#!/usr/bin/env bash
#
# update-ssl.sh — Automatically update SSL certificates on the server.
#
# Assumes:
#   - The nginx cert zips (e.g. ayi-games.online_nginx.zip) are downloaded to
#     ~/Downloads on this machine (mac).
#   - This machine can ssh/scp to the server without a password prompt.
#
# Flow (for each *_nginx.zip found in ~/Downloads):
#   1. Upload it to the server.
#   2. Unzip into ~/certs, overwriting existing cert files (flat, ignoring
#      any subfolders inside the zip).
#   3. Remove the uploaded zip from the server.
#   4. Delete the source zip from ~/Downloads.
#   5. Reload nginx once, after all zips are installed.

set -euo pipefail

SERVER="lighthouse@ayi-games.online"
CERTS_DIR="~/certs"
DOWNLOAD_DIR="${HOME}/Downloads"

usage() {
    cat <<EOF
Usage: $0

Finds every *_nginx.zip in ${DOWNLOAD_DIR}, uploads each to the server,
installs it into ${CERTS_DIR}, reloads nginx, and deletes the source zips
from ${DOWNLOAD_DIR}.
EOF
}

# --- Find all zips --------------------------------------------------------
ZIPS=()
while IFS= read -r z; do
    ZIPS+=("${z}")
done < <(find "${DOWNLOAD_DIR}" -maxdepth 1 -name '*_nginx.zip' -type f -print 2>/dev/null | sort)

if [[ ${#ZIPS[@]} -eq 0 ]]; then
    echo "ERROR: no *_nginx.zip found in ${DOWNLOAD_DIR}" >&2
    exit 1
fi

echo "Found ${#ZIPS[@]} zip(s) to process:"
for z in "${ZIPS[@]}"; do
    echo "  - ${z}"
done

# --- Upload & install each zip --------------------------------------------
for ZIP_PATH in "${ZIPS[@]}"; do
    ZIP_NAME="$(basename "${ZIP_PATH}")"
    echo
    echo ">>> Processing ${ZIP_NAME}"

    # Upload
    echo "Uploading to ${SERVER}..."
    scp "${ZIP_PATH}" "${SERVER}:${ZIP_NAME}"

    # Install on server (flat extract, overwrite), then remove from server
    echo "Installing into ${CERTS_DIR}..."
    ssh "${SERVER}" "set -e
mkdir -p ${CERTS_DIR}
unzip -oj ${ZIP_NAME} -d ${CERTS_DIR}
rm -f ${ZIP_NAME}
"

    # Only delete the local source once the upload+install succeeded
    rm -f "${ZIP_PATH}"
    echo "Deleted local source: ${ZIP_PATH}"
done

# --- Reload nginx once ----------------------------------------------------
echo
echo "Reloading nginx..."
ssh "${SERVER}" "sudo nginx -s reload && echo 'nginx reloaded OK'"

echo
echo "Done. All SSL certs updated and nginx reloaded."