#!/usr/bin/env bash
#
# 把仓库里的 nginx 配置同步到宿主机 nginx（非容器部署路径）。
#
set -euo pipefail

# 检查并创建nginx用户
if ! id -u nginx >/dev/null 2>&1; then
    echo "创建nginx用户..."
    sudo useradd -r -s /sbin/nologin nginx
fi

# 创建配置目录（ssl.d 必须存在，nginx.conf 里的 wildcard include 在目录缺失时会报 emerg）
sudo mkdir -p /etc/nginx/conf.d /etc/nginx/ssl.d

# 备份并覆盖 nginx.conf 文件
sudo cp /etc/nginx/nginx.conf /etc/nginx/nginx.conf.bak
sudo cp nginx.conf /etc/nginx/

# 备份并覆盖 conf.d 目录下的所有 .conf 文件（只放不依赖证书的配置）
for conf in conf.d/*.conf; do
    filename=$(basename "$conf")
    sudo cp "/etc/nginx/conf.d/$filename" "/etc/nginx/conf.d/${filename}.bak" 2>/dev/null || true
    sudo cp "$conf" /etc/nginx/conf.d/
done

# HTTPS 配置：只有证书已就绪的域名才启用，避免 nginx 因证书缺失拒绝启动
DOMAINS="${DOMAINS:-fastgpt.stonelan.cn gitea.stonelan.cn image.stonelan.cn registry.stonelan.cn www.stonelan.cn}"
for d in $DOMAINS; do
    src="ssl.d.available/$d.conf"
    [ -f "$src" ] || { echo "跳过 $d：缺少 $src"; continue; }

    if [ -f "/etc/letsencrypt/live/$d/fullchain.pem" ]; then
        sudo cp "$src" "/etc/nginx/ssl.d/$d.conf"
        echo "已启用 $d"
    else
        echo "跳过 $d：证书尚未生成"
    fi
done

# 测试并重载配置
if sudo nginx -t; then
    if sudo systemctl is-active --quiet nginx; then
        sudo systemctl reload nginx
        echo "配置已重载"
    else
        sudo systemctl start nginx
        echo "nginx 已启动"
    fi
else
    echo "配置测试失败，已恢复备份"
    sudo cp /etc/nginx/nginx.conf.bak /etc/nginx/nginx.conf
    for conf in conf.d/*.conf; do
        filename=$(basename "$conf")
        sudo mv -f "/etc/nginx/conf.d/${filename}.bak" "/etc/nginx/conf.d/$filename" 2>/dev/null || true
    done
    exit 1
fi