#!/usr/bin/env bash
# elevenlabs.io/scripts/migrate-host-nginx.sh
# Frees ports 80/443 on the host so the Caddy container can obtain Let's Encrypt certs.
# Backs up the whole host nginx configuration first, then stops and disables the service.
set -euo pipefail

BACKUP_DIR="/root/nginx-backup-$(date +%Y%m%d-%H%M%S)"

if ! systemctl is-active --quiet nginx; then
    echo "Host nginx is not running — nothing to migrate."
    exit 0
fi

echo "=== [1/5] Dumping host nginx config to ${BACKUP_DIR} ==="
mkdir -p "${BACKUP_DIR}"
nginx -T > "${BACKUP_DIR}/nginx-T.dump" 2>&1 || true
tar -czf "${BACKUP_DIR}/etc-nginx.tar.gz" /etc/nginx 2>/dev/null
cp -a /etc/letsencrypt "${BACKUP_DIR}/letsencrypt" 2>/dev/null || true
echo "Backup written."

echo "=== [2/5] Virtual hosts currently served ==="
grep -hE '^\s*server_name' "${BACKUP_DIR}/nginx-T.dump" | sed 's/^[ \t]*//' | sort -u

read -r -p "Stop and disable host nginx? These vhosts will go offline [y/N] " answer
case "${answer}" in
    [yY]) ;;
    *) echo "Aborted. Backup kept at ${BACKUP_DIR}"; exit 1 ;;
esac

echo "=== [3/5] Stopping nginx ==="
systemctl disable --now nginx

echo "=== [4/5] Certbot renewal hooks ==="
# Certbot keeps trying to renew certs through the nginx plugin — it would fail now.
systemctl disable --now certbot.timer 2>/dev/null || true
echo "certbot.timer disabled (Caddy manages its own certificates)."

echo "=== [5/5] Port check ==="
ss -tlnp | grep -E ':(80|443)\s' && { echo "Ports 80/443 are still busy — inspect before starting Caddy."; exit 1; }
echo "Ports 80 and 443 are free."
echo ""
echo "Backup: ${BACKUP_DIR}"
echo "Next: cd /srv/elevenlabs && docker compose pull && docker compose up -d"