#!/bin/bash
# Run after DNS for calebandlydia.com and www points to this server's public IP.
set -euo pipefail

WEBROOT="/var/www/acme"

certbot certonly --webroot -w "$WEBROOT" \
	-d calebandlydia.com -d www.calebandlydia.com \
	--agree-tos --non-interactive "$@"

cat > /etc/apache2/conf-available/calebandlydia-le-ssl.inc <<'EOF'
    Include /etc/letsencrypt/options-ssl-apache.conf
    SSLCertificateFile /etc/letsencrypt/live/calebandlydia.com/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/calebandlydia.com/privkey.pem
EOF

python3 <<'PY'
from pathlib import Path
conf = Path("/etc/apache2/sites-available/calebandlydia.conf")
text = conf.read_text()
old = """    Include /etc/letsencrypt/options-ssl-apache.conf
    SSLCertificateFile /etc/ssl/certs/ssl-cert-snakeoil.pem
    SSLCertificateKeyFile /etc/ssl/private/ssl-cert-snakeoil.key"""
new = """    Include /etc/apache2/conf-available/calebandlydia-le-ssl.inc"""
if old not in text:
    raise SystemExit("Unexpected calebandlydia.conf SSL block; edit manually.")
conf.write_text(text.replace(old, new, 1))
PY

apache2ctl configtest
systemctl reload apache2
echo "OK: Let's Encrypt cert active for calebandlydia.com"