#!/bin/bash
# update-caddy-certs.sh
# Gehört ins Caddy-Verzeichnis (neben dem Caddyfile).
#
# Liest alle Domains aus dem DMS und generiert die Wildcard-Cert-Blöcke
# für Caddy in die Datei "mail_certs" (per "import mail_certs" im Caddyfile).
#
# Generiert pro Domain:
#   - Wildcard-Cert Block (*.domain + domain)
#   - Webmail Block (reverse_proxy zu Roundcube)
#   - Autodiscover/Autoconfig Block (importiert email_settings Snippet)
#   - Email-Setup Block (QR-Code Seite für iPhone)
#
# Bei neuen Domains: Script erneut laufen lassen + caddy reload.
#
# Usage:
#   ./update-caddy-certs.sh
#   DRY_RUN=true ./update-caddy-certs.sh
#   DMS_CONTAINER=mailserver CADDY_CONTAINER=caddy ./update-caddy-certs.sh

set -e

DMS_CONTAINER=${DMS_CONTAINER:-"mailserver"}
CADDY_CONTAINER=${CADDY_CONTAINER:-"caddy"}
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
OUTPUT_FILE="$SCRIPT_DIR/mail_certs"
DRY_RUN=${DRY_RUN:-"false"}

# Node-Hostname des Mailservers (für Default-Cert Block)
NODE_HOSTNAME=${NODE_HOSTNAME:-"node1.email-srvr.com"}

echo "============================================================"
echo " 📜 Caddy Wildcard-Cert Konfig Generator"
echo " DMS Container:   $DMS_CONTAINER"
echo " Caddy Container: $CADDY_CONTAINER"
echo " Output:          $OUTPUT_FILE"
echo " Node Hostname:   $NODE_HOSTNAME"
[ "$DRY_RUN" = "true" ] && echo " ⚠️  DRY RUN - Keine Dateien werden geschrieben"
echo "============================================================"

# --- Domains aus DMS lesen ---
echo ""
echo "📋 Lese Domains aus DMS..."
DOMAINS=$(docker exec "$DMS_CONTAINER" setup email list 2>/dev/null \
    | grep -oP '(?<=@)[^\s]+' \
    | sort -u)

if [ -z "$DOMAINS" ]; then
    echo "⚠️  Keine DMS-Accounts gefunden. Nur Node-Hostname wird eingetragen."
fi

if [ -n "$DOMAINS" ]; then
    echo "   Gefundene Domains:"
    for d in $DOMAINS; do echo "   - $d"; done
fi

# --- Konfig generieren ---
echo ""
echo "📝 Generiere Caddy-Konfiguration..."

OUTPUT=""
OUTPUT="${OUTPUT}# mail_certs - Automatisch generiert von update-caddy-certs.sh\n"
OUTPUT="${OUTPUT}# Wildcard-Zertifikate + Webmail + Autodiscover für DMS-Domains.\n"
OUTPUT="${OUTPUT}# Einbinden im Caddyfile: import mail_certs\n"
OUTPUT="${OUTPUT}# Generiert: $(date)\n"
OUTPUT="${OUTPUT}\n"

# =====================================================================
# Autodiscover/Autoconfig Snippet (dynamisch)
# {labels.1}.{labels.0} = Basisdomain aus Hostname
# =====================================================================
OUTPUT="${OUTPUT}# ═══════════════════════════════════════════════\n"
OUTPUT="${OUTPUT}# Autodiscover/Autoconfig Snippet (dynamisch)\n"
OUTPUT="${OUTPUT}# {labels.1}.{labels.0} = Basisdomain aus Hostname\n"
OUTPUT="${OUTPUT}# ═══════════════════════════════════════════════\n"
OUTPUT="${OUTPUT}(email_settings) {\n"

