#!/bin/bash
# Opcjonalny self-signed TLS dla panelu (nivato-<id>.local).
# Użycie: sudo /opt/nivato-logger/bin/generate-local-tls
# Potem w /etc/default/nivato-logger ustaw np. dodatkowe JAVA args albo
# uruchom z --server.ssl.* (patrz docs / ROADMAP Faza 0 HTTPS).
set -euo pipefail

. /opt/nivato-logger/bin/nivato-device-id.sh

DEFAULTS="/etc/default/nivato-logger"
[ -f "$DEFAULTS" ] && . "$DEFAULTS"

SERVICE_USER="${NIVATO_SERVICE_USER:-ubuntu}"
SERVICE_GROUP="${NIVATO_SERVICE_GROUP:-$SERVICE_USER}"
DATA_DIR="${NIVATO_DATA_DIR:-/opt/nivato-logger/data}"
SSL_DIR="$DATA_DIR/ssl"
SUFFIX=$(nivato_device_suffix | tr 'A-Z' 'a-z')
CN="nivato-${SUFFIX}.local"

mkdir -p "$SSL_DIR"
openssl req -x509 -newkey rsa:2048 -sha256 -days 825 -nodes \
    -keyout "$SSL_DIR/privkey.pem" \
    -out "$SSL_DIR/fullchain.pem" \
    -subj "/CN=${CN}/O=Nivato/OU=Logger" \
    -addext "subjectAltName=DNS:${CN},DNS:localhost,IP:127.0.0.1"

# PKCS12 dla Spring Boot (opcjonalnie)
openssl pkcs12 -export -inkey "$SSL_DIR/privkey.pem" -in "$SSL_DIR/fullchain.pem" \
    -out "$SSL_DIR/keystore.p12" -name nivato -passout pass:nivato-change-me

chmod 0640 "$SSL_DIR/fullchain.pem" "$SSL_DIR/keystore.p12"
chmod 0600 "$SSL_DIR/privkey.pem"
chown -R "$SERVICE_USER:$SERVICE_GROUP" "$SSL_DIR"

echo "Wygenerowano cert dla ${CN}"
echo "Keystore: $SSL_DIR/keystore.p12 (hasło: nivato-change-me — zmień przed produkcją)"
echo "Włącz w unitcie / EnvironmentFile, np.:"
echo "  --server.ssl.key-store=$SSL_DIR/keystore.p12"
echo "  --server.ssl.key-store-password=..."
echo "  --server.ssl.key-store-type=PKCS12"
