#!/bin/bash
# translate.watersmedia.org on Boba-Fett (Synology DSM 7.0.1).
#
# 1. Creates the DSM reverse-proxy rule  http://translate.watersmedia.org:80
#    -> http://10.1.7.39:3100 (Church Translate) with WebSocket headers,
#    X-Forwarded-Host, and a 3600 s read timeout, through DSM's own API so it
#    shows up in Control Panel -> Login Portal -> Advanced -> Reverse Proxy.
# 2. Adds an nginx server block that answers https://translate.watersmedia.org
#    with a 301 to the http:// address (the name is LAN-only and has no
#    certificate, so browsers warn before the redirect; that is expected).
# 3. Tests the nginx config, reloads it, and prints a local check.
#
# Idempotent: re-running skips the rule if it exists and rewrites the redirect.
# Run on Boba-Fett as root:   sudo bash ~/translate-proxy.sh
set -euo pipefail

NAME=translate.watersmedia.org
BACKEND_IP=10.1.7.39
BACKEND_PORT=3100
RP_JSON=/usr/syno/etc/www/ReverseProxy.json
REDIRECT_CONF=/usr/local/etc/nginx/sites-enabled/translate-redirect.conf

if [ "$(id -u)" != 0 ]; then
  echo "Run with sudo: sudo bash $0" >&2
  exit 1
fi

echo "== 1. DSM reverse proxy rule for $NAME"
if grep -q "\"fqdn\" : \"$NAME\"" "$RP_JSON"; then
  echo "   rule already present in $RP_JSON, skipping create"
else
  # $http_upgrade etc. are nginx variables and must reach DSM literally.
  ENTRY='{"description":"translate.watersmedia.org","frontend":{"acl":null,"fqdn":"translate.watersmedia.org","https":{"hsts":false},"port":80,"protocol":0},"backend":{"fqdn":"10.1.7.39","port":3100,"protocol":0},"customize_headers":[{"name":"Upgrade","value":"$http_upgrade"},{"name":"Connection","value":"$connection_upgrade"},{"name":"X-Forwarded-Host","value":"$http_host"}],"proxy_connect_timeout":60,"proxy_read_timeout":3600,"proxy_send_timeout":60,"proxy_http_version":1,"proxy_intercept_errors":false}'
  OUT=$(/usr/syno/bin/synowebapi --exec api=SYNO.Core.AppPortal.ReverseProxy method=create version=1 entry="$ENTRY" 2>&1 || true)
  echo "   $OUT"
  if ! echo "$OUT" | grep -q '"success" *: *true'; then
    echo "   synowebapi did not report success; stopping before the redirect." >&2
    exit 1
  fi
fi

echo "== 2. HTTPS -> HTTP redirect block"
cat > "$REDIRECT_CONF" <<'EOF'
# translate.watersmedia.org is served over plain HTTP on the LAN (no certificate).
# Anyone who types https:// is sent to the http:// address. Added 2026-10-15.
server {
    listen 443 ssl;
    server_name translate.watersmedia.org;
    return 301 http://translate.watersmedia.org$request_uri;
}
EOF
echo "   wrote $REDIRECT_CONF"

echo "== 3. nginx test + reload"
/usr/bin/nginx -t
/usr/syno/bin/synosystemctl reload nginx 2>/dev/null || /usr/bin/nginx -s reload
echo "   reloaded"

echo "== 4. Local checks from Boba-Fett"
echo -n "   http  /healthz : "
curl -s -m 5 --resolve "$NAME:80:127.0.0.1" "http://$NAME/healthz"; echo
echo -n "   https /        : "
curl -sk -m 5 -o /dev/null -w '%{http_code} -> %{redirect_url}\n' --resolve "$NAME:443:127.0.0.1" "https://$NAME/"
echo "done"