#!/bin/sh
set -eu
cd "$(dirname "$0")/../.."
CONFIG_FILE=${CONFIG_FILE:-.env}
SECRETS_LAUNCHER=${SECRETS_LAUNCHER:-deployment/secrets/han-secrets}

if [ "${HAN_SECRETS_ACTIVE:-0}" != "1" ]; then
  [ -x "$SECRETS_LAUNCHER" ] || {
    echo "Secret launcher is required: $SECRETS_LAUNCHER" >&2
    exit 66
  }
  exec "$SECRETS_LAUNCHER" run --config "$CONFIG_FILE" -- "$0" "$@"
fi

lock=/tmp/han-chat-cert-renew.lock
exec 9>"$lock"
flock -n 9 || { echo '{"event":"tls.renew.skipped","reason":"lock_busy"}'; exit 0; }

compose() {
  docker compose --env-file "$CONFIG_FILE" "$@"
}

nginx_container="$(compose ps --status running --quiet nginx)"
if [ -z "$nginx_container" ]; then
  echo '{"event":"tls.renew.failed","reason":"nginx_not_running"}' >&2
  exit 1
fi

compose --profile certbot run --rm certbot renew \
  --webroot -w /var/www/certbot --quiet
compose exec -T nginx nginx -t -c /tmp/nginx.conf

# Сигнал отправляется PID 1 контейнера. Нельзя использовать `nginx -s reload`:
# он ищет дефолтный /var/run/nginx.pid, тогда как рабочий PID — /tmp/nginx.pid.
compose kill --signal HUP nginx

compose ps --status running --quiet nginx | awk 'NF {found=1} END {exit !found}'
echo "{\"event\":\"tls.renew.completed\",\"timestamp\":\"$(date -u +%FT%TZ)\"}"