#!/usr/bin/env bash
#
# Plan 294 Phase B-1 - Wildcard cert issuance for a parent domain.
#
# Issues `*.{parent}` via Certbot DNS-01 against the parent's Route53
# hosted zone. The EC2 instance role must have Route53
# `ChangeResourceRecordSets` on the zone (it does, per the Stage 0
# IAM policy).
#
# Idempotent — re-running on an already-issued cert is a no-op (Certbot
# detects the existing renewal config and returns 0).
#
# Usage (run as root on the EC2):
#   sudo /usr/local/bin/issue-wildcard-cert.sh example.com
#
# Cert lands at /etc/letsencrypt/live/{parent}-wildcard/

set -euo pipefail

if [ $# -lt 1 ]; then
    echo "Usage: $0 <parent-domain>"
    echo "Example: $0 dcsuniverse.com"
    exit 1
fi

PARENT="$1"
CERT_NAME="${PARENT}-wildcard"
EMAIL="${CERT_EMAIL:-admin@scopeforged.com}"

if [ "$EUID" -ne 0 ]; then
    echo "ERROR: this script must run as root (sudo)"
    exit 1
fi

# Ensure the DNS-Route53 plugin is installed (Plan 294 Stage 0 install
# adds it once; this is the belt for the suspenders).
if ! certbot plugins 2>/dev/null | grep -q dns-route53; then
    echo "Installing python3-certbot-dns-route53..."
    apt-get update -qq
    apt-get install -y python3-certbot-dns-route53
fi

echo "Issuing wildcard cert for *.${PARENT} ..."
certbot certonly \
    --dns-route53 \
    --domains "*.${PARENT}" \
    --cert-name "${CERT_NAME}" \
    --agree-tos \
    --email "${EMAIL}" \
    --non-interactive \
    --no-eff-email

echo
echo "Cert location: /etc/letsencrypt/live/${CERT_NAME}/"
ls -la "/etc/letsencrypt/live/${CERT_NAME}/" 2>/dev/null || echo "  (cert not yet present — Certbot may have failed)"

echo
echo "Next: regenerate the Apache vhost so it picks up the new cert:"
echo "  sudo /usr/local/bin/regenerate-tenant-vhost.sh"