#!/usr/bin/env python3
"""SU HARNESS 更新服务器 HTTPS 服务（监听 443，使用 Let's Encrypt 证书）。

在 ECS 上以 root 运行（证书路径为 certbot 默认目录）：
  setsid python3 https_server.py > /tmp/https443.log 2>&1 < /dev/null &
"""
import http.server
import os
import socketserver
import ssl

CERTS_DIR = "/etc/letsencrypt/live/update.ioecs.com"
CERT = os.path.join(CERTS_DIR, "fullchain.pem")
KEY = os.path.join(CERTS_DIR, "privkey.pem")
SERVE_DIR = "/opt/suharness-update"


class ThreadingHTTPServer(socketserver.ThreadingMixIn, http.server.HTTPServer):
    daemon_threads = True


def main() -> None:
    os.chdir(SERVE_DIR)
    httpd = ThreadingHTTPServer(("0.0.0.0", 443), http.server.SimpleHTTPRequestHandler)
    ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
    ctx.load_cert_chain(CERT, KEY)
    httpd.socket = ctx.wrap_socket(httpd.socket, server_side=True)
    print(f"HTTPS update server on :443, serving {SERVE_DIR}", flush=True)
    httpd.serve_forever()


if __name__ == "__main__":
    main()