#!/bin/sh
set -e

DOMAIN="${PAPERCLIP_DOMAIN}"
CERT_PATH="/etc/letsencrypt/live/${DOMAIN}/fullchain.pem"
EMAIL="${CERTBOT_EMAIL}"
TOKEN="${CLOUDFLARE_API_TOKEN}"

# Verify environment variables
if [ -z "$DOMAIN" ]; then
    echo "ERROR: PAPERCLIP_DOMAIN not set"
    exit 1
fi

if [ -z "$EMAIL" ]; then
    echo "ERROR: CERTBOT_EMAIL not set"
    exit 1
fi

if [ -z "$TOKEN" ]; then
    echo "ERROR: CLOUDFLARE_API_TOKEN not set"
    exit 1
fi

# Check if certificate already exists
if [ -f "$CERT_PATH" ]; then
    echo "Certificate for $DOMAIN already exists at $CERT_PATH"
    exit 0
fi

echo "Requesting certificate for $DOMAIN via Cloudflare DNS challenge..."

# Create a temporary credentials file (more reliable than env var with certbot)
CREDS_FILE="/tmp/cloudflare.ini"
cat > "$CREDS_FILE" << EOF
dns_cloudflare_api_token = ${TOKEN}
EOF
chmod 600 "$CREDS_FILE"

# Request certificate with Cloudflare DNS plugin
if certbot certonly \
    --dns-cloudflare \
    --dns-cloudflare-credentials "$CREDS_FILE" \
    --agree-tos \
    --no-eff-email \
    --email "$EMAIL" \
    --non-interactive \
    -d "$DOMAIN"; then
    echo "Certificate obtained successfully for $DOMAIN"
else
    echo "ERROR: Failed to obtain certificate for $DOMAIN"
    rm -f "$CREDS_FILE"
    exit 1
fi

# Clean up credentials file
rm -f "$CREDS_FILE"

# Verify certificate
if [ -f "$CERT_PATH" ]; then
    echo "Certificate verified at $CERT_PATH"
else
    echo "ERROR: Certificate not found at $CERT_PATH after successful certbot run"
    exit 1
fi