#!/bin/sh
set -eu
ECH_EXCLUDE="[REDACTED] check.dnsbunker.org"
out=/run/caddy/caddy.json
/usr/bin/caddy adapt --config /etc/caddy/Caddyfile --adapter caddyfile > "$out.adapted"
ECH_EXCLUDE="$ECH_EXCLUDE" /usr/bin/python3 -I - "$out.adapted" "$out.tmp" <<'PY'
import json, os, sys
c = json.load(open(sys.argv[1]))
exclude = set(os.environ["ECH_EXCLUDE"].split())
hosts = set()
for srv in c.get("apps", {}).get("http", {}).get("servers", {}).values():
    for route in srv.get("routes", []):
        for m in route.get("match", []):
            hosts.update(h for h in m.get("host", []) if "*" not in h)
tls = c.get("apps", {}).get("tls", {})
ech = tls.get("encrypted_client_hello")
if ech:
    pubs = ech.get("publication") or ([{"publishers": {"dns": {"provider": tls["dns"]}}}] if tls.get("dns") else [])
    for pub in pubs:
        pub["domains"] = sorted(hosts - exclude)
    ech["publication"] = pubs
tls["session_tickets"] = {"rotation_interval": "1h", "max_keys": 2}
c.setdefault("apps", {})["tls"] = tls
json.dump(c, open(sys.argv[2], "w"))
PY
rm -f "$out.adapted"
mv -f "$out.tmp" "$out"