#!/usr/bin/env python3
"""Fix ntfy HTTPS nginx + verify push endpoint."""
from __future__ import annotations

import os
import sys
from pathlib import Path

import paramiko

from load_dev_env import ssh_config

HOST, USER, SSH_PASSWORD = ssh_config()


NGINX_DIR = "/www/server/panel/vhost/nginx"
WEBROOT = "/www/wwwroot/www.nomadro.cn"
ROOT = Path(__file__).resolve().parent.parent


def run(c: paramiko.SSHClient, cmd: str, timeout: int = 120) -> None:
    print(f"\n$ {cmd.replace(PASSWORD, '***')}")
    _, o, e = c.exec_command(f"echo '{PASSWORD}' | sudo -S bash -lc \"{cmd}\"", timeout=timeout, get_pty=True)
    sys.stdout.buffer.write(o.read())
    sys.stdout.buffer.write(e.read())


def main() -> None:
    c = paramiko.SSHClient()
    c.set_missing_host_key_policy(paramiko.AutoAddPolicy())
    c.connect(HOST, username=USER, password=PASSWORD, timeout=30)
    try:
        # HTTP temp for certbot if needed
        http_only = f"""server {{
    listen 80;
    server_name ntfy.nomadro.cn;
    root {WEBROOT};
    location ^~ /.well-known/acme-challenge/ {{
        allow all;
        root {WEBROOT};
    }}
    location / {{
        proxy_pass http://127.0.0.1:9180;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
    }}
}}
"""
        sftp = c.open_sftp()
        with sftp.file("/tmp/ntfy.http.conf", "w") as f:
            f.write(http_only)
        sftp.put(str(ROOT / "docker" / "integrations" / "nginx" / "ntfy.nomadro.cn.conf"), "/tmp/ntfy.https.conf")
        sftp.close()

        run(c, f"cp /tmp/ntfy.http.conf {NGINX_DIR}/ntfy.nomadro.cn.conf")
        run(c, "nginx -t && nginx -s reload")

        run(
            c,
            f"certbot certonly --webroot -w {WEBROOT} -d ntfy.nomadro.cn "
            f"--non-interactive --agree-tos -m xiaoshuang.eric@gmail.com || true",
        )

        run(c, f"cp /tmp/ntfy.https.conf {NGINX_DIR}/ntfy.nomadro.cn.conf")
        run(c, "nginx -t && nginx -s reload")

        # Recreate ntfy with base URL (optional env)
        run(c, "docker inspect nomadro-ntfy --format '{{.Config.Env}}' | head -1")
        run(c, "curl -sI http://127.0.0.1:9180/ | head -5")
        run(c, "curl -sI https://ntfy.nomadro.cn/ | head -8")
        run(c, "curl -s -X POST https://ntfy.nomadro.cn/nomadcna-healthcheck -H 'Title: NomadCNA' -d 'ntfy https ok'")
        print("\n=== ntfy HTTPS fix done ===")
    finally:
        c.close()


if __name__ == "__main__":
    main()