#!/bin/bash
# Repoint the existing tube.jihakuz.xyz vhost at youtube-automate.
#
# Why this exists: tube.jihakuz.xyz was already served by a leftover
# TubeArchivist server block inside /etc/nginx/sites-available/jihakuz.xyz,
# proxying to 127.0.0.1:8003. That block loads before the standalone vhost
# deploy.sh installs (nginx takes the first server block matching a name), so
# every request went to the dead TubeArchivist port and returned 502.
#
# That old block already owns the Let's Encrypt certificate for the hostname,
# so the right fix is to repoint it rather than duplicate it — no second
# certbot run needed.
#
#     sudo /opt/youtube-automate/deploy/fix-nginx-tube.sh
set -euo pipefail

CONF=/etc/nginx/sites-available/jihakuz.xyz
STANDALONE=/etc/nginx/sites-enabled/tube.jihakuz.xyz
OLD_PORT=8003
NEW_PORT=8085

if [[ $EUID -ne 0 ]]; then
    echo "This script needs root. Run: sudo $0" >&2
    exit 1
fi

if ! grep -q "127.0.0.1:${OLD_PORT}" "$CONF"; then
    if grep -q "127.0.0.1:${NEW_PORT}" "$CONF"; then
        echo "Already repointed at ${NEW_PORT}; nothing to do."
        exit 0
    fi
    echo "Did not find 127.0.0.1:${OLD_PORT} in $CONF — nothing to change." >&2
    exit 1
fi

BACKUP="${CONF}.bak-$(date +%Y%m%d%H%M%S)"
cp -a "$CONF" "$BACKUP"
echo "==> Backed up $CONF to $BACKUP"

# X-Forwarded-For is not cosmetic: the app throttles failed logins per client
# address and reads it from that header. Without it every attempt looks like it
# came from nginx itself, so one attacker would lock out everybody.
sed -i \
  "s|proxy_pass http://127.0.0.1:${OLD_PORT};|proxy_pass http://127.0.0.1:${NEW_PORT};\n\t\tproxy_http_version 1.1;\n\t\tproxy_set_header Host \$host;\n\t\tproxy_set_header X-Real-IP \$remote_addr;\n\t\tproxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;\n\t\tproxy_set_header X-Forwarded-Proto \$scheme;|" \
  "$CONF"
echo "==> Repointed tube.jihakuz.xyz at 127.0.0.1:${NEW_PORT}"

# The standalone vhost is now redundant and would only produce a
# "conflicting server name" warning.
if [[ -L "$STANDALONE" || -f "$STANDALONE" ]]; then
    rm -f "$STANDALONE"
    echo "==> Removed the redundant standalone vhost $STANDALONE"
fi

if ! nginx -t; then
    echo "!! nginx config test failed — restoring the backup" >&2
    cp -a "$BACKUP" "$CONF"
    nginx -t
    exit 1
fi

systemctl reload nginx
echo "==> nginx reloaded"
echo
echo "Verify with:"
echo "    curl -sI https://tube.jihakuz.xyz/ | head -1     # expect 303 -> /login"