# Tooling — config rendering, mod sync, ingress, fetch scripts

## Summary

Scripts in `./tooling/` turn `BASE_DOMAIN` + templates into a working stack and
handle ingress (nginx vhost, TLS certs) and launcher/font fetches. All are
**cautious**: they halt on unset vars or missing inputs rather than emit
half-broken output.

Surviving scripts:

- `render-config.sh` — render `*.tmpl` configs (BASE_DOMAIN only)
- `classify-mods.py` — read each jar's `neoforge.mods.toml`, seed `mods-sides.json` (see 04-mods.md)
- `sync-server-mods.sh` — copy `both`/`server` jars from the distribution → `./server-mods` (see 04-mods.md)
- `build-modlist.py` — generate the landing `mods.json` + extract logos (see 17-mod-shortlist.md)
- `render-nginx.sh` — render/install the host nginx vhost (TLS terminator → caddy)
- `issue-letsencrypt.sh` — issue LE certs via OVH DNS-01 (see 15-letsencrypt.md)
- `fetch-launcher.sh` — download Fjord launcher release assets (see 06-launcher.md)
- `fetch-authlib.sh` — vendor the authlib-injector jar → `runtime/`
- `fetch-fonts.sh` — vendor the landing page fonts (see 09-landing.md)

## render-config.sh

Renders every `*.tmpl` into its real config by substituting **only**
`${BASE_DOMAIN}` (so literal `$`-syntax belonging to the target file — caddy,
toml — is left untouched). Caddy is excluded entirely (it reads `{$BASE_DOMAIN}`
natively).

Targets:
- `drasl/config/config.toml.tmpl` → `drasl/config/config.toml`
- `nmsr/config.toml.tmpl`         → `nmsr/config.toml`

Mods are **not** rendered — they are synced from the distribution by
`sync-server-mods.sh` (see 04-mods.md), no templating involved.

```bash
#!/usr/bin/env bash
set -euo pipefail
cd "$(dirname "$0")/.."
[ -f .env ] && { set -a; . ./.env; set +a; }
: "${BASE_DOMAIN:?BASE_DOMAIN unset (set in .env)}"

render() {  # $1=tmpl  $2=out
  [ -f "$1" ] || { echo "missing template: $1" >&2; exit 1; }
  envsubst '${BASE_DOMAIN}' < "$1" > "$2"
  echo "rendered $2"
}

render drasl/config/config.toml.tmpl drasl/config/config.toml
render nmsr/config.toml.tmpl          nmsr/config.toml
```

## render-nginx.sh

Renders `nginx/ulicraft-caddy.conf.tmpl` (the host nginx that terminates TLS in
front of caddy), substituting `$BASE_DOMAIN $APP_DIR $CADDY_HTTP_PORT`. Prints to
stdout by default; `--install` writes to sites-available, symlinks sites-enabled,
`nginx -t`, and reloads nginx. See `15-letsencrypt.md`.

## issue-letsencrypt.sh

Issues a separate cert for the apex and each `LE_SUBDOMAINS` entry via acme.sh +
OVH DNS-01 → `certs/<name>/{cert,key}.pem`. See `15-letsencrypt.md`.

## fetch-launcher.sh

Downloads FjordLauncherUnlocked release assets → `launcher/<tag>/` and maintains
a `latest` symlink + stable per-OS filename symlinks. Full script in
`06-launcher.md`.

## Generated / gitignored

```
drasl/config/config.toml      # rendered
nmsr/config.toml              # rendered
launcher/                     # launcher assets
www/                          # landing build output
certs/                        # Let's Encrypt certs
.env                          # secrets + host-specific
```

## Tasks

- [ ] Write `tooling/render-config.sh` (above), `chmod +x`
- [ ] Write `tooling/sync-server-mods.sh` (see 04-mods.md)
- [ ] Write `tooling/render-nginx.sh` (see 15)
- [ ] Write `tooling/issue-letsencrypt.sh` (see 15)
- [ ] Write `tooling/fetch-launcher.sh` (see 06)
- [ ] Add `gettext` (envsubst) + `jq` to host prereqs doc
- [ ] Update `.gitignore` for rendered configs + `launcher/` + `www/` + `certs/`