#!/bin/bash
set -euo pipefail

install -m 644 /dev/stdin /etc/nginx/conf.d/goatcounter-client-ip.conf <<'MAP'
# Prefer Cloudflare connecting IP when present (clearnet); else peer addr (onion/local).
map $http_cf_connecting_ip $gc_client_ip {
    ""      $remote_addr;
    default $http_cf_connecting_ip;
}
MAP

python3 - <<'PY'
from pathlib import Path

blog = Path("/etc/nginx/sites-enabled/blog-https")
text = blog.read_text()
if "location = /count" not in text:
    snippet = """
  # GoatCounter: same-origin proxy (shares site with onion)
  location = /count {
    proxy_pass http://127.0.0.1:8081/count;
    proxy_set_header Host statsblog.alipourimjourneys.ir;
    proxy_set_header X-Forwarded-For $gc_client_ip;
    proxy_set_header X-Real-IP $gc_client_ip;
    proxy_set_header X-Forwarded-Proto $scheme;
  }

  location /counter/ {
    proxy_pass http://127.0.0.1:8081/counter/;
    proxy_set_header Host statsblog.alipourimjourneys.ir;
    proxy_set_header X-Forwarded-For $gc_client_ip;
    proxy_set_header X-Forwarded-Proto $scheme;
  }

"""
    idx = text.rfind("}")
    blog.write_text(text[:idx] + snippet + text[idx:])
    print("blog-https: added /count /counter")
else:
    print("blog-https: already has /count")

stats = Path("/etc/nginx/sites-enabled/stats.blog.alipourimjourneys.ir.conf")
st = stats.read_text()
old = "proxy_set_header X-Real-IP         $remote_addr;\n    proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;"
new = "proxy_set_header X-Real-IP         $gc_client_ip;\n    proxy_set_header X-Forwarded-For   $gc_client_ip;"
if "$gc_client_ip" in st:
    print("statsblog: already patched")
elif old in st:
    stats.write_text(st.replace(old, new))
    print("statsblog: CF client IP")
else:
    raise SystemExit("statsblog: unexpected content, edit manually")

onion = Path("/etc/nginx/sites-enabled/onion-blog")
ot = onion.read_text()
# Update only goatcounter-related XFF lines (keep Isso as-is if different context)
ot2 = ot.replace(
    """location = /count {
    proxy_pass http://127.0.0.1:8081/count;
    proxy_set_header Host statsblog.alipourimjourneys.ir;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto http;
}

# reads for displaying numbers (JSON counters)
location /counter/ {
    proxy_pass http://127.0.0.1:8081/counter/;
    proxy_set_header Host statsblog.alipourimjourneys.ir;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto http;""",
    """location = /count {
    proxy_pass http://127.0.0.1:8081/count;
    proxy_set_header Host statsblog.alipourimjourneys.ir;
    proxy_set_header X-Forwarded-For $gc_client_ip;
    proxy_set_header X-Real-IP $gc_client_ip;
    proxy_set_header X-Forwarded-Proto http;
}

# reads for displaying numbers (JSON counters)
location /counter/ {
    proxy_pass http://127.0.0.1:8081/counter/;
    proxy_set_header Host statsblog.alipourimjourneys.ir;
    proxy_set_header X-Forwarded-For $gc_client_ip;
    proxy_set_header X-Forwarded-Proto http;""",
)
if ot2 != ot:
    onion.write_text(ot2)
    print("onion-blog: client IP for goatcounter")
elif "$gc_client_ip" in ot:
    print("onion-blog: already ok")
else:
    print("onion-blog: WARN could not patch automatically")
PY

nginx -t
systemctl reload nginx
echo "nginx reloaded OK"