#!/bin/bash

# -----------------------------
# Zimbra SSL Renewal Script with Zimbra Cert Check
# -----------------------------
# Usage: /usr/bin/sh renew_zimbra_cert.sh --domain=mailus.telxio.net
# -----------------------------

DOMAIN="${1#--domain=}"

if [ -z "$DOMAIN" ]; then
  echo "Error: No domain provided. Usage: $0 --domain=yourdomain.com"
  exit 1
fi

current_time=$(date +"%Y-%m-%d %H:%M:%S")
echo -e "\n------- $current_time -------- Renewing Zimbra domain: $DOMAIN --------\n"

CERT_PATH="/etc/letsencrypt/live/$DOMAIN/fullchain.pem"
PRIVKEY_PATH="/etc/letsencrypt/live/$DOMAIN/privkey.pem"
CHAIN_PATH="/etc/letsencrypt/live/$DOMAIN/chain.pem"
ZIMBRA_COMM_CERT="/opt/zimbra/ssl/zimbra/commercial/commercial.crt"
ZIMBRA_COMM_KEY="/opt/zimbra/ssl/zimbra/commercial/commercial.key"



# -----------------------------
# Check if Zimbra certificate exists and expiry
# -----------------------------
if [ -f "$ZIMBRA_COMM_CERT" ]; then
  ZIMBRA_REMAINING_DAYS=$(openssl x509 -enddate -noout -in "$ZIMBRA_COMM_CERT" | sed 's/.*=\(.*\)/\1/' | xargs -I {} date -d {} +%s)
  CURRENT_DATE=$(date +%s)
  ZIMBRA_DAYS_LEFT=$(( ($ZIMBRA_REMAINING_DAYS - $CURRENT_DATE) / 86400 ))
  echo "Zimbra commercial certificate days left: $ZIMBRA_DAYS_LEFT"

  # Step 1: If Zimbra cert is valid for more than 10 days, skip renewal
  if [ $ZIMBRA_DAYS_LEFT -ge 10 ]; then
    echo "Zimbra certificate is valid for more than 10 days. No renewal needed."
    exit 0
  fi
else
  echo "Zimbra commercial certificate not found or expired."
  ZIMBRA_DAYS_LEFT=0
fi

# -----------------------------
# Check certificate expiry for Certbot domain cert
# -----------------------------
if [ ! -f "$CERT_PATH" ] || [ ! -f "$PRIVKEY_PATH" ]; then
  echo "Certbot certificate files not found. Will proceed with renewal..."
  DOMAIN_CERT_EXPIRE=0
else
  DOMAIN_REMAINING_DAYS=$(openssl x509 -enddate -noout -in "$CERT_PATH" | sed 's/.*=\(.*\)/\1/' | xargs -I {} date -d {} +%s)
  CURRENT_DATE=$(date +%s)
  DOMAIN_CERT_EXPIRE=$(( ($DOMAIN_REMAINING_DAYS - $CURRENT_DATE) / 86400 ))
  echo "Certbot certificate days left: $DOMAIN_CERT_EXPIRE"
fi

# Step 2: If Certbot cert is valid for more than 10 days, skip renewal
if [ $DOMAIN_CERT_EXPIRE -ge 10 ]; then
  echo "Certbot certificate is valid for more than 10 days. Skipping renewal."
else
  # Step 3: Renew Certbot certificate
  echo "Certbot certificate is expiring or missing. Proceeding with renewal..."

  # Temporarily open port 80 for HTTP-01 challenge
  echo "Opening port 80 for Certbot validation..."
  iptables -I INPUT 1 -p tcp --dport 80 -j ACCEPT

  echo "Renewing certificate using Certbot..."
  certbot renew --cert-name "$DOMAIN" --preferred-challenges http --force-renewal

  if [ $? -ne 0 ]; then
    echo "Certbot renewal failed. Please check logs."
    iptables -D INPUT 1
    exit 1
  fi

  echo "Certificate renewed successfully."

