#!/usr/bin/env bash
# Runs ON the VPS (piped through `ssh silentmode 'HOST=… KEYHDR=… bash -s'`
# by blockbook-upstream.sh / .ps1). Repoints the digibyte.x vhost (served
# by Angie since 2026-09-16: /etc/angie/http.d/digibyte-x.conf — the copy
# under /etc/nginx/sites-enabled is stale, nginx.service is inactive).
# /blockbook/ proxy at $HOST, with the NOWNodes api-key header when
# KEYHDR=1, tests the config, reloads Angie and proves the route works.
set -euo pipefail
: "${HOST:?HOST (upstream hostname) is required}"
KEYHDR="${KEYHDR:-0}"
F=/etc/angie/http.d/digibyte-x.conf
mkdir -p /etc/angie/stale-baks
cp "$F" "/etc/angie/stale-baks/digibyte-x.bak.$(date +%s)"
KEY=""
if [ "$KEYHDR" = 1 ]; then
  KEY="$(. /etc/dgb-core/nownodes.env; printf %s "$NOWNODES_API_KEY" | tr -d '\r\n ')"
  [ -n "$KEY" ] || { echo "no NOWNODES_API_KEY in /etc/dgb-core/nownodes.env" >&2; exit 1; }
fi
HOST="$HOST" KEY="$KEY" python3 - "$F" <<'PY'
import os, re, sys
p = sys.argv[1]; s = open(p).read()
host, key = os.environ['HOST'], os.environ['KEY']
a = s.index('    location /blockbook/ {'); b = s.index('\n    }\n', a) + 7
blk = s[a:b]
blk = re.sub(r'proxy_pass https://[^/]+/api/v2/;', f'proxy_pass https://{host}/api/v2/;', blk)
blk = re.sub(r'proxy_ssl_name [^;]+;', f'proxy_ssl_name {host};', blk)
blk = re.sub(r'proxy_set_header Host [^;]+;', f'proxy_set_header Host {host};', blk)
blk = re.sub(r'\n        proxy_set_header api-key "[^"]*";', '', blk)
if key:
    blk = blk.replace('        proxy_set_header X-Real-IP "";\n', f'        proxy_set_header X-Real-IP "";\n        proxy_set_header api-key "{key}";\n')
open(p, 'w').write(s[:a] + blk + s[b:])
print('vhost now proxies /blockbook/ ->', host, '(api-key header)' if key else '(no key)')
PY
angie -t
systemctl reload angie
sleep 1
code=$(curl -sk -o /dev/null -w '%{http_code}' --resolve digibyte.x:443:127.0.0.1 'https://digibyte.x/blockbook/')
echo "GET /blockbook/ via vhost -> HTTP $code"
[ "$code" = 200 ] || { echo "upstream not answering 200 — check the key / host" >&2; exit 1; }