#!/bin/bash
# Sünkroonib Caddy (edge_caddy) Let's Encrypt serdi mqtt.odamus.com jaoks
# mosquitto jaoks loetavaks. Käivitub cronist (iga päev). Kui sert muutus,
# taaskäivitab mosquitto, et uus sert laaditaks.
#
# NB: LE ahel lõpeb ISRG Root X2-ga, mis on rist-signeeritud ISRG Root X1-ga
# (self-signed X1 ei ole ahelas). Seetõttu lisame CA-hunnikusse ka ISRG Root X1.
set -euo pipefail

SRC=/var/lib/docker/volumes/edge_caddy_data/_data/caddy/certificates/acme-v02.api.letsencrypt.org-directory/mqtt.odamus.com
BASE=/opt/mqtt

mkdir -p "$BASE/certs"

NEW_HASH=$(sha256sum "$SRC/mqtt.odamus.com.crt" | cut -d' ' -f1)
OLD_HASH=$(cat "$BASE/certs/.cert.hash" 2>/dev/null || echo none)

cp "$SRC/mqtt.odamus.com.crt" "$BASE/certs/server.crt"
cp "$SRC/mqtt.odamus.com.key" "$BASE/certs/server.key"

# ISRG Root X1 (self-signed, kehtiv kuni 2035) — vajalik ahela lõpetamiseks.
if [ ! -s "$BASE/certs/isrgrootx1.pem" ]; then
  curl -fsS https://letsencrypt.org/certs/isrgrootx1.pem -o "$BASE/certs/isrgrootx1.pem" || true
fi

python3 - <<'PY'
import re

data = open("/opt/mqtt/certs/server.crt").read()
certs = re.findall(r"-----BEGIN CERTIFICATE-----.*?-----END CERTIFICATE-----", data, re.S)
chain = "\n".join(certs[1:]) + "\n"
try:
    root = open("/opt/mqtt/certs/isrgrootx1.pem").read()
except FileNotFoundError:
    root = ""
open("/opt/mqtt/certs/esp32-ca.pem", "w").write(chain + root)
print(f"ahelas {len(certs)} serti + ISRG Root X1")
PY

echo "$NEW_HASH" > "$BASE/certs/.cert.hash"
chown -R 1883:1883 "$BASE/certs"
chmod 644 "$BASE/certs/server.crt" "$BASE/certs/esp32-ca.pem"
chmod 600 "$BASE/certs/server.key"

if [ "$NEW_HASH" != "$OLD_HASH" ]; then
  docker restart mqtt-mosquitto >/dev/null 2>&1 || true
fi
echo "sert sünkroonitud; hash=$NEW_HASH"