#!/usr/bin/env bash
set -euo pipefail

NGINX_SITES="/etc/nginx/sites-available"
WWW_USER="www-data"
WWW_GROUP="www-data"

for conf in "$NGINX_SITES"/*.conf; do
  domain=$(grep -m1 -E '^\s*server_name' "$conf" | awk '{print $2}')
  root=$(grep -m1 -E '^\s*root' "$conf" | awk '{print $2}' | sed 's/;//')
  [[ -n "$domain" && -n "$root" ]] || continue

  echo "▶ 처리: $domain → root=$root"

  # 1) .well-known 디렉토리
  mkdir -p "$root/.well-known/acme-challenge"
  chown -R $WWW_USER:$WWW_GROUP "$root/.well-known"

  # 2) HTTP-01 location 삽입
  if ! grep -q "location \^~ /.well-known/acme-challenge/" "$conf"; then
    sed -i -E "/^\s*listen\s+80;/a \\
    \    # ACME HTTP-01 챌린지 응답\\
    \    location ^~ /.well-known/acme-challenge/ {\\
    \        root $root;\\
    \        default_type \"text/plain\";\\
    \        try_files \$uri =404;\\
    \    }" "$conf"
  fi

  # 3) cert 복사 & vhost 치환
  #    live 디렉토리 확인 (fallback www.${domain})
  LIVE="/etc/letsencrypt/live/$domain"
  if [[ ! -d "$LIVE" ]]; then
    if [[ -d "/etc/letsencrypt/live/www.$domain" ]]; then
      LIVE="/etc/letsencrypt/live/www.$domain"
    else
      echo "  ⚠️ 인증서 디렉토리 없음, 복사/치환 스킵: $domain"
      continue
    fi
  fi

  SSLDIR="$root/ssl"
  mkdir -p "$SSLDIR"
  cp "$LIVE/fullchain.pem" "$SSLDIR/"
  cp "$LIVE/privkey.pem"   "$SSLDIR/"
  chown $WWW_USER:$WWW_GROUP "$SSLDIR/"*.pem
  chmod 640               "$SSLDIR/"*.pem

  sed -i -E \
    -e "s@ssl_certificate\s+/etc/letsencrypt/live/[^;]+/fullchain.pem;@ssl_certificate     $SSLDIR/fullchain.pem;@" \
    -e "s@ssl_certificate_key\s+/etc/letsencrypt/live/[^;]+/privkey.pem;@ssl_certificate_key $SSLDIR/privkey.pem;@" \
    "$conf"

done

nginx -t && systemctl reload nginx
echo "✅ 작업 완료"