#!/bin/bash

# ==========================================
# 脚本说明：全自动动态读取域名、独立映射并展示状态
# ==========================================

# 自动获取 acme.sh 列表里所有已管理的域名
DOMAINS=($( ~/.acme.sh/acme.sh --list | tail -n +2 | awk '{print $1}' | grep '\.' ))

if [ ${#DOMAINS[@]} -eq 0 ]; then
    echo "============================================"
    echo "[错误] 当前机器未检测到任何由 acme.sh 管理的域名！"
    echo "============================================"
    exit 1
fi

TOTAL=${#DOMAINS[@]}
CURRENT=0
mkdir -p /root/cert

for DOMAIN in "${DOMAINS[@]}"
do
    CURRENT=$((CURRENT+1))
    echo "--------------------------------------------"
    echo "尝试更新证书中："
    echo "进度  $CURRENT/$TOTAL : 更新证书 "

    # 自动判断 ECC 还是 RSA
    ECC_FLAG=""
    if [ -d "/root/.acme.sh/${DOMAIN}_ecc" ]; then
        ECC_FLAG="--ecc"
    fi

    # 尝试续签
    ~/.acme.sh/acme.sh --renew -d "$DOMAIN" $ECC_FLAG >/dev/null 2>&1

    # 核心修改：使用变量给证书独立命名，防止互相覆盖
    CERT_CRT="/root/cert/${DOMAIN}.crt"
    CERT_KEY="/root/cert/${DOMAIN}.key"

    ~/.acme.sh/acme.sh --install-cert -d "$DOMAIN" $ECC_FLAG \
        --key-file       "$CERT_KEY" \
        --fullchain-file "$CERT_CRT" \
        --reloadcmd     "systemctl restart s-ui" >/dev/null 2>&1

    # 读取独立映射后的证书文件
    if [ -s "$CERT_CRT" ] && openssl x509 -in "$CERT_CRT" -noout >/dev/null 2>&1; then
        START_DATE_STR=$(openssl x509 -in "$CERT_CRT" -noout -startdate | cut -d= -f2)
        END_DATE_STR=$(openssl x509 -in "$CERT_CRT" -noout -enddate | cut -d= -f2)

        GEN_DATE=$(date -d "$START_DATE_STR" +"%Y-%m-%d %H:%M:%S")
        CHECK_DATE=$(date +"%Y-%m-%d %H:%M:%S")

        START_SEC=$(date -d "$START_DATE_STR" +%s)
        END_SEC=$(date -d "$END_DATE_STR" +%s)
        NOW_SEC=$(date +%s)

        AGE_DAYS=$(( (NOW_SEC - START_SEC) / 86400 ))
        REMAIN_DAYS=$(( (END_SEC - NOW_SEC) / 86400 ))

        echo " ---> 证书检查日期:$CHECK_DATE"
        echo " ---> 证书生成日期:$GEN_DATE"
        echo " ---> 证书生成天数:$AGE_DAYS"
        echo " ---> 证书剩余天数:$REMAIN_DAYS"
        echo " ---> 证书过期前最后一天自动更新，如更新失败请手动更新"
        echo ""
        echo "域名：$DOMAIN"
        echo "映射路径：$CERT_CRT"
    else
        echo " ---> [错误] 未能读取到有效证书，请检查 acme.sh 状态。"
        echo "域名：$DOMAIN"
    fi
    echo "--------------------------------------------"
done