#!/usr/bin/env bash
set -euo pipefail
cd "$(dirname "$0")"

DOMAIN="vpn.yyamashita.com"
CADDY_DIR="/app/infra/caddy"
CADDY_CERT_BASE="/data/caddy/certificates/acme-v02.api.letsencrypt.org-directory/${DOMAIN}/${DOMAIN}"

echo "証明書を更新中..."

docker compose -f "$CADDY_DIR/docker-compose.yml" exec -T caddy \
    cat "${CADDY_CERT_BASE}.crt" > certs/server.crt
docker compose -f "$CADDY_DIR/docker-compose.yml" exec -T caddy \
    cat "${CADDY_CERT_BASE}.key" > certs/server.key
chmod 600 certs/server.key

# チェーン分割 + Android 用 CA 証明書更新
awk '/BEGIN CERTIFICATE/{n++} n==1' certs/server.crt > certs/server-leaf.crt
awk '/BEGIN CERTIFICATE/{n++} n>1' certs/server.crt > certs/server-chain.crt
mv certs/server-leaf.crt certs/server.crt
awk '/BEGIN CERTIFICATE/{n++} n==1' certs/server-chain.crt > "$CADDY_DIR/ca.pem"

docker compose restart
echo "完了。証明書を更新してリロードしました。"