# --- 1. Outlook Classic Autodiscover (POST + GET XML) ---
OUTPUT="${OUTPUT}    # Outlook Autodiscover (XML) - POST und GET\n"
OUTPUT="${OUTPUT}    route /autodiscover/autodiscover.xml {\n"
OUTPUT="${OUTPUT}        header Content-Type \"application/xml\"\n"
OUTPUT="${OUTPUT}        respond \`<?xml version=\"1.0\" encoding=\"utf-8\"?>\n"
OUTPUT="${OUTPUT}<Autodiscover xmlns=\"http://schemas.microsoft.com/exchange/autodiscover/responseschema/2006\">\n"
OUTPUT="${OUTPUT}  <Response xmlns=\"http://schemas.microsoft.com/exchange/autodiscover/outlook/responseschema/2006a\">\n"
OUTPUT="${OUTPUT}    <Account>\n"
OUTPUT="${OUTPUT}      <AccountType>email</AccountType>\n"
OUTPUT="${OUTPUT}      <Action>settings</Action>\n"
OUTPUT="${OUTPUT}      <Protocol>\n"
OUTPUT="${OUTPUT}        <Type>IMAP</Type>\n"
OUTPUT="${OUTPUT}        <Server>imap.{labels.1}.{labels.0}</Server>\n"
OUTPUT="${OUTPUT}        <Port>993</Port>\n"
OUTPUT="${OUTPUT}        <DomainRequired>off</DomainRequired>\n"
OUTPUT="${OUTPUT}        <LoginName></LoginName>\n"
OUTPUT="${OUTPUT}        <SPA>off</SPA>\n"
OUTPUT="${OUTPUT}        <SSL>on</SSL>\n"
OUTPUT="${OUTPUT}        <AuthRequired>on</AuthRequired>\n"
OUTPUT="${OUTPUT}      </Protocol>\n"
OUTPUT="${OUTPUT}      <Protocol>\n"
OUTPUT="${OUTPUT}        <Type>SMTP</Type>\n"
OUTPUT="${OUTPUT}        <Server>smtp.{labels.1}.{labels.0}</Server>\n"
OUTPUT="${OUTPUT}        <Port>465</Port>\n"
OUTPUT="${OUTPUT}        <DomainRequired>off</DomainRequired>\n"
OUTPUT="${OUTPUT}        <LoginName></LoginName>\n"
OUTPUT="${OUTPUT}        <SPA>off</SPA>\n"
OUTPUT="${OUTPUT}        <SSL>on</SSL>\n"
OUTPUT="${OUTPUT}        <AuthRequired>on</AuthRequired>\n"
OUTPUT="${OUTPUT}      </Protocol>\n"
OUTPUT="${OUTPUT}    </Account>\n"
OUTPUT="${OUTPUT}  </Response>\n"
OUTPUT="${OUTPUT}</Autodiscover>\` 200\n"
OUTPUT="${OUTPUT}    }\n"
OUTPUT="${OUTPUT}\n"

# --- 2. Outlook New / Microsoft 365 (JSON v2) ---
# Outlook New sendet GET auf /autodiscover/autodiscover.json?Protocol=AutodiscoverV1&...
# Antwort muss den XML-Endpoint zurückgeben
OUTPUT="${OUTPUT}    # Outlook New/365 (JSON → Redirect zu XML)\n"
OUTPUT="${OUTPUT}    route /autodiscover/autodiscover.json {\n"
OUTPUT="${OUTPUT}        header Content-Type \"application/json\"\n"
OUTPUT="${OUTPUT}        respond \`{\"Protocol\":\"AutodiscoverV1\",\"Url\":\"https://autodiscover.{labels.1}.{labels.0}/autodiscover/autodiscover.xml\"}\` 200\n"
OUTPUT="${OUTPUT}    }\n"
OUTPUT="${OUTPUT}\n"

