#!/usr/bin/env bash
set -euo pipefail
DB=/var/lib/scpanel/scpanel.db
CERTBOT="$(command -v certbot || true)"
[[ -n "$CERTBOT" && -f "$DB" ]] || exit 0
mapfile -t DOMAINS < <(/opt/scpanel/venv/bin/python - "$DB" <<'PY'
import sqlite3,sys
c=sqlite3.connect(sys.argv[1]);
for (d,) in c.execute("SELECT domain FROM ssl_certificates WHERE auto_renew=1 AND status IN ('valid','expiring','expired') ORDER BY id"): print(d)
c.close()
PY
)
for domain in "${DOMAINS[@]}"; do
  [[ "$domain" =~ ^[A-Za-z0-9][A-Za-z0-9.-]{0,251}$ ]] || continue
  "$CERTBOT" renew --cert-name "$domain" --non-interactive --deploy-hook /opt/scpanel/scripts/scpanel-certbot-deploy-hook || true
done
