#!/bin/sh
set -eu

COMPOSE=/usr/local/sbin/han-vm2-compose
TLS_DIR=/var/lib/han-chat/public-tls
TLS_GROUP=han-nginx-tls

lineage=${RENEWED_LINEAGE:?Certbot did not provide RENEWED_LINEAGE}
test -s "$lineage/fullchain.pem"
test -s "$lineage/privkey.pem"
test -d "$TLS_DIR"
getent group "$TLS_GROUP" >/dev/null

staging=$(mktemp -d "${TLS_DIR}/.renew.XXXXXX")
trap 'rm -rf -- "$staging"' EXIT HUP INT TERM
install -m 0640 -o root -g "$TLS_GROUP" \
  "$lineage/fullchain.pem" "$staging/fullchain.pem"
install -m 0640 -o root -g "$TLS_GROUP" \
  "$lineage/privkey.pem" "$staging/privkey.pem"
mv -f "$staging/fullchain.pem" "$TLS_DIR/fullchain.pem"
mv -f "$staging/privkey.pem" "$TLS_DIR/privkey.pem"
rmdir "$staging"
trap - EXIT HUP INT TERM

container=$("$COMPOSE" ps --status running --quiet nginx)
[ -n "$container" ] || {
  echo "HAN VM2 nginx is not running" >&2
  exit 1
}

if ! nginx_test_output=$(
  "$COMPOSE" exec -T nginx nginx -t -c /etc/nginx/nginx.conf 2>&1
); then
  printf '%s\n' "$nginx_test_output" >&2
  exit 1
fi
/usr/bin/docker kill --signal HUP "$container" >/dev/null