#!/bin/bash
#
# Generate a self-signed PKCS12 keystore for the msh-zr web UI (HTTPS).
#
# The keystore is host-specific and contains a private key, so it must be
# created on the machine where the web UI runs (after installation).
# To use a CA / Let's Encrypt certificate instead, skip
# this script and point WEB_SSL_KEYSTORE at your own PKCS12 keystore.
#
# Usage: gen-cert [-host <hostname>] [-days <n>] [-pass <password>] [-force]
#

set -o pipefail

script_dir="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
msh_home=`realpath $script_dir/..`

source "$msh_home/lib/defaults.cf"
[ -f "$msh_home/etc/config.cf" ] && source "$msh_home/etc/config.cf"

host="$(hostname -f 2>/dev/null || hostname)"
days=3650
password="$WEB_SSL_KEYSTORE_PASSWORD"
force=no

while [ $# -gt 0 ]; do
  case "$1" in
    -host)  host="$2"; shift 2 ;;
    -days)  days="$2"; shift 2 ;;
    -pass)  password="$2"; shift 2 ;;
    -force) force=yes; shift ;;
    -h|-help|--help)
      grep '^# ' "$0" | sed 's/^# \{0,1\}//'
      exit 0
      ;;
    *) echo "Unknown option: $1" >&2; exit 1 ;;
  esac
done

# Resolve the keystore path (defaults to etc/keystore.p12 under the install dir).
keystore="${WEB_SSL_KEYSTORE:-etc/keystore.p12}"
case "$keystore" in
  /*) keystore_path="$keystore" ;;
  *)  keystore_path="$msh_home/$keystore" ;;
esac

alias="${WEB_SSL_KEY_ALIAS:-msh-zr-web}"
storetype="${WEB_SSL_KEYSTORE_TYPE:-PKCS12}"

if [ -z "$password" ]; then
  echo "Error: no keystore password. Set WEB_SSL_KEYSTORE_PASSWORD in etc/config.cf or pass -pass <password>." >&2
  exit 1
fi

if [ -f "$keystore_path" ] && [ "$force" != "yes" ]; then
  echo "Error: keystore already exists at $keystore_path (use -force to overwrite)." >&2
  exit 1
fi

# Locate keytool next to the configured Java, falling back to PATH.
keytool_bin=""
if [ -n "$MSH_JAVA_BIN" ]; then
  resolved_java="$(command -v "$MSH_JAVA_BIN" 2>/dev/null || true)"
  [ -n "$resolved_java" ] && [ -x "$(dirname "$resolved_java")/keytool" ] && keytool_bin="$(dirname "$resolved_java")/keytool"
fi
[ -z "$keytool_bin" ] && keytool_bin="$(command -v keytool 2>/dev/null || true)"

if [ -z "$keytool_bin" ]; then
  echo "Error: keytool not found. Ensure a JDK is installed and on PATH." >&2
  exit 1
fi

mkdir -p "$(dirname "$keystore_path")"
[ "$force" = "yes" ] && rm -f "$keystore_path"

"$keytool_bin" -genkeypair \
  -alias "$alias" \
  -keyalg RSA \
  -keysize 2048 \
  -validity "$days" \
  -storetype "$storetype" \
  -keystore "$keystore_path" \
  -storepass "$password" \
  -dname "CN=$host" \
  -ext "san=dns:$host"

chmod 640 "$keystore_path"

cat <<EOF

Self-signed keystore created: $keystore_path
  alias:    $alias
  host:     $host
  validity: $days days

Enable HTTPS by setting these in $msh_home/etc/config.cf, then restart msh-zr-web:
  WEB_SSL_KEYSTORE=${WEB_SSL_KEYSTORE:-etc/keystore.p12}
  WEB_SSL_KEYSTORE_PASSWORD=<the password you used>

The web UI will then serve HTTPS on port \$WEB_PORT (currently ${WEB_PORT}).
Browsers will warn about the self-signed certificate until it is trusted.
EOF
