#!/usr/bin/env bash
set -euo pipefail

if [[ ${EUID} -ne 0 ]]; then
  printf '%s\n' "enable-tls must run as root" >&2
  exit 1
fi
domain=threads-tool-dev.30cm.net
if [[ ! -f "/etc/letsencrypt/live/$domain/fullchain.pem" || ! -f "/etc/letsencrypt/live/$domain/privkey.pem" ]]; then
  printf '%s\n' "certificate not found; obtain a DNS-01 certificate for $domain first" >&2
  exit 1
fi
install -m 0644 /opt/harbor/deploy/nginx/harbor-tls.conf /etc/nginx/sites-available/harbor.conf
nginx -t
systemctl reload nginx
printf '%s\n' "TLS enabled for $domain"