# --- 3. Thunderbird Autoconfig ---
OUTPUT="${OUTPUT}    # Thunderbird Autoconfig\n"
OUTPUT="${OUTPUT}    route /mail/config-v1.1.xml {\n"
OUTPUT="${OUTPUT}        header Content-Type \"application/xml\"\n"
OUTPUT="${OUTPUT}        respond \`<?xml version=\"1.0\"?>\n"
OUTPUT="${OUTPUT}<clientConfig version=\"1.1\">\n"
OUTPUT="${OUTPUT}  <emailProvider id=\"{labels.1}.{labels.0}\">\n"
OUTPUT="${OUTPUT}    <displayName>{labels.1}.{labels.0} Mail</displayName>\n"
OUTPUT="${OUTPUT}    <domain>{labels.1}.{labels.0}</domain>\n"
OUTPUT="${OUTPUT}    <incomingServer type=\"imap\">\n"
OUTPUT="${OUTPUT}      <hostname>imap.{labels.1}.{labels.0}</hostname>\n"
OUTPUT="${OUTPUT}      <port>993</port>\n"
OUTPUT="${OUTPUT}      <socketType>SSL</socketType>\n"
OUTPUT="${OUTPUT}      <authentication>password-cleartext</authentication>\n"
OUTPUT="${OUTPUT}      <username>%%EMAILADDRESS%%</username>\n"
OUTPUT="${OUTPUT}    </incomingServer>\n"
OUTPUT="${OUTPUT}    <outgoingServer type=\"smtp\">\n"
OUTPUT="${OUTPUT}      <hostname>smtp.{labels.1}.{labels.0}</hostname>\n"
OUTPUT="${OUTPUT}      <port>465</port>\n"
OUTPUT="${OUTPUT}      <socketType>SSL</socketType>\n"
OUTPUT="${OUTPUT}      <authentication>password-cleartext</authentication>\n"
OUTPUT="${OUTPUT}      <username>%%EMAILADDRESS%%</username>\n"
OUTPUT="${OUTPUT}    </outgoingServer>\n"
OUTPUT="${OUTPUT}  </emailProvider>\n"
OUTPUT="${OUTPUT}</clientConfig>\` 200\n"
OUTPUT="${OUTPUT}    }\n"
OUTPUT="${OUTPUT}\n"

