#!/usr/bin/php
<?php

/**
 * EXPERIMENTAL : auth/cleanup certbot script
 * using AlternC 3.x.11 API for Domain Names 
 */

/* the config file located in /etc/letsencrypt/alternc-plugin.conf 
   is a json file that contains the following :
   {
     "suffix": { "server": "https://alternc.server.com/", "token": "sohdifeejoCafii9Aeph0Jah4naithoC" },
     "othersuffix: { ... }
   }
   where suffix is a domain suffix like example.com or sub.domain.fr ... 
   This plugin will use the AlternC 'server' API with the 'token' to set / unset domain names as requested by CertBot
   The longer suffix is always preferred (to get *.sub.example.com we will use sub.example.com over example.com)
*/
$conffile="/etc/letsencrypt/alternc-plugin.conf";

$conf=@json_decode(file_get_contents($conffile),true);
if (!is_array($conf) || !count($conf)) {
    echo "FATAL: cannot read $conffile or json incorrect. See certbot-auth source code for more information\n";
    exit(1);
}
    
$certbot=strtolower(getenv("CERTBOT_DOMAIN"));
$sub="";
$value=getenv("CERTBOT_VALIDATION");
if (!$certbot || !$value) {
    echo "FATAL: environment variable missing: CERTBOT_DOMAIN | CERTBOT_VALIDATION\n";
    exit(1);
}

// Search for the matching suffix information
$domain=""; $server=""; $token=""; $length=0;
foreach($conf as $suffix => $data) {
    if ($certbot==$suffix || substr($certbot,-strlen($suffix)-1)==(".".$suffix)) { // ^matching or \.matching
        if (strlen($suffix)>$length) {
            $length=strlen($suffix);
            $domain=$suffix; $server=$data["server"]; $token=$data["token"];
        }
    }
}
if (!$domain) {
    echo "FATAL: the domain $certbot is NOT available through AlternC api. Please check your configuration file\n";
    exit(1);
}
// now let's split what is domain and what is SUB :)
if ($domain==$certbot) {
    $sub="";
} else {
    $sub=".".substr($certbot,0,-strlen($domain)-1);
}

// API call:
echo "adding subdomain on AlternC server $server for domain $domain & sub $sub\n";
$s=file_get_contents($server."/api/rest/subdomain/set?token=".$token."&dom=".$domain."&sub=_acme-challenge".$sub."&type=TXT&dest=".urlencode($value)."&urgent=1");
if (!$result=@json_decode($s,true) || $result["content"]!=true) {
    echo "FATAL: error while calling set API on $server, returned string\n$s\n";
    exit(1);
}

// wait for a few seconds for the information to propagate to DNS through update_domaines & others...
sleep(10);
exit(0);