mnemo_cards/tools/ssl/setup_ssl.sh

#!/bin/bash

# SSL Certificate Setup Script for All Mnemo Cards Domains
# Usage: ./setup_ssl.sh
#
# This script uses nginx webroot mode for certificate issuance/renewal
# which doesn't require stopping nginx.

set -e

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m' # No Color

# Function to print colored output
print_status() {
    echo -e "${GREEN}[INFO]${NC} $1"
}

print_warning() {
    echo -e "${YELLOW}[WARNING]${NC} $1"
}

print_error() {
    echo -e "${RED}[ERROR]${NC} $1"
}

print_success() {
    echo -e "${GREEN}[SUCCESS]${NC} $1"
}

echo "🔐 Setting up SSL certificates for all Mnemo Cards domains..."

# Check if running as root
if [ "$EUID" -ne 0 ]; then
    print_error "This script must be run as root (sudo)"
    exit 1
fi

# Email for Let's Encrypt (can be overridden)
LETSENCRYPT_EMAIL="${LETSENCRYPT_EMAIL:-admin@mnemo-cards.online}"

# Domains to set up certificates for (only mnemo-cards.online domains)
DOMAINS=(
    "mnemo-cards.online"
    "api.mnemo-cards.online"
    "admin.mnemo-cards.online"
    "code.mnemo-cards.online"
    "vscode.mnemo-cards.online"
)

# Webroot path for ACME challenge
WEBROOT_PATH="/var/www/html"

# Check if certbot is installed
if ! command -v certbot &> /dev/null; then
    print_status "Installing certbot and nginx plugin..."
    apt update
    apt install -y certbot python3-certbot-nginx
    print_success "Certbot installed"
fi

# Ensure webroot directory exists
mkdir -p "$WEBROOT_PATH/.well-known/acme-challenge"
chmod -R 755 "$WEBROOT_PATH/.well-known"

# Clean up old/invalid certificate for hosting domain (not our domain)
if [ -d "/etc/letsencrypt/live/5492281-cf88967.twc1.net" ]; then
    print_warning "Removing old hosting certificate (5492281-cf88967.twc1.net)..."
    certbot delete --cert-name 5492281-cf88967.twc1.net --non-interactive 2>/dev/null || true
    rm -rf /etc/letsencrypt/live/5492281-cf88967.twc1.net 2>/dev/null || true
    rm -rf /etc/letsencrypt/archive/5492281-cf88967.twc1.net 2>/dev/null || true
    rm -f /etc/letsencrypt/renewal/5492281-cf88967.twc1.net.conf 2>/dev/null || true
    print_success "Old hosting certificate removed"
fi

# Get certificates for all domains using nginx plugin (no downtime)
for domain in "${DOMAINS[@]}"; do
    if [ -d "/etc/letsencrypt/live/$domain" ] && [ -f "/etc/letsencrypt/live/$domain/fullchain.pem" ]; then
        print_success "Certificate already exists for $domain"
    else
        print_status "Obtaining certificate for $domain..."

        # Use nginx plugin - it handles configuration automatically without stopping nginx
        if certbot certonly --nginx -d "$domain" --non-interactive --agree-tos --email "$LETSENCRYPT_EMAIL"; then
            print_success "Certificate obtained for $domain"
        else
            print_warning "Nginx plugin failed for $domain, trying standalone..."
            # Fallback to standalone (requires stopping nginx briefly)
            systemctl stop nginx 2>/dev/null || true
            if certbot certonly --standalone -d "$domain" --non-interactive --agree-tos --email "$LETSENCRYPT_EMAIL"; then
                print_success "Certificate obtained for $domain (standalone)"
            else
                print_error "Failed to obtain certificate for $domain"
            fi
            systemctl start nginx 2>/dev/null || true
        fi
    fi
done

# Ensure nginx is running
if ! systemctl is-active --quiet nginx; then
    print_status "Starting nginx..."
    systemctl start nginx
fi

# Set up automatic renewal cron job (uses nginx plugin, no downtime)
print_status "Setting up automatic certificate renewal..."

# Remove old cron jobs that might cause issues
crontab -l 2>/dev/null | grep -v "certbot" | crontab - 2>/dev/null || true

# Add single renewal job that uses nginx plugin
CRON_JOB="0 3 * * * /usr/bin/certbot renew --quiet --deploy-hook \"systemctl reload nginx\""

(crontab -l 2>/dev/null | grep -v certbot; echo "$CRON_JOB") | crontab -
print_success "Automatic renewal cron job configured"

# Test renewal (dry-run)
print_status "Testing certificate renewal..."
if certbot renew --dry-run 2>&1 | grep -q "Congratulations\|would have been renewed\|No renewals were attempted"; then
    print_success "Certificate renewal test passed"
else
    print_warning "Certificate renewal test had issues - check /var/log/letsencrypt/letsencrypt.log"
fi

echo ""
print_success "SSL certificate setup completed!"
echo ""
echo "📋 Summary:"
echo "- Certificates configured for: ${DOMAINS[*]}"
echo "- Using nginx plugin (no downtime during renewal)"
echo "- Automatic renewal scheduled at 3:00 AM daily"
echo ""
echo "🔍 Run './check_ssl.sh' to verify certificate status"
echo "🔄 Certificates will auto-renew before expiration"