#!/bin/sh

set -o errexit

mkdir -p /srv/nginx

if [ ! -e /srv/nginx/dhparam.pem ]; then
    cp /etc/nginx/ssl/dhparam.pem /srv/nginx/dhparam.pem
fi

if [ ! -e /srv/nginx/ca-certs.pem ]; then
    # Fetch letsencrypt chain
    cp /etc/nginx/ssl/ca-certs.pem /srv/nginx/ca-certs.pem
fi

if [ ! -e /srv/nginx/certificate.conf ]; then
    cp  /etc/nginx/ssl/certificate.conf /srv/nginx/certificate.conf
fi

if [ ! -e /srv/nginx/certificate.key -o ! -e /srv/nginx/certificate.crt ]; then
    if [ ! -e /etc/nginx/ssl/certificate.key -o ! -e /etc/nginx/ssl/certificate.crt ]; then
        openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
            -keyout /etc/nginx/ssl/certificate.key \
            -out    /etc/nginx/ssl/certificate.crt \
            -config /etc/nginx/ssl/certificate.conf
    fi
    cp /etc/nginx/ssl/certificate.key /srv/nginx/certificate.key
    cp /etc/nginx/ssl/certificate.crt /srv/nginx/certificate.crt
fi
