#!/usr/bin/env bash
#
# 把仓库里的 nginx 配置同步到宿主机 nginx（非容器部署路径）。
#
set -euo pipefail

# 检查并创建nginx用户
if ! id -u nginx >/dev/null 2>&1; then
    echo "创建nginx用户..."
    sudo useradd -r -s /sbin/nologin nginx
fi

# 创建配置目录（ssl.d 必须存在，nginx.conf 里的 wildcard include 在目录缺失时会报 emerg）
sudo mkdir -p /etc/nginx/conf.d /etc/nginx/ssl.d

# 备份并覆盖 nginx.conf 文件
sudo cp /etc/nginx/nginx.conf /etc/nginx/nginx.conf.bak
sudo cp nginx.conf /etc/nginx/

# 备份并覆盖 conf.d 目录下的所有 .conf 文件（只放不依赖证书的配置）
for conf in conf.d/*.conf; do
    filename=$(basename "$conf")
    sudo cp "/etc/nginx/conf.d/$filename" "/etc/nginx/conf.d/${filename}.bak" 2>/dev/null || true
    sudo cp "$conf" /etc/nginx/conf.d/
done

# HTTPS 配置：证书就绪后才启用，避免 nginx 因证书缺失拒绝启动
# 5 个域名共用一张 SAN 证书，统一放在 CERT_NAME 目录下
CERT_NAME="${CERT_NAME:-stonelan.cn}"
CERT_FULL="/etc/letsencrypt/live/$CERT_NAME/fullchain.pem"
DOMAINS="${DOMAINS:-fastgpt.stonelan.cn gitea.stonelan.cn image.stonelan.cn registry.stonelan.cn www.stonelan.cn}"

if [ -f "$CERT_FULL" ]; then
    for d in $DOMAINS; do
        src="ssl.d.available/$d.conf"
        if [ -f "$src" ]; then
            sudo cp "$src" "/etc/nginx/ssl.d/$d.conf"
            echo "已启用 $d"
        else
            echo "跳过 $d：缺少 $src"
        fi
    done
else
    echo "证书尚未生成（$CERT_FULL），跳过 HTTPS 配置"
fi

# 测试并重载配置
if sudo nginx -t; then
    if sudo systemctl is-active --quiet nginx; then
        sudo systemctl reload nginx
        echo "配置已重载"
    else
        sudo systemctl start nginx
        echo "nginx 已启动"
    fi
else
    echo "配置测试失败，已恢复备份"
    sudo cp /etc/nginx/nginx.conf.bak /etc/nginx/nginx.conf
    for conf in conf.d/*.conf; do
        filename=$(basename "$conf")
        sudo mv -f "/etc/nginx/conf.d/${filename}.bak" "/etc/nginx/conf.d/$filename" 2>/dev/null || true
    done
    exit 1
fi