#!/usr/bin/env bash
# Apply koopa Caddyfile (git.hacktivism.ch, forgejo-ssh note :9200, ACME host list).
# Usage: sudo ~/koopa-caddy/apply.sh
#    or: ~/koopa-caddy/apply.sh   (will re-exec with sudo if needed)
set -euo pipefail

SRC="${CADDYFILE_SRC:-/home/hernani/koopa-caddy/Caddyfile}"
DST="/etc/caddy/Caddyfile"
BACKUP_DIR="/etc/caddy"

if [[ ! -f "$SRC" ]]; then
  echo "error: source missing: $SRC" >&2
  exit 1
fi

if [[ "$(id -u)" -ne 0 ]]; then
  exec sudo -E "$0" "$@"
fi

ts=$(date +%Y%m%d-%H%M%S)
bak="${BACKUP_DIR}/Caddyfile.bak-${ts}"
cp -a "$DST" "$bak"
echo "backup: $bak"

cp "$SRC" "$DST"
chown root:caddy "$DST" 2>/dev/null || chown root:root "$DST"
chmod 644 "$DST"

echo "validate..."
if command -v caddy >/dev/null 2>&1; then
  caddy validate --config "$DST"
else
  echo "warn: caddy binary not in PATH; skipping validate" >&2
fi

echo "reload..."
systemctl reload caddy
systemctl is-active caddy

echo "spot-check:"
grep -n "git.hacktivism\|9200\|9024" "$DST" | head -10
echo "OK: $DST updated from $SRC"