#!/usr/bin/env bash
# Local demonstration only: self-signed certificates, no ACME issuance.
# Requires Bash, OpenSSL and Docker on a local Linux Docker host.
set -euo pipefail
umask 077
for command in docker openssl mktemp; do command -v "$command" >/dev/null; done
lab_dir=$(mktemp -d)
container=""
cleanup() {
  if [[ -n "$container" ]]; then docker rm -f "$container" >/dev/null 2>&1 || true; fi
  rm -rf "$lab_dir"
}
trap cleanup EXIT
trap 'exit 130' INT
trap 'exit 143' TERM
image='nginx@sha256:060849a174666c53439dc7cecbf8f67e225c7cbfb1a44ca97915d9a172a81e6d'
for generation in old new; do
  openssl req -x509 -newkey rsa:2048 -nodes -days 2 \
    -subj '/CN=renewal.test' -addext 'subjectAltName=DNS:renewal.test' \
    -keyout "$lab_dir/$generation.key" -out "$lab_dir/$generation.crt" 2>/dev/null
done
cp "$lab_dir/old.crt" "$lab_dir/live.crt"
cp "$lab_dir/old.key" "$lab_dir/live.key"
cat > "$lab_dir/nginx.conf" <<'NGINX'
events {}
http {
  server {
    listen 8443 ssl;
    server_name renewal.test;
    ssl_certificate /lab/live.crt;
    ssl_certificate_key /lab/live.key;
    location / { return 200 'certificate reload lab\n'; }
  }
}
NGINX
container=$(docker run -d --rm -p 127.0.0.1:0:8443 \
  --mount "type=bind,src=$lab_dir,dst=/lab,readonly" \
  "$image" nginx -c /lab/nginx.conf -g 'daemon off;')
address=$(docker port "$container" 8443/tcp)
file_fingerprint() { openssl x509 -in "$1" -noout -sha256 -fingerprint; }
served_fingerprint() {
  # Trust is deliberately not checked: these are synthetic self-signed certs.
  openssl s_client -connect "$address" -servername renewal.test </dev/null 2>/dev/null |
    openssl x509 -noout -sha256 -fingerprint
}
old=$(file_fingerprint "$lab_dir/old.crt")
new=$(file_fingerprint "$lab_dir/new.crt")
ready=false
for attempt in {1..30}; do
  if served=$(served_fingerprint) && [[ "$served" == "$old" ]]; then ready=true; break; fi
  sleep 0.2
done
[[ "$ready" == true ]] || { echo 'Initial TLS probe failed' >&2; exit 1; }
printf 'BEFORE: %s\n' "$served"
cp "$lab_dir/new.crt" "$lab_dir/live.crt"
cp "$lab_dir/new.key" "$lab_dir/live.key"
served=$(served_fingerprint)
[[ "$served" == "$old" && "$served" != "$new" ]]
printf 'DISK:   %s\nSERVED: %s\n' "$new" "$served"
docker exec "$container" nginx -c /lab/nginx.conf -t
docker exec "$container" nginx -c /lab/nginx.conf -s reload
ready=false
for attempt in {1..30}; do
  if served=$(served_fingerprint) && [[ "$served" == "$new" ]]; then ready=true; break; fi
  sleep 0.2
done
[[ "$ready" == true ]] || { echo 'Certificate did not change after reload' >&2; exit 1; }
printf 'AFTER:  %s\nPASS: disk changed first; served certificate changed after reload.\n' "$served"