#!/usr/bin/env bash
# One-time installation. Existing domain configuration is never silently overwritten.
set -euo pipefail
root=/opt/cadworld-sim
base=/opt/1panel/apps/openresty/openresty
conf=$base/conf/conf.d/cadworld-sim.robotquan.com.conf
source_dir=$(cd -- "$(dirname -- "$0")" && pwd)
[[ ! -e "$conf" ]] || { echo 'Domain vhost already exists; inspect/backup it first.' >&2; exit 1; }
mkdir -p "$root/backups" "$base/www/acme/cadworld-sim.robotquan.com" "$base/www/ssl/cadworld-sim.robotquan.com"
chmod 700 "$root/backups" "$base/www/ssl/cadworld-sim.robotquan.com"
tar -czf "$root/backups/openresty-pre-cadworld.tar.gz" -C "$base" conf
cp "$source_dir/compose.yaml" "$root/compose.yaml"
printf 'CADWORLD_RELEASE=bootstrap\n' > "$root/release.env"
# HTTP only serves challenges. No API or credentials until a trusted certificate exists.
printf '%s\n' \
 'server {' \
 ' listen 80; server_name cadworld-sim.robotquan.com;' \
 ' location ^~ /.well-known/acme-challenge/ { root /www/acme/cadworld-sim.robotquan.com; default_type text/plain; }' \
 ' location / { return 503; }' \
 '}' > "$conf"
docker exec 1Panel-openresty-m72w nginx -t
docker exec 1Panel-openresty-m72w nginx -s reload
docker compose --env-file "$root/release.env" -f "$root/compose.yaml" run --rm -T --interactive=false certbot certonly \
 --non-interactive --agree-tos --register-unsafely-without-email \
 --webroot -w /var/www/acme -d cadworld-sim.robotquan.com
cp "$source_dir/openresty.conf" "$conf"
docker exec 1Panel-openresty-m72w nginx -t
docker exec 1Panel-openresty-m72w nginx -s reload
cp "$source_dir/renew-certificate.sh" "$root/renew-certificate.sh"
chmod 700 "$root/renew-certificate.sh"
cp "$source_dir/cadworld-certificate.service" /etc/systemd/system/
cp "$source_dir/cadworld-certificate.timer" /etc/systemd/system/
systemctl daemon-reload
systemctl enable --now cadworld-certificate.timer