#!/usr/bin/env bash
set -euo pipefail

ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
ENV_FILE="${ROOT_DIR}/.env.prod"

cd "$ROOT_DIR"

if [[ ! -f "$ENV_FILE" ]]; then
    echo "Missing ${ENV_FILE}. Copy .env.example to .env.prod and configure it." >&2
    exit 1
fi

# shellcheck disable=SC1090
set -a
source "$ENV_FILE"
set +a

if [[ -z "${CLEARNET_DOMAIN:-}" ]]; then
    echo "CLEARNET_DOMAIN is not set in .env.prod" >&2
    exit 1
fi

LIVE_DIR="${ROOT_DIR}/deploy/certs/live/${CLEARNET_DOMAIN}"

if [[ -f "${LIVE_DIR}/fullchain.pem" ]]; then
    echo "Certificates already exist at deploy/certs/live/${CLEARNET_DOMAIN}" >&2
    exit 1
fi

mkdir -p "$LIVE_DIR"

openssl req -x509 -nodes -newkey rsa:2048 -days 1 \
    -keyout "${LIVE_DIR}/privkey.pem" \
    -out "${LIVE_DIR}/fullchain.pem" \
    -subj "/CN=${CLEARNET_DOMAIN}"

echo "Temporary self-signed certificates created at deploy/certs/live/${CLEARNET_DOMAIN}"