#!/bin/bash
# git.xpcool.com 证书更新（2026-09-13）
# 自适应：从 nginx 配置里读出实际引用的证书路径，覆盖该路径，避免文件名不一致踩空
set -e

DOMAIN=git.xpcool.com
CONF=/data/nginx/conf.d/$DOMAIN.conf

echo "=== conf ssl lines ==="
grep -n "listen\|server_name\|ssl_certificate" "$CONF"

echo "=== ssl dir (before) ==="
sudo ls -l /data/nginx/ssl/$DOMAIN/

# 从配置解析真实路径（ssl_certificate\s 不会误匹配 ssl_certificate_key）
CRT=$(grep -oP "ssl_certificate\s+\K[^;]+" "$CONF" | head -1 | tr -d ' \r')
KEY=$(grep -oP "ssl_certificate_key\s+\K[^;]+" "$CONF" | head -1 | tr -d ' \r')
echo "target crt = $CRT"
echo "target key = $KEY"

echo "=== old cert ==="
sudo openssl x509 -in "$CRT" -noout -subject -enddate
echo -n "old sha="; sudo sha256sum "$CRT" | cut -c1-16

# 备份旧证书（可回滚）
STAMP=$(date +%Y%m%d%H%M)
sudo cp -a "$CRT" "${CRT}.bak.$STAMP"
sudo cp -a "$KEY" "${KEY}.bak.$STAMP"
echo "backup -> ${CRT}.bak.$STAMP"

# 覆盖为新证书
sudo cp /tmp/${DOMAIN}_bundle.crt "$CRT"
sudo cp /tmp/${DOMAIN}.key "$KEY"
sudo chmod 644 "$CRT"
sudo chmod 600 "$KEY"

echo "=== key/cert match check ==="
c=$(sudo openssl x509 -in "$CRT" -noout -pubkey | openssl md5)
k=$(sudo openssl pkey -in "$KEY" -pubout 2>/dev/null | openssl md5)
echo "cert=$c"
echo "key =$k"
if [ "$c" = "$k" ]; then echo "MATCH_OK"; else echo "MATCH_FAIL"; exit 1; fi

echo "=== new cert ==="
sudo openssl x509 -in "$CRT" -noout -subject -enddate

sudo nginx -t
sudo systemctl reload nginx

echo "=== verify served cert ==="
echo | openssl s_client -connect 127.0.0.1:443 -servername $DOMAIN 2>/dev/null | openssl x509 -noout -subject -enddate
echo "DONE"