#!/usr/bin/env bash
set -euo pipefail

SSL_DIR="/etc/sone/ssl/local"
DAYS_LEFT_LIMIT="${DAYS_LEFT_LIMIT:-30}"
RENEWED=0

if [ ! -d "$SSL_DIR" ]; then
  exit 0
fi

renew_cert() {
  local domain="$1"
  local cert_file="${SSL_DIR}/${domain}.crt"
  local key_file="${SSL_DIR}/${domain}.key"
  local openssl_config="${SSL_DIR}/${domain}.openssl.cnf"

  cat > "$openssl_config" <<EOF_SSL
[req]
default_bits = 2048
prompt = no
default_md = sha256
distinguished_name = dn
x509_extensions = v3_req

[dn]
CN = ${domain}

[v3_req]
subjectAltName = @alt_names

[alt_names]
DNS.1 = ${domain}
EOF_SSL

  openssl req \
    -x509 \
    -nodes \
    -days 3650 \
    -newkey rsa:2048 \
    -keyout "$key_file" \
    -out "$cert_file" \
    -config "$openssl_config" >/dev/null 2>&1

  chmod 600 "$key_file"
  chmod 644 "$cert_file"

  RENEWED=1
  echo "renewed: ${domain}"
}

for cert in "$SSL_DIR"/*.crt; do
  [ -e "$cert" ] || continue

  domain="$(basename "$cert" .crt)"

  if ! openssl x509 -checkend "$((DAYS_LEFT_LIMIT * 86400))" -noout -in "$cert" >/dev/null 2>&1; then
    renew_cert "$domain"
  fi
done

if [ "$RENEWED" -eq 1 ]; then
  if command -v nginx >/dev/null 2>&1; then
    nginx -t && systemctl reload nginx
  fi
else
  echo "no local certificates need renewal"
fi
