#!/usr/bin/env bash
set -euo pipefail

script_dir=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
# shellcheck source=scripts/cluster/common.sh
source "$script_dir/common.sh"
load_cluster_env

public_key=$(cluster_ssh "$CLUSTER_NINGBO_HOST" 'bash -s' <<'REMOTE'
set -euo pipefail
install -d -m 0700 /root/.ssh
if [[ ! -f /root/.ssh/id_ed25519_easyai_cert_sync ]]; then
  ssh-keygen -q -t ed25519 -N '' -f /root/.ssh/id_ed25519_easyai_cert_sync
fi
cat /root/.ssh/id_ed25519_easyai_cert_sync.pub
REMOTE
)
[[ $public_key == ssh-ed25519\ * ]] || {
  echo 'invalid certificate sync public key' >&2
  exit 1
}
cluster_ssh "$CLUSTER_HONGKONG_HOST" bash -s -- "$public_key" <<'REMOTE'
set -euo pipefail
public_key=$1
install -d -m 0700 /root/.ssh
touch /root/.ssh/authorized_keys
chmod 0600 /root/.ssh/authorized_keys
grep -Fqx "$public_key" /root/.ssh/authorized_keys || printf '%s\n' "$public_key" >>/root/.ssh/authorized_keys
REMOTE

cluster_scp "$script_dir/sync-nginx-certificate.sh" \
  "$CLUSTER_NINGBO_HOST:/usr/local/sbin/easyai-sync-nginx-certificate"
cluster_ssh "$CLUSTER_NINGBO_HOST" 'bash -s' <<'REMOTE'
set -euo pipefail
chmod 0750 /usr/local/sbin/easyai-sync-nginx-certificate
install -d -m 0755 /etc/letsencrypt/renewal-hooks/deploy
ln -sfn /usr/local/sbin/easyai-sync-nginx-certificate \
  /etc/letsencrypt/renewal-hooks/deploy/easyai-sync-nginx-certificate
/usr/local/sbin/easyai-sync-nginx-certificate
REMOTE
echo 'certificate_sync_install=PASS'