#!/usr/bin/env bash
# Remove Caddy's stored certificate material for exactly ONE domain.
# Root-only helper so 'paas remove' (running as deploy) can wipe certs.
set -euo pipefail
d="${1:-}"
# strict hostname check: no slashes, no leading/trailing dot or dash
[[ "$d" =~ ^[a-z0-9]([a-z0-9.-]*[a-z0-9])?$ ]] || { echo "paas-cert-prune: invalid domain '$d'" >&2; exit 2; }
base=/var/lib/caddy/.local/share/caddy/certificates
shopt -s nullglob
for dir in "$base"/*/"$d"; do
    rm -rf "$dir"
    echo "removed $dir"
done
exit 0