  # Close temporary port 80
  echo "Removing temporary iptables rule..."
  iptables -D INPUT 1
fi

# -----------------------------
# Backup old Zimbra SSL folder
# -----------------------------
ZIMBRA_LE_DIR="/opt/zimbra/ssl/letsencrypt"
BACKUP_DIR="${ZIMBRA_LE_DIR}.$(date '+%Y%m%d%H%M%S')"

echo "Backing up existing Zimbra letsencrypt folder to $BACKUP_DIR"
if [ -d "$ZIMBRA_LE_DIR" ]; then
  mv "$ZIMBRA_LE_DIR" "$BACKUP_DIR"
fi

mkdir -p "$ZIMBRA_LE_DIR"

# -----------------------------
# Copy renewed certs to Zimbra folder
# -----------------------------
echo "Copying renewed certificates to $ZIMBRA_LE_DIR"
cp "$CERT_PATH" "$ZIMBRA_LE_DIR/cert.pem"
cp "$PRIVKEY_PATH" "$ZIMBRA_LE_DIR/privkey.pem"
cp "$CHAIN_PATH" "$ZIMBRA_LE_DIR/chain.pem"

# Create zimbra_chain.pem combining cert + chain
cat "$CHAIN_PATH" | tee "$ZIMBRA_LE_DIR/zimbra_chain.pem"

# -----------------------------
# Create zimbra_chain.pem with static root certificate
# -----------------------------
tee -a "$ZIMBRA_LE_DIR/zimbra_chain.pem"<<EOF
-----BEGIN CERTIFICATE-----
MIIFazCCA1OgAwIBAgIRAIIQz7DSQONZRGPgu2OCiwAwDQYJKoZIhvcNAQELBQAw
TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh
cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMTUwNjA0MTEwNDM4
WhcNMzUwNjA0MTEwNDM4WjBPMQswCQYDVQQGEwJVUzEpMCcGA1UEChMgSW50ZXJu
ZXQgU2VjdXJpdHkgUmVzZWFyY2ggR3JvdXAxFTATBgNVBAMTDElTUkcgUm9vdCBY
MTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAK3oJHP0FDfzm54rVygc
h77ct984kIxuPOZXoHj3dcKi/vVqbvYATyjb3miGbESTtrFj/RQSa78f0uoxmyF+
0TM8ukj13Xnfs7j/EvEhmkvBioZxaUpmZmyPfjxwv60pIgbz5MDmgK7iS4+3mX6U
A5/TR5d8mUgjU+g4rk8Kb4Mu0UlXjIB0ttov0DiNewNwIRt18jA8+o+u3dpjq+sW
T8KOEUt+zwvo/7V3LvSye0rgTBIlDHCNAymg4VMk7BPZ7hm/ELNKjD+Jo2FR3qyH
B5T0Y3HsLuJvW5iB4YlcNHlsdu87kGJ55tukmi8mxdAQ4Q7e2RCOFvu396j3x+UC
B5iPNgiV5+I3lg02dZ77DnKxHZu8A/lJBdiB3QW0KtZB6awBdpUKD9jf1b0SHzUv
KBds0pjBqAlkd25HN7rOrFleaJ1/ctaJxQZBKT5ZPt0m9STJEadao0xAH0ahmbWn
OlFuhjuefXKnEgV4We0+UXgVCwOPjdAvBbI+e0ocS3MFEvzG6uBQE3xDk3SzynTn
jh8BCNAw1FtxNrQHusEwMFxIt4I7mKZ9YIqioymCzLq9gwQbooMDQaHWBfEbwrbw
qHyGO0aoSCqI3Haadr8faqU9GY/rOPNk3sgrDQoo//fb4hVC1CLQJ13hef4Y53CI
rU7m2Ys6xt0nUW7/vGT1M0NPAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNV
HRMBAf8EBTADAQH/MB0GA1UdDgQWBBR5tFnme7bl5AFzgAiIyBpY9umbbjANBgkq
hkiG9w0BAQsFAAOCAgEAVR9YqbyyqFDQDLHYGmkgJykIrGF1XIpu+ILlaS/V9lZL
ubhzEFnTIZd+50xx+7LSYK05qAvqFyFWhfFQDlnrzuBZ6brJFe+GnY+EgPbk6ZGQ
3BebYhtF8GaV0nxvwuo77x/Py9auJ/GpsMiu/X1+mvoiBOv/2X/qkSsisRcOj/KK
NFtY2PwByVS5uCbMiogziUwthDyC3+6WVwW6LLv3xLfHTjuCvjHIInNzktHCgKQ5
ORAzI4JMPJ+GslWYHb4phowim57iaztXOoJwTdwJx4nLCgdNbOhdjsnvzqvHu7Ur
TkXWStAmzOVyyghqpZXjFaH3pO3JLF+l+/+sKAIuvtd7u+Nxe5AW0wdeRlN8NwdC
jNPElpzVmbUq4JUagEiuTDkHzsxHpFKVK7q4+63SM1N95R1NbdWhscdCb+ZAJzVc
oyi3B43njTOQ5yOf+1CceWxG1bQVs5ZufpsMljq4Ui0/1lvh+wjChP4kqKOJ2qxq
4RgqsahDYVvTH9w7jXbyLeiNdd8XM2w9U/t7y0Ff/9yi0GE44Za4rF2LN9d11TPA
mRGunUHBcnWEvgJBQl9nJEiU0Zsnvgc/ubhPgXRR4Xq37Z0j4r7g1SgEEzwxA57d
emyPxgcYxn/eR44/KJ4EBs+lVDR3veyJm+kXQ99b21/+jh5Xos1AnX5iItreGCc=
-----END CERTIFICATE-----
EOF

