wild-central/internal/api/v1/handlers_certbot.go

package v1

import (
	"fmt"
	"net/http"
	"strings"

	"github.com/wild-cloud/wild-central/internal/config"
)

// CertStatus returns TLS certificate status for all relevant domains:
// the central domain, the wildcard cert, and any registered service domains.
func (api *API) CertStatus(w http.ResponseWriter, r *http.Request) {
	centralDomain := api.getCentralDomain()

	globalCfg, _ := config.LoadGlobalConfig(api.getGlobalConfigPath())
	email := ""
	if globalCfg != nil {
		email = globalCfg.Operator.Email
	}

	cfToken := api.getCloudflareToken()

	// Derive gateway domain for wildcard cert
	gatewayDomain := ""
	if parts := strings.SplitN(centralDomain, ".", 2); len(parts) == 2 {
		gatewayDomain = parts[1]
	}

	// Gather cert statuses
	certs := []map[string]any{}

	// Central domain cert
	if centralDomain != "" {
		status := api.certbot.GetStatus(centralDomain)
		certs = append(certs, map[string]any{
			"domain": centralDomain,
			"type":   "central",
			"cert":   status,
		})
	}

	// Wildcard cert
	if gatewayDomain != "" {
		wildcardDomain := "*." + gatewayDomain
		status := api.certbot.GetStatus(gatewayDomain)
		certs = append(certs, map[string]any{
			"domain": wildcardDomain,
			"type":   "wildcard",
			"cert":   status,
		})
	}

	// Registered service certs (for services that need TLS termination)
	svcs, _ := api.services.List()
	for _, svc := range svcs {
		if svc.TLS != "terminate" || svc.Domain == "" {
			continue
		}
		// Skip if covered by wildcard
		if gatewayDomain != "" && strings.HasSuffix(svc.Domain, "."+gatewayDomain) {
			continue
		}
		status := api.certbot.GetStatus(svc.Domain)
		certs = append(certs, map[string]any{
			"domain":  svc.Domain,
			"type":    "service",
			"service": svc.Name,
			"cert":    status,
		})
	}

	respondJSON(w, http.StatusOK, map[string]any{
		"configured":     centralDomain != "",
		"domain":         centralDomain,
		"gatewayDomain":  gatewayDomain,
		"canProvision":   cfToken != "" && email != "",
		"hasToken":       cfToken != "",
		"hasEmail":       email != "",
		"certs":          certs,
	})
}

// CertProvision provisions a TLS certificate for a domain using DNS-01.
// Query param ?domain=... specifies the domain. Defaults to the central domain.
func (api *API) CertProvision(w http.ResponseWriter, r *http.Request) {
	domain := r.URL.Query().Get("domain")
	if domain == "" {
		domain = api.getCentralDomain()
	}
	if domain == "" {
		respondError(w, http.StatusBadRequest, "No domain specified and no central domain configured")
		return
	}

	globalCfg, err := config.LoadGlobalConfig(api.getGlobalConfigPath())
	if err != nil {
		respondError(w, http.StatusInternalServerError, fmt.Sprintf("Failed to load config: %v", err))
		return
	}
	email := globalCfg.Operator.Email
	if email == "" {
		respondError(w, http.StatusBadRequest, "Operator email not configured")
		return
	}

	token := api.getCloudflareToken()
	if token == "" {
		respondError(w, http.StatusBadRequest, "Cloudflare API token not configured")
		return
	}

	if err := api.certbot.EnsureCredentials(token); err != nil {
		respondError(w, http.StatusInternalServerError, fmt.Sprintf("Failed to write credentials: %v", err))
		return
	}

	if err := api.certbot.Provision(domain, email); err != nil {
		respondError(w, http.StatusInternalServerError, fmt.Sprintf("Certificate provisioning failed: %v", err))
		return
	}

	// If this was a wildcard cert, also build HAProxy PEM
	if strings.HasPrefix(domain, "*.") {
		baseDomain := strings.TrimPrefix(domain, "*.")
		_ = api.certbot.BuildHAProxyCert(baseDomain)
	} else {
		_ = api.certbot.BuildHAProxyCert(domain)
	}

	// Trigger reconciliation so HAProxy picks up the new cert
	go api.reconcileNetworking()

	status := api.certbot.GetStatus(domain)
	respondJSON(w, http.StatusOK, map[string]any{
		"message": fmt.Sprintf("Certificate provisioned for %s", domain),
		"cert":    status,
	})
}

// CertRenew renews all certbot-managed certificates.
func (api *API) CertRenew(w http.ResponseWriter, r *http.Request) {
	if err := api.certbot.Renew(); err != nil {
		respondError(w, http.StatusInternalServerError, fmt.Sprintf("Certificate renewal failed: %v", err))
		return
	}

	// Rebuild HAProxy PEMs
	domain := api.getCentralDomain()
	if domain != "" {
		_ = api.certbot.BuildHAProxyCert(domain)
	}

	// Trigger reconciliation
	go api.reconcileNetworking()

	respondJSON(w, http.StatusOK, map[string]string{"message": "Certificates renewed"})
}

// getCentralDomain returns the configured central domain or empty string.
func (api *API) getCentralDomain() string {
	globalCfg, err := config.LoadGlobalConfig(api.getGlobalConfigPath())
	if err != nil {
		return ""
	}
	return globalCfg.Cloud.Central.Domain
}