#!/usr/bin/env bash

# Conditionally installs custom SSL certificates from CERTIFICATE_URLS environment variable.

set -o nounset
set -o errexit
set -o pipefail
IFS=$'\n\t'

DEFAULT_ROOT="/etc/ssl/certs"
CUSTOM_ROOT="/usr/local/share/ca-certificates"

if [[ -z "${CERTIFICATE_URLS:-}" ]]; then
  printf "%s: Skipped, CERTIFICATE_URLS is empty.\n" "${0}"
  exit 0
fi

printf "%s\n" "Installing custom SSL certificates..."

IFS=',' read -ra urls <<< "${CERTIFICATE_URLS}"

for url in "${urls[@]}"; do
  # Trim whitespace.
  url=$(printf "%s" "${url}" | xargs)

  if [ -z "${url}" ]; then
    continue
  fi

  printf "%s\n" "Downloading certificate: ${url}."

  base_name=$(basename "${url}")
  file_name="${base_name%.*}.crt"
  install_path="${CUSTOM_ROOT}/${file_name}"

  if curl --fail --silent --show-error --location "${url}" --output "$install_path"; then
    printf "%s\n" "Downloaded ${url} to $install_path."
  else
    printf "%s\n" "ERROR: Failed to download from ${url}."
    exit 1
  fi
done

printf "%s\n" "Updating CA certificates..."
update-ca-certificates

if [[ -d "$DEFAULT_ROOT" && -z "$(ls -A "$DEFAULT_ROOT")" ]]; then
  printf "%s\n" "ERROR: No certificates exist!"
  exit 1
fi

printf "%s\n" "Custom SSL certificates installed successfully."