#!/usr/bin/env bash
set -euo pipefail

if [[ ${EUID} -ne 0 ]]; then
  printf '%s\n' "enable-tls must run as root" >&2
  exit 1
fi
domain=threads-tool.30cm.net
if [[ ! -f "/etc/letsencrypt/live/$domain/fullchain.pem" || ! -f "/etc/letsencrypt/live/$domain/privkey.pem" ]]; then
  printf '%s\n' "certificate not found; obtain a DNS-01 certificate for $domain first" >&2
  exit 1
fi
install -m 0644 /opt/harbor/deploy/nginx/harbor-tls.conf /etc/nginx/sites-available/harbor.conf
install -d -m 0755 /etc/letsencrypt/renewal-hooks/deploy
install -m 0755 /opt/harbor/deploy/remote/certbot-renew-hook.sh /etc/letsencrypt/renewal-hooks/deploy/harbor-nginx
nginx -t
systemctl reload nginx
printf '%s\n' "TLS enabled for $domain"
