#!/usr/bin/env bash

if [[ -z "$1" ]] || [[ "$1" == '--help' ]]
then
    echo "Usage: $0 <wildcard-domain>"
    exit 1
fi

set -e

domain=$1
certalias="_.$1"

tmpdir=$(mktemp -d)
trap 'cd /; rm -Rf "$tmpdir"' EXIT

export BW_REPO_PATH="${BW_REPO_PATH:-$PWD}"

cd -- "$tmpdir"
git clone https://github.com/dehydrated-io/dehydrated.git
cd dehydrated
git checkout "$(git describe --tags --abbrev=0)"

cat >config <<EOF
BASEDIR=$tmpdir
KEYSIZE=4096
HOOK=$tmpdir/dehydrated/hook
RENEW_DAYS=90
CHALLENGETYPE=dns-01
EOF

cat >hook <<"EOF"
#!/usr/bin/env bash

if [[ "$1" == 'deploy_challenge' ]]
then
    domain=$2
    token_value=$4

    echo
    echo You must now provide this DNS record:
    echo "$(tput bold)_acme-challenge.$domain IN TXT $token_value$(tput sgr0)"
    echo
    echo "Hit ENTER once it's available."
    read
fi
EOF
chmod +x hook

cat <<EOF

You will soon be asked to create several DNS records.
$(tput bold)Please create all of them. The second one does NOT replace
the first one.$(tput sgr0)

EOF

./dehydrated --register --accept-terms -f config
./dehydrated -c -d "$domain" --alias "$certalias" -d "*.$domain" -f config

cd -- "$tmpdir"/certs/"$certalias"

echo
echo Copying final files:
echo
bw_repo=$(bw debug -c 'print(repo.path)')
cp -v cert.pem "$bw_repo"/data/ssl/"$certalias".crt.pem
cp -v chain.pem "$bw_repo"/data/ssl/"$certalias".crt_intermediate.pem

echo "Encrypting private key via bw ..."
bw debug -c "repo.vault.encrypt_file('$tmpdir/certs/$certalias/privkey.pem', 'ssl/$certalias.key.pem.vault')"

echo
echo "Certificate and key created."