#!/usr/bin/env bash
# Creates the kiosk certificates: a long lived local authority, and a server
# certificate signed by it. Install the authority on each kiosk device once.
#
#   ./scripts/gen-cert.sh                          use HTTPS_HOSTNAMES from .env
#   ./scripts/gen-cert.sh visitors.local 10.0.0.5  override the names
#   ./scripts/gen-cert.sh --force                  replace the authority too
#
# The server normally does this by itself on start, so you only need this to
# change the address list or to inspect the result before going live.
set -euo pipefail
cd "$(dirname "$0")/.."

FORCE=""
NAMES=()
for arg in "$@"; do
  if [ "$arg" = "--force" ]; then FORCE="--force"; else NAMES+=("$arg"); fi
done

if [ ${#NAMES[@]} -gt 0 ]; then
  HTTPS_HOSTNAMES="$(IFS=,; echo "${NAMES[*]}")"
  export HTTPS_HOSTNAMES
  echo "Using names: ${HTTPS_HOSTNAMES}"
fi

if docker compose ps --status running 2>/dev/null | grep -q visitor-signin; then
  docker compose exec -T visitor-signin node scripts/make-cert.mjs $FORCE
  echo "Restarting so the new certificate is served..."
  docker compose restart visitor-signin
else
  node scripts/make-cert.mjs $FORCE
fi