#!/bin/bash

# Encontra o certificado válido
CERT_REAL=""
for f in /home/stoa/ssl/certs/*.crt; do
    if openssl x509 -in "$f" -noout -ext subjectAltName 2>/dev/null | grep -q "coregestaozimm.stoa.chat"; then
        CERT_REAL="$f"
        break
    fi
done

if [ -n "$CERT_REAL" ]; then
    NOME_ARQUIVO=$(basename "$CERT_REAL")
    PREFIX=$(echo "$NOME_ARQUIVO" | awk -F'_' '{print $(NF-3)"_"$(NF-2)}')
    CHAVE_REAL=$(ls -t /home/stoa/ssl/keys/*${PREFIX}*.key | head -1)
    
    # Pega o pacote de raízes oficial do próprio cPanel
    CABUNDLE_REAL="${CERT_REAL%.crt}.cabundle"

    \cp "$CHAVE_REAL" /home/stoa/coregestaozimm.stoa.chat/ssl_fixo.key
    cat "$CERT_REAL" > /home/stoa/coregestaozimm.stoa.chat/ssl_fixo.crt
    
    # Adiciona a raiz oficial sem inventar moda
    if [ -f "$CABUNDLE_REAL" ]; then
        echo "" >> /home/stoa/coregestaozimm.stoa.chat/ssl_fixo.crt
        cat "$CABUNDLE_REAL" >> /home/stoa/coregestaozimm.stoa.chat/ssl_fixo.crt
    fi

    systemctl restart backend-zimm.service
fi