#!/bin/sh

set -eu

CERT_MANAGER_VERSION=v1.21.1
CERT_MANAGER_CHART=oci://quay.io/jetstack/charts/cert-manager
PROJECT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
CREDENTIALS_FILE=${CLOUDFLARE_CREDENTIALS_FILE:-$PROJECT_DIR/cloudflare-api-credentials.yaml}

kubectl create namespace cert-manager --dry-run=client -o yaml | kubectl apply -f -

if [ -f "$CREDENTIALS_FILE" ]; then
  if grep -q 'REPLACE_WITH_' "$CREDENTIALS_FILE"; then
    echo "Refusing placeholder credentials in $CREDENTIALS_FILE" >&2
    exit 1
  fi
  kubectl apply -f "$CREDENTIALS_FILE"
elif kubectl -n cert-manager get secret cloudflare-api-token-secret >/dev/null 2>&1; then
  echo "Keeping existing cert-manager/cloudflare-api-token-secret Secret."
else
  echo "Missing $CREDENTIALS_FILE and the live Cloudflare Secret." >&2
  exit 1
fi

helm upgrade --install cert-manager "$CERT_MANAGER_CHART" \
  --version "$CERT_MANAGER_VERSION" \
  --namespace cert-manager \
  --create-namespace \
  --take-ownership \
  --force-conflicts \
  --rollback-on-failure \
  --wait \
  --timeout 10m \
  -f "$PROJECT_DIR/values.yaml"

kubectl apply -f "$PROJECT_DIR/cloudflare.yaml"
kubectl apply -f "$PROJECT_DIR/http-issuer.yaml"
kubectl wait --for=condition=Ready clusterissuer/letsencrypt-dns --timeout=120s
kubectl wait --for=condition=Ready clusterissuer/letsencrypt-http --timeout=120s

kubectl apply -f "$PROJECT_DIR/certificates.yaml"
kubectl wait --for=condition=Ready certificate/brunner-ninja --namespace default --timeout=10m
kubectl wait --for=condition=Ready certificate/watschn-studio --namespace default --timeout=10m
kubectl wait --for=condition=Ready certificate/brgkepler-com --namespace default --timeout=10m
kubectl wait --for=condition=Ready certificate/gschissenes-equipment --namespace default --timeout=10m