ \.php$ {
		include yiimpool/php_fastcgi.conf;
	}
	# additional config
	include yiimpool/general.conf;
	include phpmyadmin.conf;
}
# HTTP redirect
server {
	listen 80;
	listen [::]:80;
	server_name .'"${DomainName}"';
	include yiimpool/letsencrypt.conf;
	location / {
		return 301 https://'"${DomainName}"'$request_uri;
	}
}
' | sudo -E tee /etc/nginx/sites-available/${DomainName}.conf >/dev/null 2>&1

	print_status "Restarting services..."
	restart_service nginx >/dev/null 2>&1
	restart_service php8.1-fpm >/dev/null 2>&1

	print_success "SSL configuration completed successfully"
	
	print_header "SSL Configuration Summary"
	print_info "Domain: ${DomainName}"
	print_info "Certificate Location: /etc/letsencrypt/live/${DomainName}"
	print_info "Auto-renewal: Enabled"
	print_info "Configuration: /etc/nginx/sites-available/${DomainName}.conf"
else
	print_error "SSL certificate generation failed"
	print_warning "Please check /var/log/letsencrypt for details"
	print_warning "Sleeping for 5 seconds before continuing..."
	sleep 5
fi

print_divider

# Reset error handling
set +eu +o pipefail

cd $HOME/Yiimpoolv1/yiimp_single