#!/usr/bin/env bash
# Creates a self-signed certificate so the kiosk can use the camera over https.
# Give it the address staff will actually type, e.g.  ./gen-cert.sh visitors.local 192.168.1.50
set -euo pipefail

OUT_DIR="${OUT_DIR:-./data/certs}"
PRIMARY="${1:-visitors.local}"
shift || true

mkdir -p "$OUT_DIR"

ALT="DNS:${PRIMARY}"
INDEX=1
for extra in "$@"; do
  if [[ "$extra" =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
    ALT="${ALT},IP:${extra}"
  else
    ALT="${ALT},DNS:${extra}"
  fi
  INDEX=$((INDEX + 1))
done
ALT="${ALT},DNS:localhost,IP:127.0.0.1"

openssl req -x509 -nodes -newkey rsa:2048 -days 1095 \
  -keyout "${OUT_DIR}/server.key" \
  -out "${OUT_DIR}/server.crt" \
  -subj "/C=AU/ST=Victoria/L=Melbourne/O=Visitor Sign In/CN=${PRIMARY}" \
  -addext "subjectAltName=${ALT}" \
  -addext "basicConstraints=CA:FALSE" \
  -addext "keyUsage=digitalSignature,keyEncipherment" \
  -addext "extendedKeyUsage=serverAuth"

chmod 600 "${OUT_DIR}/server.key"

echo
echo "Certificate written to ${OUT_DIR}"
echo "Names covered: ${ALT}"
echo
echo "Next: set HTTPS_ENABLED=true in .env, then restart the container."
echo "Install ${OUT_DIR}/server.crt as a trusted root on each kiosk device to stop the warning."