# @summary A single certificate
# @param cert_name
#   Name of the certificate, can be anything, but $::fqdn is recommended
# @param ensure    Present or absent (currently does nothing)
# @param include_self
#   Should the certificates name be one of its domains?
# @param authenticator
#   How should the challenge be handled.
# @param domains
#   List of domains to add to certificate
# @param config
#   Additional config for this entry
define letsencrypt::cert (
  Letsencrypt::Authenticator $authenticator,
  String $cert_name                 = $name,
  Enum['present', 'absent'] $ensure = 'present',
  Boolean $include_self             = true,
  Array[String] $domains            = [],
  Hash[String, Any] $config         = {},
) {
  $conf_file   = "${letsencrypt::config_dir}/${cert_name}.ini"
  $domain_file = "${letsencrypt::config_dir}/${cert_name}.domains"

  include "::letsencrypt::authenticator::${authenticator}"

  $local_conf = {
    'cert-name'           => $cert_name,
    'rsa-key-size'        => 4096,
    'authenticator'       => $authenticator,
    'agree-tos'           => true,
    'quiet'               => true,
    'keep-until-expiring' => true,
    'non-interactive'     => true,
  }

  $conf = $letsencrypt::config_ + $local_conf + $config

  file { $conf_file:
    ensure  => file,
    content => epp("${module_name}/ini.epp", { 'values' => $conf }),
  }

  concat { $domain_file:
    ensure_newline => true,
    warn           => true,
  }

  ensure_resource('letsencrypt::domain', $domains, {
      cert_name => $cert_name,
  })
  if $include_self and ! ($cert_name in $domains) {
    ensure_resource('letsencrypt::domain', $cert_name, {
        cert_name => $cert_name,
    })
  }

  letsencrypt::renew { $cert_name:
  }

  if ! ($cert_name in $facts['letsencrypt_bycertname']) {
    exec { "letsencrypt - get initial ${cert_name}":
      creates => "${letsencrypt::cert_dir}/${cert_name}",
      command => [$letsencrypt::renew::setup::renew_script, $cert_name],
      require => [
        Concat[$domain_file],
        File[$conf_file],
        File[$letsencrypt::renew::setup::renew_script],
      ],
    }
  }

  exec { "letsencrypt - refresh ${cert_name}":
    command     => [$letsencrypt::renew::setup::renew_script, $cert_name],
    subscribe   => [File[$conf_file], Concat[$domain_file]],
    refreshonly => true,
    require     => [
      Concat[$domain_file],
      File[$conf_file],
      File[$letsencrypt::renew::setup::renew_script],
    ],
  }
}