#!/usr/bin/env bash
set -euo pipefail

ROOT="/data/aios-gitops"
WORKSPACE="$ROOT/workspace"
LOG="$ROOT/logs/g-cnnetmkt-ingress-fix.log"
BACKUP_DIR="$ROOT/backups/nginx-g-cnnetmkt-$(date +%Y%m%d-%H%M%S)"
SITE="/etc/nginx/sites-available/aios-user-portal.conf"
TRACKED="$WORKSPACE/deploy/nginx/g-cnnetmkt-gitea-server.conf"
REPORT="$ROOT/artifacts/CNNETMKT_SSL_INGRESS_STATUS.md"
mkdir -p "$ROOT/logs" "$BACKUP_DIR" "$WORKSPACE/deploy/nginx" "$ROOT/artifacts"
exec > >(tee -a "$LOG") 2>&1

echo "== backup =="
sudo cp -a "$SITE" "$BACKUP_DIR/aios-user-portal.conf"

cat > "$TRACKED" <<'NGINX'
# AIOS GitOps alias for https://g.cnnetmkt.top/
# Note: this server block intentionally keeps /git/ as the Gitea app prefix,
# matching the current Gitea ROOT_URL and avoiding a disruptive app.ini rewrite.
server {
    listen 443 ssl;
    listen [::]:443 ssl;
    server_name g.cnnetmkt.top;

    access_log /var/log/nginx/aios-g-cnnetmkt.access.log;
    error_log /var/log/nginx/aios-g-cnnetmkt.error.log;

    ssl_certificate /etc/letsencrypt/live/user.cnnetmkt.top/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/user.cnnetmkt.top/privkey.pem;
    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;

    location = / {
        return 302 /git/;
    }

    location = /git {
        return 302 /git/;
    }

    location /git/ {
        proxy_pass http://127.0.0.1:3000/;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-Prefix /git;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
        proxy_redirect off;
    }
}

server {
    listen 80;
    listen [::]:80;
    server_name g.cnnetmkt.top;

    location = / {
        return 302 https://$host/git/;
    }

    location / {
        return 301 https://$host$request_uri;
    }
}
NGINX

echo "== install g.cnnetmkt server block =="
sudo cp "$TRACKED" /etc/nginx/sites-available/g-cnnetmkt-gitea.conf
sudo ln -sfn /etc/nginx/sites-available/g-cnnetmkt-gitea.conf /etc/nginx/sites-enabled/g-cnnetmkt-gitea.conf
sudo nginx -t
sudo systemctl reload nginx

echo "== local validation before cert expand =="
for h in g.cnnetmkt.top cnnetmkt.top user.cnnetmkt.top; do
  echo "-- $h /"
  curl -k -sS -D - -o /tmp/aios-body --resolve "$h:443:127.0.0.1" "https://$h/" | sed -n '1,12p' || true
  grep -ao '<title>[^<]*' /tmp/aios-body 2>/dev/null | head -1 || true
  echo "-- $h /git/"
  curl -k -sS -D - -o /tmp/aios-body --resolve "$h:443:127.0.0.1" "https://$h/git/" | sed -n '1,12p' || true
  grep -ao '<title>[^<]*' /tmp/aios-body 2>/dev/null | head -1 || true
done

echo "== certbot dry run expand for g/user/portal =="
CERTBOT_STATUS="not-run"
if sudo certbot certonly --nginx --cert-name user.cnnetmkt.top \
  -d user.cnnetmkt.top -d portal.cnnetmkt.top -d g.cnnetmkt.top \
  --expand --dry-run --non-interactive --agree-tos; then
  CERTBOT_STATUS="dry-run-ok"
else
  CERTBOT_STATUS="dry-run-failed"
fi

if [ "$CERTBOT_STATUS" = "dry-run-ok" ]; then
  echo "== certbot real expand for g/user/portal =="
  if sudo certbot certonly --nginx --cert-name user.cnnetmkt.top \
    -d user.cnnetmkt.top -d portal.cnnetmkt.top -d g.cnnetmkt.top \
    --expand --non-interactive --agree-tos; then
    CERTBOT_STATUS="issued-g-user-portal"
    sudo nginx -t
    sudo systemctl reload nginx
  else
    CERTBOT_STATUS="real-issue-failed"
  fi
fi

echo "== final cert and route validation =="
{
  echo "# cnnetmkt SSL ingress status"
  echo
  echo "generated_at=$(date -Is)"
  echo "g_route_status=installed"
  echo "certbot_status=$CERTBOT_STATUS"
  echo "apex_dns_status=blocked_until_cnnetmkt.top_has_A_record_to_1.95.164.183"
  echo "wildcard_status=blocked_until_dns01_provider_credentials_available"
  echo "backup_dir=$BACKUP_DIR"
  echo "tracked_nginx=$TRACKED"
  echo
  echo "## validation"
  for h in g.cnnetmkt.top cnnetmkt.top user.cnnetmkt.top; do
    echo "### $h"
    curl -k -sS -D - -o /tmp/aios-body --resolve "$h:443:127.0.0.1" "https://$h/" | sed -n '1,12p' || true
    grep -ao '<title>[^<]*' /tmp/aios-body 2>/dev/null | head -1 || true
    echo
    echo | openssl s_client -connect 127.0.0.1:443 -servername "$h" 2>/dev/null \
      | openssl x509 -noout -subject -issuer -dates -ext subjectAltName 2>/dev/null || true
    echo
  done
  echo "## certbot"
  sudo certbot certificates || true
} | tee "$REPORT"

cd "$WORKSPACE"
git add deploy/nginx/g-cnnetmkt-gitea-server.conf
git commit -m "fix(ingress): add g.cnnetmkt.top GitOps alias" || true

echo "G_CNNETMKT_INGRESS_FIX_DONE certbot_status=$CERTBOT_STATUS report=$REPORT"