#!/bin/sh
set -eu

NGINX_PORT="${NGINX_PORT:-8443}"
NGINX_SERVER_NAME="${NGINX_SERVER_NAME:-_}"
SSL_CERT_DIR="${SSL_CERT_DIR:-/etc/nginx/certs}"
SSL_CERT_FILE_NAME="${SSL_CERT_FILE_NAME:-cert.pem}"
SSL_CHAIN_FILE_NAME="${SSL_CHAIN_FILE_NAME:-chain.pem}"
SSL_KEY_FILE_NAME="${SSL_KEY_FILE_NAME:-privkey.pem}"
UPSTREAM_HOST="${UPSTREAM_HOST:-360-player}"
UPSTREAM_PORT="${UPSTREAM_PORT:-8360}"

GENERATED_DIR="/etc/nginx/generated"
GENERATED_CERT_PATH="${GENERATED_DIR}/fullchain.pem"
GENERATED_KEY_PATH="${GENERATED_DIR}/privkey.pem"

mkdir -p "${GENERATED_DIR}"

normalize_pem_file() {
  pem_path="$1"

  # 去掉 CRLF 並確保結尾有換行，否則 cert 和 chain 接起來會黏成一行、nginx 讀不到。
  awk '
    {
      sub(/\r$/, "")
      print
      has_content = 1
    }
    END {
      if (has_content) {
        print ""
      }
    }
  ' "${pem_path}"
}

build_cert_bundle() {
  cert_path="${SSL_CERT_DIR}/${SSL_CERT_FILE_NAME}"
  chain_path="${SSL_CERT_DIR}/${SSL_CHAIN_FILE_NAME}"
  key_path="${SSL_CERT_DIR}/${SSL_KEY_FILE_NAME}"

  if [ ! -f "${cert_path}" ]; then
    echo "Missing certificate file: ${cert_path}" >&2
    exit 1
  fi

  if [ ! -f "${chain_path}" ]; then
    echo "Missing chain file: ${chain_path}" >&2
    exit 1
  fi

  if [ ! -f "${key_path}" ]; then
    echo "Missing key file: ${key_path}" >&2
    exit 1
  fi

  normalize_pem_file "${cert_path}" > "${GENERATED_CERT_PATH}"
  normalize_pem_file "${chain_path}" >> "${GENERATED_CERT_PATH}"
  cp "${key_path}" "${GENERATED_KEY_PATH}"

  # 到期日印在 log 裡，容器一起來就看得到憑證還剩多久。
  openssl x509 -in "${cert_path}" -noout -subject -enddate 2>/dev/null || true
}

write_nginx_config() {
  cat > /etc/nginx/conf.d/default.conf <<EOF
server {
    listen ${NGINX_PORT} ssl;
    server_name ${NGINX_SERVER_NAME};

    ssl_certificate ${GENERATED_CERT_PATH};
    ssl_certificate_key ${GENERATED_KEY_PATH};
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers on;

    # 影片串流：一定要關掉緩衝。開著的話 nginx 會先把整段 Range 回應寫進
    # 暫存檔再吐給瀏覽器，15 GB 的來源會把容器磁碟塞爆，拖動進度條也會卡住。
    proxy_buffering off;
    proxy_max_temp_file_size 0;

    location / {
        proxy_pass http://${UPSTREAM_HOST}:${UPSTREAM_PORT};
        proxy_http_version 1.1;
        proxy_set_header Host \$host;
        proxy_set_header X-Real-IP \$remote_addr;
        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;

        # /api/events 是 SSE，轉檔跑好幾小時期間連線要一直開著；
        # 預設 60 秒就會被切斷，進度就不會再更新了。
        proxy_read_timeout 24h;
        proxy_send_timeout 24h;
    }
}
EOF
}

watch_cert_updates() {
  while inotifywait -qq -e close_write,create,delete,move "${SSL_CERT_DIR}"; do
    echo "Certificate files changed, reloading nginx..."
    build_cert_bundle
    nginx -s reload
  done
}

build_cert_bundle
write_nginx_config
nginx -t

watch_cert_updates &
WATCHER_PID=$!

cleanup() {
  kill "${WATCHER_PID}" 2>/dev/null || true
}

trap cleanup INT TERM

nginx -g 'daemon off;' &
NGINX_PID=$!

wait "${NGINX_PID}"