#!/bin/bash
set -e

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
PROJECT_ROOT="$SCRIPT_DIR/.."

if [ ! -f "$PROJECT_ROOT/.env" ]; then
  echo "Файл .env не найден. Запустите сначала ./scripts/00-init.sh"
  exit 1
fi

export $(grep -v '^#' "$PROJECT_ROOT/.env" | xargs)

CERTS_DIR="$PROJECT_ROOT/nginx/certs"
CA_DIR="$PROJECT_ROOT/ca"

if ! command -v mkcert &> /dev/null; then
  echo "mkcert не установлен."
  echo "Linux: sudo apt install mkcert"
  echo "macOS: brew install mkcert nss"
  exit 1
fi

mkdir -p "$CERTS_DIR" "$CA_DIR"

DOMAINS=(
  "*.$LOCAL_DOMAIN"
  "*.$LOCAL_DOMAIN.local"
  "$LOCAL_DOMAIN"
  "localhost"
  "127.0.0.1"
  "::1"
)

if [ -n "$PUBLIC_DOMAIN" ]; then
  DOMAINS+=("*.$PUBLIC_DOMAIN" "$PUBLIC_DOMAIN")
fi

mkcert -install
mkcert \
  -cert-file "$CERTS_DIR/default.crt" \
  -key-file "$CERTS_DIR/default.key" \
  "${DOMAINS[@]}"

cp "$(mkcert -CAROOT)/rootCA.pem" "$CA_DIR/rootCA.pem"

echo "Сертификаты созданы в $CERTS_DIR"
echo "Установите корневой сертификат на устройствах:"
echo "  $CA_DIR/rootCA.pem"