#!/usr/bin/env bash
# HTTPS внутри Docker: монтирование сертификата в контейнер (Apache + mod_ssl)
#
# Использование:
#   ./enable-docker-ssl.sh cloud.example.com \
#       /path/to/fullchain.pem /path/to/privkey.pem
#
# Или положите файлы в docker/certs/ и запустите:
#   ./enable-docker-ssl.sh cloud.example.com
#
# Nextcloud будет доступен: https://cloud.example.com:8443  (порт NEXTCLOUD_HTTPS_PORT)

set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
cd "${SCRIPT_DIR}"

# shellcheck source=../lib/common.sh
source "${SCRIPT_DIR}/../lib/common.sh"
drop_root_if_sudo "${SCRIPT_DIR}/enable-docker-ssl.sh" "$@"

[[ -f .env ]] || { echo "[ERROR] Сначала: ./install.sh"; exit 1; }
check_docker_access || exit 1

# shellcheck disable=SC1091
source .env

DOMAIN="${1:-}"
SRC_CERT="${2:-}"
SRC_KEY="${3:-}"

CERT_DIR="${SCRIPT_DIR}/certs"
CERT_FILE="${CERT_DIR}/fullchain.pem"
KEY_FILE="${CERT_DIR}/privkey.pem"

mkdir -p "${CERT_DIR}"

if [[ -z "${DOMAIN}" ]]; then
  read -r -p "Домен (trusted domain): " DOMAIN
fi

# Копируем или используем certs/
if [[ -n "${SRC_CERT}" && -n "${SRC_KEY}" ]]; then
  cp "${SRC_CERT}" "${CERT_FILE}"
  cp "${SRC_KEY}" "${KEY_FILE}"
elif [[ ! -f "${CERT_FILE}" || ! -f "${KEY_FILE}" ]]; then
  echo "[ERROR] Укажите сертификаты или положите в ${CERT_DIR}/"
  echo "  ./enable-docker-ssl.sh domain /path/fullchain.pem /path/privkey.pem"
  exit 1
fi

chmod 600 "${KEY_FILE}" 2>/dev/null || true

# Порт HTTPS (по умолчанию 8443)
HTTPS_PORT="${NEXTCLOUD_HTTPS_PORT:-8443}"
if ! grep -q '^NEXTCLOUD_HTTPS_PORT=' .env 2>/dev/null; then
  echo "NEXTCLOUD_HTTPS_PORT=${HTTPS_PORT}" >> .env
fi

touch .ssl-enabled

echo "[INFO] Сборка образа с mod_ssl..."
run_compose build app

echo "[INFO] Перезапуск с HTTPS (порт ${HTTPS_PORT})..."
run_compose up -d
ensure_app_code_ready

HTTPS_URL="https://${DOMAIN}:${HTTPS_PORT}"

echo "[INFO] Настройка Nextcloud..."
if run_compose exec -T -u www-data app php occ status &>/dev/null; then
  run_compose exec -T -u www-data app php occ config:system:set overwrite.cli.url --value="${HTTPS_URL}"
  run_compose exec -T -u www-data app php occ config:system:set overwriteprotocol --value="https"
  # Порт в overwritehost обязателен для публичных ссылок /s/… при нестандартном HTTPS-порте
  # run_compose exec -T -u www-data app php occ config:system:set overwritehost --value="${DOMAIN}:${HTTPS_PORT}"
else
  echo "[WARN] Nextcloud ещё не установлен; после install.sh выполните:"
  echo "       ./enable-docker-ssl.sh ${DOMAIN}"
fi

current_domains="$(grep '^NEXTCLOUD_TRUSTED_DOMAINS=' .env | cut -d= -f2- | sed 's/^"//; s/"$//' || true)"
if ! printf '%s\n' "${current_domains}" | tr ' ' '\n' | grep -Fxq "${DOMAIN}"; then
  current_domains="${current_domains} ${DOMAIN}"
  current_domains="$(echo "${current_domains}" | xargs)"
  sed -i "s|^NEXTCLOUD_TRUSTED_DOMAINS=.*|NEXTCLOUD_TRUSTED_DOMAINS=\"${current_domains}\"|" .env
fi

echo ""
echo "[INFO] === HTTPS внутри Docker включён ==="
echo "  URL:     ${HTTPS_URL}"
echo "  HTTP:    http://127.0.0.1:${NEXTCLOUD_PORT:-8080}  (по-прежнему работает)"
echo "  Certs:   ${CERT_DIR}/ → /etc/ssl/nextcloud/ в контейнере"
echo ""
echo "Отключить: ./disable-docker-ssl.sh"
echo "Проверка:  curl -kI ${HTTPS_URL}/status.php"