#!/bin/bash
# فعال‌سازی SSL رایگان Let's Encrypt برای دامنه CDN
# استفاده: bash cdn-ssl.sh cdn.modstagram.com admin@modstagram.com

set -e

DOMAIN="$1"
EMAIL="$2"

if [ -z "$DOMAIN" ]; then
  echo "ERROR: domain is required"
  exit 1
fi

if [ -z "$EMAIL" ]; then
  EMAIL="admin@modstagram.com"
fi

if ! command -v certbot &> /dev/null; then
  echo "Installing certbot..."
  apt-get update -y
  apt-get install -y certbot python3-certbot-nginx
fi

echo "Requesting certificate for: $DOMAIN"

certbot certonly \
  --nginx \
  --non-interactive \
  --agree-tos \
  --email "$EMAIL" \
  -d "$DOMAIN" \
  --redirect

echo "Certificate issued successfully for $DOMAIN"

if command -v nginx &> /dev/null; then
  nginx -t && systemctl reload nginx
  echo "Nginx reloaded"
fi

if [ "$3" = "--setup-cron" ] || [ "${SSL_AUTO_RENEW:-true}" = "true" ]; then
  CRON_CMD="0 3 * * * certbot renew --quiet --nginx && systemctl reload nginx"
  (crontab -l 2>/dev/null | grep -v "certbot renew" ; echo "$CRON_CMD") | crontab -
  echo "Auto-renew cron job configured"
fi

echo "SSL activation complete"