#!/usr/bin/env bash
# setup-wildcard.sh — install the mod_md *.7rnx.net wildcard (acme-dns/DNS-01) on 7rntst.
# Idempotent, configtest-gated. Run from the repo's infra/7rnx/ directory.
#
# Prereqs:
# 1. acme-dns account registered; creds JSON at /etc/acme-dns/7rnx.json
# {"username":"..","password":"..","subdomain":".."}
# 2. one-time CNAME _acme-challenge.7rnx.net -> <subdomain>.auth.acme-dns.io
# (at the DNS host; ensure nothing else — e.g. cPanel AutoSSL — squats that name)
# 3. libapache2-mod-md installed
# After this runs, add apache/atproto-7rnx.conf as a site (a2ensite) so mod_md has a
# vhost to drive issuance, then reload once more to promote the obtained cert.
set -uo pipefail
HERE="$(cd "$(dirname "$0")" && pwd)"
CREDS=/etc/acme-dns/7rnx.json
HOOK=/etc/apache2/acme-dns-hook.sh
CONF=/etc/apache2/conf-available/md-7rnx-wildcard.conf
EMAIL="${1:-}"; [ -n "$EMAIL" ] || { read -rp "Admin email for Let's Encrypt: " EMAIL; }
if [ "$(id -u)" -ne 0 ]; then echo "Elevating with sudo..."; exec sudo bash "$0" "$EMAIL"; fi
[ -f "$CREDS" ] || { echo "ERROR: $CREDS missing — register acme-dns + write creds first"; exit 1; }
[ -f /etc/apache2/mods-available/md.load ] || { echo "ERROR: apt-get install -y libapache2-mod-md"; exit 1; }
# hook: executable by www-data (mod_md's run-user); creds readable by www-data
install -m 0755 -o root -g www-data "$HERE/acme-dns-hook.sh" "$HOOK"
chown root:www-data "$CREDS"; chmod 640 "$CREDS"
# mod_md config (set contact email)
install -m 0644 "$HERE/apache/md-7rnx-wildcard.conf" "$CONF"
sed -i "s|^MDContactEmail.*|MDContactEmail $EMAIL|" "$CONF"
a2enmod md >/dev/null
a2enconf md-7rnx-wildcard >/dev/null
apache2ctl configtest || { echo "ERROR: configtest failed — NOT reloading."; exit 1; }
systemctl reload apache2
echo "OK. mod_md now manages *.7rnx.net."
echo "Next: sudo a2ensite atproto-7rnx (from apache/atproto-7rnx.conf) so mod_md issues,"
echo "then 'sudo systemctl reload apache2' once the cert is obtained to promote it."
echo "Self-test the hook as the run-user: sudo -u www-data $HOOK setup 7rnx.net abcdefghijklmnopqrstuvwxyz0123456789ABCDEFG"