#!/bin/sh
set -eu

PKI_ROOT=/etc/lisglosips/pki
CA_DIR="$PKI_ROOT/ca"
CERT_DIR="$PKI_ROOT/certs"
PRIVATE_DIR="$PKI_ROOT/private"
HOST_NAME=${HOST_NAME:-yanzi}
TAILSCALE_IP=${TAILSCALE_IP:-100.90.90.91}

umask 077
install -d -m 0700 "$CA_DIR"
install -d -m 0755 "$CERT_DIR"
install -d -m 0700 "$PRIVATE_DIR"

if [ ! -s "$CA_DIR/lisglosips-dev-ca.key" ] || [ ! -s "$CA_DIR/lisglosips-dev-ca.crt" ]; then
  openssl req -x509 -newkey rsa:4096 -sha256 -days 3650 -nodes \
    -subj '/CN=LisgloSIPS Development CA/O=LisgloSIPS' \
    -keyout "$CA_DIR/lisglosips-dev-ca.key" \
    -out "$CA_DIR/lisglosips-dev-ca.crt"
fi

cat >"$PKI_ROOT/server-cert.cnf" <<EOF
[req]
prompt = no
distinguished_name = dn
req_extensions = req_ext

[dn]
CN = lisglosips.local
O = LisgloSIPS

[req_ext]
subjectAltName = @alt_names

[alt_names]
DNS.1 = lisglosips.local
DNS.2 = $HOST_NAME
DNS.3 = grafana.lisglosips.local
DNS.4 = homer.lisglosips.local
IP.1 = $TAILSCALE_IP
IP.2 = 127.0.0.1

[server_ext]
basicConstraints = critical,CA:FALSE
keyUsage = critical,digitalSignature,keyEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names
EOF

openssl req -new -newkey rsa:3072 -nodes -sha256 \
  -config "$PKI_ROOT/server-cert.cnf" \
  -keyout "$PRIVATE_DIR/server.key" \
  -out "$PKI_ROOT/server.csr"

openssl x509 -req -sha256 -days 397 \
  -in "$PKI_ROOT/server.csr" \
  -CA "$CA_DIR/lisglosips-dev-ca.crt" \
  -CAkey "$CA_DIR/lisglosips-dev-ca.key" \
  -CAcreateserial \
  -extfile "$PKI_ROOT/server-cert.cnf" \
  -extensions server_ext \
  -out "$CERT_DIR/server.crt"

chown root:root "$CA_DIR/lisglosips-dev-ca.key" "$PKI_ROOT/server.csr" "$PKI_ROOT/server-cert.cnf"
chown root:www-data "$PRIVATE_DIR/server.key"
chown root:root "$CA_DIR/lisglosips-dev-ca.crt" "$CERT_DIR/server.crt"
chmod 0600 "$CA_DIR/lisglosips-dev-ca.key" "$PKI_ROOT/server.csr" "$PKI_ROOT/server-cert.cnf"
chmod 0640 "$PRIVATE_DIR/server.key"
chmod 0644 "$CA_DIR/lisglosips-dev-ca.crt" "$CERT_DIR/server.crt"

openssl verify -CAfile "$CA_DIR/lisglosips-dev-ca.crt" "$CERT_DIR/server.crt"