#!/bin/bash
# Sync Let's Encrypt cert from nginx (.24) to Mailcow SMTP/IMAP (.28)
# Run from workstation with SSH to both hosts, or schedule after certbot renew on .24
set -euo pipefail

NGINX_HOST="${NGINX_HOST:-10.100.1.24}"
MAILCOW_HOST="${MAILCOW_HOST:-10.100.1.28}"
DOMAIN="${DOMAIN:-sync.geonet.co.id}"
STACK="/opt/stacks/mailcow"
CERT_SRC="/etc/letsencrypt/live/${DOMAIN}/fullchain.pem"
KEY_SRC="/etc/letsencrypt/live/${DOMAIN}/privkey.pem"

echo "Copy LE cert ${DOMAIN} -> Mailcow ${MAILCOW_HOST}"
ssh root@"${NGINX_HOST}" "cat ${CERT_SRC}" | ssh root@"${MAILCOW_HOST}" "cat > ${STACK}/data/assets/ssl/cert.pem"
ssh root@"${NGINX_HOST}" "cat ${KEY_SRC}" | ssh root@"${MAILCOW_HOST}" "cat > ${STACK}/data/assets/ssl/key.pem"
ssh root@"${MAILCOW_HOST}" "chmod 600 ${STACK}/data/assets/ssl/key.pem && openssl x509 -in ${STACK}/data/assets/ssl/cert.pem -noout -issuer"
ssh root@"${MAILCOW_HOST}" "cd ${STACK} && docker compose restart postfix-mailcow dovecot-mailcow nginx-mailcow"
echo "DONE"