#!/usr/bin/env bash
# Render deploy/.env from the 1Password item. Run where `op` is authenticated,
# then scp deploy/.env to the droplet (or run this on the droplet with an
# op service-account token). Never commit the output.
set -euo pipefail

item="op://Employee/kaaso7pdpoacuvvpku7dxxjasi"
out="$(cd "$(dirname "$0")" && pwd)/.env"

read_field() { op read "$item/$1"; }

db_password="$(read_field DB_PASSWORD)"

{
  echo "CRATE_TAG=${CRATE_TAG:-latest}"
  echo "SECRET_KEY_BASE=$(read_field SECRET_KEY_BASE)"
  echo "STORE_KEY=$(read_field STORE_KEY)"
  echo "OAUTH_CLIENT_JWK=$(read_field OAUTH_CLIENT_JWK)"
  echo "DISCOGS_CONSUMER_KEY=$(read_field DISCOGS_CONSUMER_KEY)"
  echo "DISCOGS_CONSUMER_SECRET=$(read_field DISCOGS_CONSUMER_SECRET)"
  echo "BASE_URL=$(read_field BASE_URL)"
  echo "DB_PASSWORD=$db_password"
  echo "DATABASE_URL=postgres://atrecord:${db_password}@db:5432/atrecord"
} >"$out"

chmod 600 "$out"
echo "wrote $out (0600)"