#!/bin/bash
# ==============================================================================
# OnEver Drive — SSL / HTTPS Configuration for Debian 12 / 13 LXC
# Supports Let's Encrypt (Certbot) or Local High-Entropy Self-Signed Cert
# ==============================================================================

set -e

DOMAIN="$1"
SSL_DIR="/etc/ssl/onever-drive"

if [ -z "$DOMAIN" ]; then
    echo "Uso:"
    echo "  $0 <midominio.com>          # Para Certbot / Let's Encrypt"
    echo "  $0 self-signed              # Para certificado autofirmado LAN / Intranet"
    exit 1
fi

if [ "$DOMAIN" != "self-signed" ]; then
    echo "[*] Instalando Certbot para Let's Encrypt..."
    apt-get update && apt-get install -y certbot python3-certbot-nginx
    certbot --nginx -d "$DOMAIN" --non-interactive --agree-tos -m "admin@$DOMAIN"
    echo "[+] Certificado Let's Encrypt configurado para $DOMAIN"
else
    echo "[*] Generando certificado SSL autofirmado de 4096 bits para Intranet..."
    mkdir -p "$SSL_DIR"
    openssl req -x509 -nodes -days 3650 -newkey rsa:4096 \
        -keyout "$SSL_DIR/server.key" \
        -out "$SSL_DIR/server.crt" \
        -subj "/C=ES/ST=State/L=City/O=OnEver/CN=onever-drive.local"

    cat <<'EOF' > /etc/nginx/sites-available/onever-drive
server {
    listen 80 default_server;
    listen [::]:80 default_server;
    server_name _;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl http2 default_server;
    listen [::]:443 ssl http2 default_server;
    server_name _;

    ssl_certificate /etc/ssl/onever-drive/server.crt;
    ssl_certificate_key /etc/ssl/onever-drive/server.key;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;

    root /var/www/onever-drive-web;
    index index.html;

    client_max_body_size 0;

    location / {
        try_files $uri $uri/ /index.html;
    }

    location /api/ {
        proxy_pass http://127.0.0.1:8000;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;

        proxy_request_buffering off;
        proxy_buffering off;
        proxy_read_timeout 600s;
        proxy_send_timeout 600s;
    }

    location /ws/ {
        proxy_pass http://127.0.0.1:8000;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "Upgrade";
        proxy_set_header Host $host;
        proxy_read_timeout 86400s;
        proxy_send_timeout 86400s;
    }
}
EOF
    nginx -t
    systemctl restart nginx
    echo "[+] SSL autofirmado activado en puerto 443 (HTTPS)"
fi