#!/bin/sh
set -eu

CERTS=${1:-"$(cd "$(dirname "$0")/.." && pwd)/certs"}
mkdir -p "$CERTS"
umask 077

if [ ! -s "$CERTS/root.crt" ]; then
  openssl req -x509 -newkey rsa:2048 \
    -keyout "$CERTS/root.key" -out "$CERTS/root.crt" \
    -days 3650 -nodes \
    -subj "/CN=Tangled Dev CA" \
    -addext "basicConstraints=critical,CA:TRUE,pathlen:1" \
    -addext "keyUsage=critical,keyCertSign,cRLSign" \
    -addext "nameConstraints=critical,permitted;DNS:tngl.boltless.dev"
fi

if [ ! -s "$CERTS/github.env" ]; then
  secret=$(head -c 24 /dev/urandom | od -An -tx1 | tr -d ' \n')
  cat > "$CERTS/github.env" <<EOF
GITHUB_CLIENT_ID=ghstub-client-id
GITHUB_CLIENT_SECRET=ghstub-client-secret
GITHUB_SESSION_SECRET=${secret}
GITHUB_APP_SLUG=tangled-dev-stub
EOF
fi

gen_key() {
  if command -v go >/dev/null 2>&1; then
    go run ./cmd/knotmirror generate-service-auth-key
  else
    nix develop .#default -c go run ./cmd/knotmirror generate-service-auth-key
  fi
}

# openssl cannot make an atproto multibase secp256k1 key
if [ ! -s "$CERTS/migrator.env" ]; then
  gen_key | sed 's/^MIRROR_SERVICE_PRIVATE_KEY=/MIGRATOR_PRIVATE_KEY=/' > "$CERTS/migrator.env"
  {
    printf 'MIGRATOR_MASTER_KEY=%s\n' "$(head -c 32 /dev/urandom | base64)"
    printf 'MIGRATOR_API_TOKEN=%s\n' "$(head -c 24 /dev/urandom | od -An -tx1 | tr -d ' \n')"
    printf 'MIGRATOR_URL=https://migrator.tngl.boltless.dev\n'
    printf 'MIGRATOR_DID=did:web:migrator.tngl.boltless.dev\n'
    printf 'MIGRATOR_PLC_URL=https://plc.tngl.boltless.dev\n'
    printf 'MIGRATOR_GITHUB_HOST=github.tngl.boltless.dev\n'
  } >> "$CERTS/migrator.env"
fi

if [ ! -s "$CERTS/service-auth.env" ]; then
  gen_key > "$CERTS/service-auth.env"
fi

printf 'certs and keys are ready in %s\n' "$CERTS"