#!/usr/bin/env bash
set -euo pipefail
TS=$(date +%Y%m%d%H%M%S)
cp -a /etc/caddy/Caddyfile "/etc/caddy/Caddyfile.bak.public-portal.${TS}"
python3 - <<'PY'
from pathlib import Path
p=Path('/etc/caddy/Caddyfile')
s=p.read_text()
old = """    @profile_protected host sotlab.co.uk www.sotlab.co.uk webpi.sotlab.co.uk status.sotlab.co.uk music.sotlab.co.uk
    handle @profile_protected {
        reverse_proxy 127.0.0.1:8090
    }
"""
new = """    @public_portal host sotlab.co.uk www.sotlab.co.uk
    handle @public_portal {
        root * /srv/www/webpi
        file_server
    }

    @profile_protected host webpi.sotlab.co.uk status.sotlab.co.uk music.sotlab.co.uk
    handle @profile_protected {
        reverse_proxy 127.0.0.1:8090
    }
"""
if old not in s:
    raise SystemExit('expected profile_protected block not found')
p.write_text(s.replace(old,new))
PY
caddy validate --config /etc/caddy/Caddyfile
systemctl reload caddy.service
systemctl is-active --quiet caddy.service