# --- 4. Apple MobileConfig (inline, wie Autodiscover/Autoconfig) ---
OUTPUT="${OUTPUT}    # Apple MobileConfig (inline respond)\n"
OUTPUT="${OUTPUT}    route /apple {\n"
OUTPUT="${OUTPUT}        header Content-Type \"application/x-apple-aspen-config; charset=utf-8\"\n"
OUTPUT="${OUTPUT}        header Content-Disposition \"attachment; filename=email.mobileconfig\"\n"
OUTPUT="${OUTPUT}        respond \`<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n"
OUTPUT="${OUTPUT}<!DOCTYPE plist PUBLIC \"-//Apple//DTD PLIST 1.0//EN\" \"http://www.apple.com/DTDs/PropertyList-1.0.dtd\">\n"
OUTPUT="${OUTPUT}<plist version=\"1.0\">\n"
OUTPUT="${OUTPUT}<dict>\n"
OUTPUT="${OUTPUT}    <key>PayloadContent</key>\n"
OUTPUT="${OUTPUT}    <array>\n"
OUTPUT="${OUTPUT}        <dict>\n"
OUTPUT="${OUTPUT}            <key>EmailAccountDescription</key>\n"
OUTPUT="${OUTPUT}            <string>{query.email}</string>\n"
OUTPUT="${OUTPUT}            <key>EmailAccountName</key>\n"
OUTPUT="${OUTPUT}            <string>{query.email}</string>\n"
OUTPUT="${OUTPUT}            <key>EmailAccountType</key>\n"
OUTPUT="${OUTPUT}            <string>EmailTypeIMAP</string>\n"
OUTPUT="${OUTPUT}            <key>EmailAddress</key>\n"
OUTPUT="${OUTPUT}            <string>{query.email}</string>\n"
OUTPUT="${OUTPUT}            <key>IncomingMailServerAuthentication</key>\n"
OUTPUT="${OUTPUT}            <string>EmailAuthPassword</string>\n"
OUTPUT="${OUTPUT}            <key>IncomingMailServerHostName</key>\n"
OUTPUT="${OUTPUT}            <string>imap.{labels.1}.{labels.0}</string>\n"
OUTPUT="${OUTPUT}            <key>IncomingMailServerPortNumber</key>\n"
OUTPUT="${OUTPUT}            <integer>993</integer>\n"
OUTPUT="${OUTPUT}            <key>IncomingMailServerUseSSL</key>\n"
OUTPUT="${OUTPUT}            <true/>\n"
OUTPUT="${OUTPUT}            <key>IncomingMailServerUsername</key>\n"
OUTPUT="${OUTPUT}            <string>{query.email}</string>\n"
OUTPUT="${OUTPUT}            <key>OutgoingMailServerAuthentication</key>\n"
OUTPUT="${OUTPUT}            <string>EmailAuthPassword</string>\n"
OUTPUT="${OUTPUT}            <key>OutgoingMailServerHostName</key>\n"
OUTPUT="${OUTPUT}            <string>smtp.{labels.1}.{labels.0}</string>\n"
OUTPUT="${OUTPUT}            <key>OutgoingMailServerPortNumber</key>\n"
OUTPUT="${OUTPUT}            <integer>465</integer>\n"
OUTPUT="${OUTPUT}            <key>OutgoingMailServerUseSSL</key>\n"
OUTPUT="${OUTPUT}            <true/>\n"
OUTPUT="${OUTPUT}            <key>OutgoingMailServerUsername</key>\n"
OUTPUT="${OUTPUT}            <string>{query.email}</string>\n"
OUTPUT="${OUTPUT}            <key>OutgoingPasswordRequired</key>\n"
OUTPUT="${OUTPUT}            <true/>\n"
OUTPUT="${OUTPUT}            <key>PayloadDescription</key>\n"
OUTPUT="${OUTPUT}            <string>E-Mail Konfiguration</string>\n"
OUTPUT="${OUTPUT}            <key>PayloadDisplayName</key>\n"
OUTPUT="${OUTPUT}            <string>{labels.1}.{labels.0} E-Mail</string>\n"
OUTPUT="${OUTPUT}            <key>PayloadIdentifier</key>\n"
OUTPUT="${OUTPUT}            <string>com.{labels.1}.{labels.0}.email.account</string>\n"
OUTPUT="${OUTPUT}            <key>PayloadType</key>\n"
OUTPUT="${OUTPUT}            <string>com.apple.mail.managed</string>\n"
OUTPUT="${OUTPUT}            <key>PayloadUUID</key>\n"
OUTPUT="${OUTPUT}            <string>A1B2C3D4-E5F6-7890-ABCD-EF1234567890</string>\n"
OUTPUT="${OUTPUT}            <key>PayloadVersion</key>\n"
OUTPUT="${OUTPUT}            <integer>1</integer>\n"
OUTPUT="${OUTPUT}        </dict>\n"
OUTPUT="${OUTPUT}    </array>\n"
OUTPUT="${OUTPUT}    <key>PayloadDescription</key>\n"
OUTPUT="${OUTPUT}    <string>E-Mail Einrichtung</string>\n"
OUTPUT="${OUTPUT}    <key>PayloadDisplayName</key>\n"
OUTPUT="${OUTPUT}    <string>{labels.1}.{labels.0} E-Mail</string>\n"
OUTPUT="${OUTPUT}    <key>PayloadIdentifier</key>\n"
OUTPUT="${OUTPUT}    <string>com.{labels.1}.{labels.0}.email.profile</string>\n"
OUTPUT="${OUTPUT}    <key>PayloadOrganization</key>\n"
OUTPUT="${OUTPUT}    <string>Bay Area Affiliates, Inc.</string>\n"
OUTPUT="${OUTPUT}    <key>PayloadRemovalDisallowed</key>\n"
OUTPUT="${OUTPUT}    <false/>\n"
OUTPUT="${OUTPUT}    <key>PayloadType</key>\n"
OUTPUT="${OUTPUT}    <string>Configuration</string>\n"
OUTPUT="${OUTPUT}    <key>PayloadUUID</key>\n"
OUTPUT="${OUTPUT}    <string>F0E1D2C3-B4A5-6789-0FED-CBA987654321</string>\n"
OUTPUT="${OUTPUT}    <key>PayloadVersion</key>\n"
OUTPUT="${OUTPUT}    <integer>1</integer>\n"
OUTPUT="${OUTPUT}</dict>\n"
OUTPUT="${OUTPUT}</plist>\` 200\n"
OUTPUT="${OUTPUT}    }\n"

# --- 5. Samsung Email (nutzt ebenfalls autoconfig, kein extra Block nötig) ---
# Samsung Email-App versucht:
#   1. https://autoconfig.<domain>/mail/config-v1.1.xml (= Thunderbird-Format, schon abgedeckt)
#   2. Alternativ: Outlook Autodiscover XML
# → Kein separater Block erforderlich.

