#!/bin/bash
# Sostituisce il certificato self-signed con Let's Encrypt.
# Prerequisito: DNS A b2b-guzzini.mypantarei.net → IP pubblico di questo host.
#
#   sudo bash /var/www/html/server-ops/mypantarei/enable-b2b-guzzini-letsencrypt.sh
set -euo pipefail

HOST=b2b-guzzini.mypantarei.net
WEBROOT=/var/www/html/b2b-guzzini
EMAIL=admin@mypantarei.net

echo "=== Verifica DNS pubblico ==="
PUB=$(dig +short "$HOST" A @8.8.8.8 | head -1)
SERVER_IP=$(dig +short vteguzzini.mypantarei.net A @8.8.8.8 | head -1)
echo "b2b-guzzini → ${PUB:-NXDOMAIN}"
echo "vteguzzini  → ${SERVER_IP:-?}"
if [[ -z "${PUB}" || "${PUB}" == "127.0.0.1" ]]; then
	echo "ERRORE: crea il record A pubblico prima di continuare."
	exit 1
fi

# Temporaneamente no-redirect ACME: il vhost HTTP deve servire .well-known
certbot certonly --webroot -w "$WEBROOT" -d "$HOST" \
	--non-interactive --agree-tos -m "$EMAIL" --keep-until-expiring

SSL_CONF=/etc/apache2/sites-available/b2b-guzzini-le-ssl.conf
sed -i "s|SSLCertificateFile .*|SSLCertificateFile /etc/letsencrypt/live/${HOST}/fullchain.pem|" "$SSL_CONF"
sed -i "s|SSLCertificateKeyFile .*|SSLCertificateKeyFile /etc/letsencrypt/live/${HOST}/privkey.pem|" "$SSL_CONF"

# Include LE options se presente
grep -q 'options-ssl-apache.conf' "$SSL_CONF" || \
	sed -i "/SSLCertificateKeyFile/a\\    Include /etc/letsencrypt/options-ssl-apache.conf" "$SSL_CONF"

apache2ctl configtest
systemctl reload apache2
echo "OK: certificato Let's Encrypt attivo per https://${HOST}"