<?php

// Stalwart mail, get DNS entries for DANE

$api_key = "STALWART_API_KEY";
$url = "https://STALWART_DOMAIN/api/dns/records/STALWART_DOMAIN";

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_HTTPHEADER, array('Authorization: Bearer ' . $api_key));
$response = curl_exec($ch);
curl_close($ch);

// Now we update cloudflare records
$cloudflare_api_key = "CLOUDFLARE_API_KEY";
$domain = "STALWART_DOMAIN";

// Get the zone ID for the domain
$zone_url = "https://api.cloudflare.com/client/v4/zones?name=$domain";
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $zone_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    "Authorization: Bearer $cloudflare_api_key",
    "Content-Type: application/json"
]);
$zone_response = curl_exec($ch);
curl_close($ch);

$zone_data = json_decode($zone_response, true);
$zone_id = $zone_data['result'][0]['id'];

// Fetch existing DNS records to get their IDs
$dns_records_url = "https://api.cloudflare.com/client/v4/zones/$zone_id/dns_records";
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $dns_records_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    "Authorization: Bearer $cloudflare_api_key",
    "Content-Type: application/json"
]);
$dns_records_response = curl_exec($ch);
curl_close($ch);

$dns_records_data = json_decode($dns_records_response, true);

// Delete all existing TLSA records
foreach ($dns_records_data['result'] as $existing_record) {
    if ($existing_record['type'] === 'TLSA') {
        $dns_record_id = $existing_record['id'];
        $delete_url = "https://api.cloudflare.com/client/v4/zones/$zone_id/dns_records/$dns_record_id";

        $ch = curl_init();
        curl_setopt($ch, CURLOPT_URL, $delete_url);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
        curl_setopt($ch, CURLOPT_CUSTOMREQUEST, "DELETE");
        curl_setopt($ch, CURLOPT_HTTPHEADER, [
            "Authorization: Bearer $cloudflare_api_key",
            "Content-Type: application/json"
        ]);

        $delete_response = curl_exec($ch);
        curl_close($ch);

        echo "Deleted TLSA record: {$existing_record['name']}\n";
    }
}

// Add new TLSA records
$dns_records = json_decode($response, true)['data'];
foreach ($dns_records as $record) {
    if ($record['type'] === 'TLSA') {
        $add_url = "https://api.cloudflare.com/client/v4/zones/$zone_id/dns_records";

        // Split the TLSA content into its components
        list($usage, $selector, $matching_type, $certificate) = explode(' ', $record['content'], 4);

        $dns_data = [
            "type" => $record['type'],
            "name" => rtrim($record['name'], '.'),
            "data" => [
                "usage" => $usage,
                "selector" => $selector,
                "matching_type" => $matching_type,
                "certificate" => $certificate
            ],
            "proxied" => false
        ];

        $ch = curl_init();
        curl_setopt($ch, CURLOPT_URL, $add_url);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
        curl_setopt($ch, CURLOPT_POST, 1);
        curl_setopt($ch, CURLOPT_HTTPHEADER, [
            "Authorization: Bearer $cloudflare_api_key",
            "Content-Type: application/json"
        ]);
        curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($dns_data));

        $add_response = curl_exec($ch);
        curl_close($ch);

        echo "Added TLSA record: {$record['name']}\n";
    }
}