#!/usr/bin/env bash
set +x
set -Eeuo pipefail
root=${1:?}
domain=${2:?}
image=${3:?}
[[ "$root" == /*/gray-logistics-chat && "$root" != *..* ]] || exit 2
[[ "$domain" =~ ^[a-z0-9.-]+$ && "$image" =~ ^baiyue-logistics-chat-certbot:[a-f0-9]{12}-b[0-9]+$ ]] || exit 2
[[ "$(cat "$root/.project")" == baiyue-logistics-chat-gray ]] || exit 2
certificate="$root/tls/config/live/$domain/fullchain.pem"
previous=$(sha256sum "$certificate")
docker run --rm --name baiyue-logistics-chat-certbot-renew \
  -v "$root/tls/config:/etc/letsencrypt" -v "$root/tls/work:/var/lib/letsencrypt" \
  -v "$root/tls/logs:/var/log/letsencrypt" -v /var/lib/baiyue-logistics-chat-acme:/webroot \
  "$image" renew --non-interactive --cert-name "$domain"
if [[ "$(sha256sum "$certificate")" != "$previous" ]]; then nginx -t; nginx -s reload; fi