#!/bin/bash
set -euo pipefail
[[ $(id -u) == 0 ]] || exit 1
cd "$(dirname "$0")"
test -s /etc/dpl-letsencrypt/live/c2.deeplink-subscribe.com/fullchain.pem
docker image inspect sha256:d8807a5b2442bc25ce4fbc1312354b9dcbb0f538d75181ef735f4ea980760e70 >/dev/null
docker image inspect sha256:31ff8ea3e8f958a835edbd1579709017da75b742ff3a5984ea59d12ea0775577 >/dev/null
install -d -m 755 /var/lib/dpl-sgw
install -d -m 755 /var/lib/dpl-sgw/acme /var/lib/dpl-sgw/ssl
ln -sfn /etc/dpl-letsencrypt/live/c2.deeplink-subscribe.com/fullchain.pem /var/lib/dpl-sgw/ssl/cert.pem
ln -sfn /etc/dpl-letsencrypt/live/c2.deeplink-subscribe.com/privkey.pem /var/lib/dpl-sgw/ssl/key.pem
if [[ ! -e /var/lib/dpl-sgw/admin.env ]]; then
    umask 077
    printf 'ADMIN_USER=dpl-admin\nADMIN_PASS=%s\nV2B_BACKEND=https://dp-link.net\nV2B_HOST=dp-link.net\n' "$(openssl rand -hex 24)" > /var/lib/dpl-sgw/admin.env
fi
docker volume create dpl_sgw_config >/dev/null
config_dir=$(docker volume inspect -f '{{.Mountpoint}}' dpl_sgw_config)
# Only the new volume. Allow the documented jump host for acceptance checks.
if [[ ! -f "$config_dir/whitelist_ips.txt" ]]; then
    printf '104.168.30.40\n' > "$config_dir/whitelist_ips.txt"
fi
chmod 755 renew-gateway.sh
docker compose -f gateway.compose.yml config --quiet
docker compose -f gateway.compose.yml up -d
install -m 644 dpl-gateway-cert.service dpl-gateway-cert.timer /etc/systemd/system/
install -m 644 dpl-cloudflare-ips.service dpl-cloudflare-ips.timer /etc/systemd/system/
python3 update-cloudflare-ips.py
systemctl daemon-reload
systemctl enable --now dpl-gateway-cert.timer
systemctl enable --now dpl-cloudflare-ips.timer
echo 'New gateway started; verify initialization before enabling the HTTPS host site.'