#!/usr/bin/env bash
# TP31 — Caddyfile + DNS-Token in LXC 130 ausrollen.
#
# Das Token wird aus ~/.secrets/credentials.env gelesen und direkt in die
# Container-Env-Datei geschrieben. Es erscheint dabei NIE auf stdout und nie in
# einer Kommandozeile — dieselbe Regel wie bei `sshpass -e` (s. CLAUDE.md).
set -euo pipefail

PVE=${PVE:-root@10.40.20.100}
CTID=${CTID:-130}
HERE=$(cd "$(dirname "$0")" && pwd)

TOKEN=$(grep -m1 '^CF_DNS_API_TOKEN=' ~/.secrets/credentials.env 2>/dev/null | cut -d= -f2- || true)
if [ -z "${TOKEN}" ]; then
  echo "FEHLER: CF_DNS_API_TOKEN fehlt in ~/.secrets/credentials.env" >&2
  echo "  Anlegen in Cloudflare: My Profile -> API Tokens -> Create Token," >&2
  echo "  Permission 'Zone : DNS : Edit', Zone Resources auf emsenhuber.net begrenzen." >&2
  echo "  NICHT das account-weite CF_API_TOKEN wiederverwenden." >&2
  exit 1
fi

echo "-> Caddyfile"
scp -q "${HERE}/Caddyfile" "${PVE}:/tmp/.caddyfile.$$"
ssh "${PVE}" "pct push ${CTID} /tmp/.caddyfile.\$\$ /etc/caddy/Caddyfile --perms 644 2>/dev/null || pct push ${CTID} /tmp/.caddyfile.$$ /etc/caddy/Caddyfile --perms 644; rm -f /tmp/.caddyfile.$$"

echo "-> Token (maskiert: Laenge ${#TOKEN})"
printf 'CF_DNS_API_TOKEN=%s\n' "${TOKEN}" | ssh "${PVE}" "cat > /tmp/.cenv.$$ && chmod 600 /tmp/.cenv.$$ && pct push ${CTID} /tmp/.cenv.$$ /etc/caddy/caddy.env --perms 600 && rm -f /tmp/.cenv.$$"

echo "-> validate"
ssh "${PVE}" "pct exec ${CTID} -- sh -c 'set -a; . /etc/caddy/caddy.env; set +a; /usr/local/bin/caddy validate --config /etc/caddy/Caddyfile' 2>&1 | tail -3"

echo "-> reload/start"
ssh "${PVE}" "pct exec ${CTID} -- systemctl reload-or-restart caddy && sleep 3 && pct exec ${CTID} -- systemctl is-active caddy"