#!/bin/bash

LE_CERTS_DIR="{{ letsencrypt_acme_sh_certificates_install_path }}"
LE_LOG_DIR=/var/log/letsencrypt
LE_LOGFILE="$LE_LOG_DIR/minio.log"
MINIO_CERTS_DIR="{{ minio_tls_certs_dir }}"
MINIO_KEYFILE="{{ minio_tls_key_file }}"
MINIO_CERTFILE="{{ minio_tls_cert_file }}"
DATE=$( date )
RETVAL=

[ ! -d $LE_LOG_DIR ] && mkdir $LE_LOG_DIR
echo "$DATE" >> "$LE_LOGFILE"

logger "acme-minio-hook: Check if the certificate has been renewed"
cmp ${LE_CERTS_DIR}/fullchain  ${MINIO_CERTFILE}
RETVAL=$?
if [ $RETVAL -eq 0 ] ; then
    logger "acme-minio-hook: No new cerficate."
    echo "acme-minio-hook: No new cerficate." >> $LE_LOGFILE
    exit 0
else
    logger "acme-minio-hook: Copying the key file"
    echo "Copy the certificate files" >> $LE_LOGFILE
    /bin/cp -f ${LE_CERTS_DIR}/privkey  ${MINIO_KEYFILE}
    /bin/cp -f ${LE_CERTS_DIR}/fullchain  ${MINIO_CERTFILE}
{% if ansible_distribution_file_variety == "Debian" %}
    if [ -f /etc/ssl/certs/ca-certificates.crt ] ; then
        cp -pf /etc/ssl/certs/ca-certificates.crt ${MINIO_CERTS_DIR}/CAs/ca-certificates.crt
    fi
{% endif %}
{% if ansible_distribution_file_variety == "RedHat" %}
    if [ -f /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem ] ; then
        cp -pf /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem  ${MINIO_CERTS_DIR}/CAs/ca-certificates.crt
    fi
{% endif %}
fi

chmod 440 ${MINIO_KEYFILE} ${MINIO_CERTFILE}
chown root ${MINIO_KEYFILE} ${MINIO_CERTFILE}
chgrp minio-user ${MINIO_KEYFILE} ${MINIO_CERTFILE}

logger "acme-minio-hook: Restart the minio service after a certificate renewal"
systemctl restart minio >> $LE_LOGFILE 2>&1
echo "acme-minio-hook: Restart the minio service" >> $LE_LOGFILE

logger "acme-minio-hook: Done"
echo "acme-minio-hook: Done." >> $LE_LOGFILE

exit 0