#!/usr/bin/env bash

source "$(dirname $0)/vars"

APP="$1"; PORT="$2"; INT_PORT="$3"
[[ "$INT_PORT" != "" ]] || INT_PORT="$APP_PORT"
WILDCARD_SSL="$DOKKU_ROOT/ssl"
SSL="$DOKKU_ROOT/$APP/ssl"

if [[ "$PORT" == "" ]] || [[ -f "$DOKKU_ROOT/$APP/NO_VHOST" ]]; then
  rm -f "$DOKKU_ROOT/$APP/nginx.conf"
  pluginhook nginx-pre-reload $APP
  sudo /etc/init.d/nginx reload > /dev/null
  exit 0
fi

hostnames_for_app "$APP"

if [[ "$hostname" != "" ]]; then
  if [[ -f "$SSL/server.crt" ]] && [[ -f "$SSL/server.key" ]]; then
    SSL_INUSE="$SSL"
  elif  [[ -f "$WILDCARD_SSL/server.crt" ]] && [[ -f "$WILDCARD_SSL/server.key" ]] && [[ $hostname = `openssl x509 -in $WILDCARD_SSL/server.crt -noout -subject | tr '/' '\n' | grep CN= | cut -c4-` ]]; then
    SSL_INUSE="$WILDCARD_SSL"
  fi

  # ssl based nginx.conf
  if [[ -n "$SSL_INUSE" ]]; then
  cat<<EOF > $DOKKU_ROOT/$APP/nginx.conf
upstream $APP { server 127.0.0.1:$PORT; }
server {
  listen      [::]:80;
  listen      80;
  server_name ${hostnames[@]} ${redirect_hostnames[@]};
  return 301 https://$hostname\$request_uri;
}

server {
  listen      [::]:443;
  listen      443;
  server_name ${hostnames[@]};

  ssl on;
  ssl_certificate     $SSL_INUSE/server.crt;
  ssl_certificate_key $SSL_INUSE/server.key;
  ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-RC4-SHA:ECDHE-RSA-AES128-SHA:AES128-GCM-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH:!CAMELLIA;
  ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
  ssl_prefer_server_ciphers on;

  location    / {
    proxy_pass  http://$APP;
EOF

    for host in "${hostnames[@]}";
    do
      cat <<EOF >> $DOKKU_ROOT/$APP/nginx.conf
    proxy_redirect http://$host:$INT_PORT/ https://$host/;
    proxy_redirect https://$host:$INT_PORT/ https://$host/;
EOF
    done

cat<<EOF >> $DOKKU_ROOT/$APP/nginx.conf
    proxy_http_version 1.1;
    proxy_set_header Upgrade \$http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_set_header Host \$http_host;
    proxy_set_header X-Forwarded-Proto \$scheme;
    proxy_set_header X-Forwarded-For \$remote_addr;
    proxy_set_header X-Forwarded-Port \$server_port;
    proxy_set_header X-Request-Start \$msec;
  }
}
EOF

  echo "https://$hostname" > "$DOKKU_ROOT/$APP/URL"
else
# default nginx.conf
  cat<<EOF > $DOKKU_ROOT/$APP/nginx.conf
upstream $APP { server 127.0.0.1:$PORT; }
server {
  listen      [::]:80;
  listen      80;
  server_name ${hostnames[@]};
  location    / {
    proxy_pass  http://$APP;
EOF

    for host in "${hostnames[@]}";
    do
      cat <<EOF >> $DOKKU_ROOT/$APP/nginx.conf
    proxy_redirect http://$host:$INT_PORT/ http://$host/;
EOF
    done

cat<<EOF >> $DOKKU_ROOT/$APP/nginx.conf
    proxy_http_version 1.1;
    proxy_set_header Upgrade \$http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_set_header Host \$http_host;
    proxy_set_header X-Forwarded-Proto \$scheme;
    proxy_set_header X-Forwarded-For \$remote_addr;
    proxy_set_header X-Forwarded-Port \$server_port;
    proxy_set_header X-Request-Start \$msec;
  }
}
EOF

  if [[ "$redirect_hostnames" != "" ]]; then
    cat<<EOF >> $DOKKU_ROOT/$APP/nginx.conf
server {
  listen      [::]:80;
  listen      80;
  server_name ${redirect_hostnames[@]};
  return 302 http://$hostname\$request_uri;
}
EOF
  fi

  echo "http://$hostname" > "$DOKKU_ROOT/$APP/URL"
  fi
  pluginhook nginx-pre-reload $APP
  sudo /etc/init.d/nginx reload > /dev/null
fi
