#!/usr/bin/env python3
"""Move only the newly issued DPL certificate out of the old global renewal hooks."""
import pathlib
import shutil

domain = "c2.deeplink-subscribe.com"
old = pathlib.Path("/etc/letsencrypt")
new = pathlib.Path("/etc/dpl-letsencrypt")
renewal = old / "renewal" / (domain + ".conf")
if not renewal.exists():
    assert (new / "renewal" / (domain + ".conf")).exists(), "No DPL renewal registration"
    print("DPL certificate already isolated")
    raise SystemExit
text = renewal.read_text()
assert "authenticator = webroot" in text
assert "https://acme-v02.api.letsencrypt.org/directory" in text
account = next(line.split("=", 1)[1].strip() for line in text.splitlines() if line.startswith("account ="))
assert account.isalnum()
new.mkdir(mode=0o700, exist_ok=True)
for folder in ("live", "archive", "renewal", "accounts"):
    (new / folder).mkdir(mode=0o700, exist_ok=True)
for folder in ("live", "archive"):
    assert (old / folder / domain).is_dir()
    assert not (new / folder / domain).exists(), "Partial migration; inspect before retry"
account_relative = pathlib.Path("accounts/acme-v02.api.letsencrypt.org/directory") / account
shutil.copytree(old / account_relative, new / account_relative, dirs_exist_ok=True)
backup = pathlib.Path("/root/codex-backups/dpl-gateway-20261011/certificate-before-isolation")
backup.mkdir(mode=0o700, exist_ok=True)
shutil.copy2(renewal, backup / renewal.name)
for folder in ("live", "archive"):
    shutil.move(str(old / folder / domain), str(new / folder / domain))
(new / "renewal" / renewal.name).write_text(text.replace("/etc/letsencrypt/", "/etc/dpl-letsencrypt/"))
(new / "renewal" / renewal.name).chmod(0o600)
renewal.unlink()  # Only the new DPL registration; old certificates and hooks stay intact.
assert (new / "live" / domain / "fullchain.pem").is_file()
print("DPL certificate isolated from original gateway renewal hooks")