OUTPUT="${OUTPUT}}\n\n"

# =====================================================================
# Email-Setup Snippet (QR-Code Seite für iPhone)
# =====================================================================
OUTPUT="${OUTPUT}# ═══════════════════════════════════════════════\n"
OUTPUT="${OUTPUT}# Email-Setup Snippet (QR-Code Seite)\n"
OUTPUT="${OUTPUT}# ═══════════════════════════════════════════════\n"
OUTPUT="${OUTPUT}(email_setup_page) {\n"
OUTPUT="${OUTPUT}    route /email-setup* {\n"
OUTPUT="${OUTPUT}        uri strip_prefix /email-setup\n"
OUTPUT="${OUTPUT}        root * /var/www/email-setup\n"
OUTPUT="${OUTPUT}        try_files {path} /setup.html\n"
OUTPUT="${OUTPUT}        file_server\n"
OUTPUT="${OUTPUT}    }\n"
OUTPUT="${OUTPUT}}\n\n"

# Node-Hostname immer als erstes (Default-Cert des DMS)
echo "   → Node-Hostname Block: $NODE_HOSTNAME"
OUTPUT="${OUTPUT}# Node-Hostname (Default-Cert für DMS Fallback)\n"
OUTPUT="${OUTPUT}${NODE_HOSTNAME} {\n"
OUTPUT="${OUTPUT}    tls {\n"
OUTPUT="${OUTPUT}        dns cloudflare {env.CLOUDFLARE_API_TOKEN}\n"
OUTPUT="${OUTPUT}    }\n"
OUTPUT="${OUTPUT}    respond \"OK\" 200\n"
OUTPUT="${OUTPUT}}\n\n"

# Wildcard-Blocks + Webmail + Autodiscover pro Kundendomain
for domain in $DOMAINS; do
    echo "   → Wildcard Block:     *.${domain}"
    echo "   → Webmail Block:      webmail.${domain}"
    echo "   → Autodiscover Block: autodiscover.${domain}, autoconfig.${domain}"
    echo "   → Email-Setup Block:  webmail.${domain}/email-setup"

    # Wildcard-Cert Block (für Cert-Generierung + Fallback)
    OUTPUT="${OUTPUT}# ═══════════════════════════════════════════════\n"
    OUTPUT="${OUTPUT}# ${domain}\n"
    OUTPUT="${OUTPUT}# ═══════════════════════════════════════════════\n\n"

    OUTPUT="${OUTPUT}# Wildcard-Cert für $domain\n"
    OUTPUT="${OUTPUT}*.${domain}, ${domain} {\n"
    OUTPUT="${OUTPUT}    tls {\n"
    OUTPUT="${OUTPUT}        dns cloudflare {env.CLOUDFLARE_API_TOKEN}\n"
    OUTPUT="${OUTPUT}    }\n"
    OUTPUT="${OUTPUT}    respond \"OK\" 200\n"
    OUTPUT="${OUTPUT}}\n\n"

    # Webmail Block (Roundcube + Email-Setup)
    OUTPUT="${OUTPUT}# Roundcube Webmail + Email-Setup für $domain\n"
    OUTPUT="${OUTPUT}webmail.${domain} {\n"
    OUTPUT="${OUTPUT}    import email_setup_page\n"
    OUTPUT="${OUTPUT}    reverse_proxy roundcube:80\n"
    OUTPUT="${OUTPUT}    encode gzip\n"
    OUTPUT="${OUTPUT}    log {\n"
    OUTPUT="${OUTPUT}        output stderr\n"
    OUTPUT="${OUTPUT}        format console\n"
    OUTPUT="${OUTPUT}    }\n"
    OUTPUT="${OUTPUT}}\n\n"

