#!/usr/bin/env bash
# Build config/cloudflare-ddns.env for timothyjmiller/cloudflare-ddns from secrets/.env
set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
STACK_DIR="${STACK_DIR:-$(cd "$SCRIPT_DIR/.." && pwd)}"
SECRETS="${SECRETS_FILE:-$STACK_DIR/secrets/.env}"
OUT_DIR="${CONFIG_DIR:-$STACK_DIR/config}/cloudflare-ddns"
OUT="$OUT_DIR/ddns.env"

[[ -f "$SECRETS" ]] || { echo "missing $SECRETS"; exit 1; }

set -a
# shellcheck disable=SC1090
source "$SECRETS"
set +a

TOKEN="${CLOUDFLARE_API_TOKEN:-${CLOUDFLAREAPIKEY:-}}"
ZONE="${CLOUDFLARE_ZONE_ID:-${CLOUDFLAREZONEID:-}}"
DOMAIN="${CLOUDFLARE_DOMAIN:-${CLOUDFLAREDOMAIN:-devopshomelab.com}}"
SUBS="${CLOUDFLARE_SUBDOMAINS:-${CLOUDFLARESUBDOMAINS:-}}"
PROXIED="${CLOUDFLARE_PROXIED:-${CLOUDFLAREPROXIED:-false}}"
CRON="${CLOUDFLARE_UPDATE_CRON:-@every 5m}"

[[ -n "$TOKEN" ]] || { echo "CLOUDFLAREAPIKEY / CLOUDFLARE_API_TOKEN missing"; exit 1; }
[[ -n "$DOMAIN" ]] || { echo "CLOUDFLAREDOMAIN missing"; exit 1; }

# apex + each subdomain → full FQDNs
DOMAINS=("$DOMAIN")
IFS=',' read -ra parts <<<"$SUBS"
for s in "${parts[@]}"; do
  s="$(echo "$s" | tr -d '[:space:]')"
  [[ -z "$s" ]] && continue
  if [[ "$s" == "$DOMAIN" || "$s" == "@" || "$s" == "." ]]; then
    continue
  elif [[ "$s" == *.* ]]; then
    DOMAINS+=("$s")
  else
    DOMAINS+=("${s}.${DOMAIN}")
  fi
done

# unique join
IP4_LIST="$(printf '%s\n' "${DOMAINS[@]}" | awk 'NF && !seen[$0]++' | paste -sd, -)"

mkdir -p "$OUT_DIR"
umask 077
cat >"$OUT" <<EOF
# Generated by scripts/render-cloudflare-ddns-env.sh — do not commit
CLOUDFLARE_API_TOKEN=${TOKEN}
IP4_DOMAINS=${IP4_LIST}
IP4_PROVIDER=cloudflare.trace
IP6_PROVIDER=none
PROXIED=${PROXIED}
UPDATE_CRON=${CRON}
UPDATE_ON_START=true
TTL=1
RECORD_COMMENT=arr-stack cloudflare-ddns
TZ=${TZ:-UTC}
EOF

# optional zone id is not required by current image (token + domains)
if [[ -n "$ZONE" ]]; then
  echo "# CLOUDFLARE_ZONE_ID=${ZONE} (informational; env-mode uses token scopes)" >>"$OUT"
fi

chmod 600 "$OUT"
echo "Wrote $OUT"
echo "IP4_DOMAINS=${IP4_LIST}"