#!/usr/bin/env bash
# Install certbot and certbot-dns-cloudflare inside the NPM container so the NPM UI
# can use DNS (Cloudflare) challenge without needing to reach PyPI on first use.
# Run from repo root. Requires SSH to Proxmox and .env with PROXMOX_HOST, NPMPLUS_VMID.
# See: docs/04-configuration/NPM_SSL_DNS_CLOUDFLARE_TROUBLESHOOTING.md

set -euo pipefail

# Load IP configuration
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
PROJECT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
source "${PROJECT_ROOT}/config/ip-addresses.conf" 2>/dev/null || true


SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
PROJECT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
cd "$PROJECT_ROOT"

if [ -f .env ]; then
  set +u
  set -a
  # shellcheck source=/dev/null
  source .env 2>/dev/null || true
  set +a
  set -u
fi

NPMPLUS_VMID="${NPMPLUS_VMID:-${NPM_VMID:-10233}}"
PROXMOX_HOST="${PROXMOX_HOST:-192.168.11.11}"

echo "Installing certbot + certbot-dns-cloudflare in NPM container (VMID $NPMPLUS_VMID on $PROXMOX_HOST)..."
echo "Container must have outbound internet (DNS + route to PyPI)."
echo ""

ssh -o ConnectTimeout=10 -o StrictHostKeyChecking=accept-new root@"$PROXMOX_HOST" \
  "pct exec $NPMPLUS_VMID -- /opt/certbot/bin/pip install --upgrade pip setuptools wheel && \
   pct exec $NPMPLUS_VMID -- /opt/certbot/bin/pip install certbot certbot-dns-cloudflare"

echo ""
echo "Done. You can request DNS (Cloudflare) certificates in the NPM UI again."