#!/bin/bash
# SSL证书申请脚本 - stock.allbyai.cn
# 使用 acme.sh + DNS 验证方式申请免费SSL证书
# 适用于 DNSPod 有 Web 防护导致 HTTP 验证失败的情况
# 在服务器上执行此脚本

set -e

DOMAIN="stock.allbyai.cn"
SSL_DIR="/etc/nginx/ssl"
ACME_HOME="/home/ubuntu/.acme.sh"

echo "=========================================="
echo "为 ${DOMAIN} 完成SSL证书安装"
echo "=========================================="

# 检查 acme.sh 是否已安装
if [ ! -f "${ACME_HOME}/acme.sh" ]; then
    echo "错误: acme.sh 未安装，请先运行初始化"
    exit 1
fi

# 检查 DNS TXT 记录
echo "[1/4] 检查 DNS TXT 记录..."
TXT_RECORD=$(dig +short TXT _acme-challenge.stock.allbyai.cn 2>/dev/null || echo "")
if [ -z "$TXT_RECORD" ]; then
    echo ""
    echo "错误: DNS TXT 记录未找到！"
    echo ""
    echo "请在 DNSPod 添加以下 TXT 记录:"
    echo "  主机记录: _acme-challenge.stock"
    echo "  记录值: cM9lSA4-uKk-yjrvA38HYtmA1h7E3DzgIXVJq8IsSNo"
    echo ""
    echo "添加后等待 1-2 分钟，然后重新运行此脚本"
    exit 1
fi
echo "DNS TXT 记录已找到: $TXT_RECORD"

# 创建 SSL 目录
echo "[2/4] 创建 SSL 目录..."
mkdir -p ${SSL_DIR}

# 完成证书申请
echo "[3/4] 完成证书申请..."
${ACME_HOME}/acme.sh --renew -d ${DOMAIN} --yes-I-know-dns-manual-mode-enough-go-ahead-please

# 安装证书
echo "[4/4] 安装证书到 Nginx..."
${ACME_HOME}/acme.sh --install-cert -d ${DOMAIN} \
    --key-file ${SSL_DIR}/${DOMAIN}.key \
    --fullchain-file ${SSL_DIR}/${DOMAIN}.crt \
    --reloadcmd "systemctl reload nginx"

# 更新 Nginx 配置
echo "[5/5] 更新 Nginx 配置..."
cat > /etc/nginx/sites-available/${DOMAIN} << 'NGINX_CONF'
# Nginx配置 - stock.allbyai.cn (HTTPS)
server {
    listen 80;
    server_name stock.allbyai.cn;
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl http2;
    server_name stock.allbyai.cn;

    ssl_certificate /etc/nginx/ssl/stock.allbyai.cn.crt;
    ssl_certificate_key /etc/nginx/ssl/stock.allbyai.cn.key;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers off;

    access_log /var/log/nginx/stock.allbyai.cn.access.log;
    error_log /var/log/nginx/stock.allbyai.cn.error.log;

    location / {
        proxy_pass http://127.0.0.1:3333;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_cache_bypass $http_upgrade;
        proxy_read_timeout 300s;
        proxy_connect_timeout 75s;
    }

    location /static/ {
        alias /opt/stock-app/static/;
        expires 7d;
        add_header Cache-Control "public, immutable";
    }
}
NGINX_CONF

# 重载 Nginx
nginx -t && systemctl reload nginx

echo ""
echo "=========================================="
echo "SSL证书安装完成！"
echo ""
echo "访问地址: https://${DOMAIN}"
echo ""
echo "证书信息:"
echo "  - 证书路径: ${SSL_DIR}/${DOMAIN}.crt"
echo "  - 密钥路径: ${SSL_DIR}/${DOMAIN}.key"
echo "  - 有效期: 90天"
echo "  - 自动续期: 已配置 (acme.sh cron)"
echo ""
echo "手动续期命令: ${ACME_HOME}/acme.sh --renew -d ${DOMAIN} --force"
echo "=========================================="