# Set proper ownership
chown -R zimbra:zimbra "$ZIMBRA_LE_DIR"

# -----------------------------
# Verify the certificate
# -----------------------------
echo "Verifying certificate using zmcertmgr..."
sudo su - zimbra -c "/opt/zimbra/bin/zmcertmgr verifycrt comm \
    $ZIMBRA_LE_DIR/privkey.pem \
    $ZIMBRA_LE_DIR/cert.pem \
    $ZIMBRA_LE_DIR/zimbra_chain.pem"

if [ $? -ne 0 ]; then
  echo "Certificate verification failed."
  exit 1
fi

# -----------------------------
# Backup old commercial cert
# -----------------------------
ZIMBRA_COMM_DIR="/opt/zimbra/ssl/zimbra"
COMM_BACKUP_DIR="${ZIMBRA_COMM_DIR}.$(date '+%Y%m%d%H%M%S')"
echo "Backing up old commercial cert to $COMM_BACKUP_DIR"
cp -a "$ZIMBRA_COMM_DIR" "$COMM_BACKUP_DIR"

# -----------------------------
# Deploy new certificate
# -----------------------------
echo "Copying private key for deployment..."
cp "$ZIMBRA_LE_DIR/privkey.pem" "$ZIMBRA_COMM_DIR/commercial/commercial.key"
chown zimbra:zimbra "$ZIMBRA_COMM_DIR/commercial/commercial.key"

echo "Deploying new certificate..."
sudo su - zimbra -c "/opt/zimbra/bin/zmcertmgr deploycrt comm \
    $ZIMBRA_LE_DIR/cert.pem \
    $ZIMBRA_LE_DIR/zimbra_chain.pem"

# -----------------------------
# Restart Zimbra
# -----------------------------
echo "Restarting Zimbra services..."
sudo su - zimbra -c "zmcontrol restart"

echo -e "\n------- $current_time -------- Renewal completed for $DOMAIN --------\n"