    # Autodiscover / Autoconfig Block
    OUTPUT="${OUTPUT}# Autodiscover/Autoconfig für $domain\n"
    OUTPUT="${OUTPUT}autodiscover.${domain}, autoconfig.${domain} {\n"
    OUTPUT="${OUTPUT}    import email_settings\n"
    OUTPUT="${OUTPUT}    respond \"Autodiscover Service Online\" 200\n"
    OUTPUT="${OUTPUT}}\n\n"
done

# --- Ausgabe ---
if [ "$DRY_RUN" = "true" ]; then
    echo ""
    echo "--- VORSCHAU ---"
    printf '%b' "$OUTPUT"
    echo "--- ENDE ---"
else
    printf '%b' "$OUTPUT" > "$OUTPUT_FILE"
    echo "   ✅ Geschrieben: $OUTPUT_FILE"
fi

# --- Import im Caddyfile prüfen ---
CADDYFILE="$SCRIPT_DIR/Caddyfile"
if [ -f "$CADDYFILE" ]; then
    if grep -q "import mail_certs" "$CADDYFILE"; then
        echo "   ✅ 'import mail_certs' bereits im Caddyfile vorhanden."
    else
        echo ""
        echo "⚠️  AKTION: 'import mail_certs' fehlt noch im Caddyfile!"
        echo "   Bitte nach dem globalen {} Block eintragen:"
        echo ""
        echo "   {                              ← globaler Block"
        echo "       email {env.CLOUDFLARE_EMAIL}"
        echo "       ..."
        echo "   }"
        echo "   import mail_certs             ← hier einfügen"
    fi

    # Prüfe ob alte email_autodiscover Referenz entfernt werden kann
    if grep -q "import email_autodiscover" "$CADDYFILE"; then
        echo ""
        echo "⚠️  AUFRÄUMEN: 'import email_autodiscover' im Caddyfile gefunden!"
        echo "   Das Snippet (email_settings) ist jetzt in mail_certs eingebettet."
        echo "   Bitte 'import email_autodiscover' aus dem Caddyfile entfernen."
    fi
fi

# --- Prüfe ob alte Dateien noch existieren ---
if [ -f "$SCRIPT_DIR/email_autodiscover" ]; then
    echo ""
    echo "⚠️  AUFRÄUMEN: Datei 'email_autodiscover' kann entfernt werden!"
    echo "   Das Snippet ist jetzt in mail_certs eingebettet."
fi

if [ -f "$SCRIPT_DIR/email-setup/autodiscover.xml" ]; then
    echo ""
    echo "⚠️  AUFRÄUMEN: 'email-setup/autodiscover.xml' kann entfernt werden!"
    echo "   Statische XML wird nicht mehr benötigt (dynamisch über Caddy)."
fi

echo ""
echo "============================================================"
echo "🔄 Nächste Schritte:"
echo ""
echo "1. Caddy Konfiguration validieren:"
echo "   docker exec $CADDY_CONTAINER caddy validate --config /etc/caddy/Caddyfile"
echo ""
echo "2. Caddy neu laden (kein Downtime):"
echo "   docker exec $CADDY_CONTAINER caddy reload --config /etc/caddy/Caddyfile"
echo ""
echo "3. Cert-Generierung verfolgen (~30s pro Domain):"
echo "   docker logs -f $CADDY_CONTAINER 2>&1 | grep -i 'certificate\|acme\|tls\|error'"
echo ""
echo "4. Autodiscover testen:"
for domain in $DOMAINS; do
    echo "   # Thunderbird:"
    echo "   curl -s https://autoconfig.${domain}/mail/config-v1.1.xml | head -10"
    echo "   # Outlook:"
    echo "   curl -s https://autodiscover.${domain}/autodiscover/autodiscover.xml | head -10"
    echo "   # Apple (sollte .mobileconfig liefern):"
    echo "   curl -sI \"https://autodiscover.${domain}/apple?email=test@${domain}\""
    echo ""
done
echo "5. iPhone Email-Setup QR-Code Seite:"
for domain in $DOMAINS; do
    echo "   https://webmail.${domain}/email-setup"
done
echo "============================================================"