#!/bin/sh
set -e

# Generate cert if not exists (first-run)
if [ ! -d "/etc/letsencrypt/live/{{ matrix_domain }}" ]; then
  echo "Requesting initial Let's Encrypt certificate..."
  certbot certonly --standalone \
    --non-interactive --agree-tos --email admin@{{ matrix_domain }} \
    -d {{ matrix_domain }} \
    --domain {{ matrix_domain }} \
    --preferred-challenges http \
    --http-01-port 8080 \
    --server https://acme-v02.api.letsencrypt.org/directory || true

  # For staging (dev): use --server https://acme-staging-v02.api.letsencrypt.org/directory
fi

# Try to renew (non-blocking)
echo "Attempting certificate renewal..."
certbot renew --dry-run --quiet || true

# Start Nginx (certs will be loaded if they exist)
exec "$@"