#!/usr/bin/env bash
# gen-ca.sh — Generate the EMS root CA (one-time operation).
#
# Outputs: ca.key (KEEP SECRET) and ca.crt (distribute to all devices).
# ca.key must be backed up encrypted and kept off the Synology.
# Losing ca.key means all devices must re-enroll after generating a new CA.
set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
cd "$SCRIPT_DIR"

if [[ -f ca.key ]]; then
    echo "ERROR: ca.key already exists."
    echo "Delete it explicitly if you intend to replace the CA."
    echo "WARNING: a new CA invalidates ALL existing server and client certs — every device must re-enroll."
    exit 1
fi

echo "Generating EMS root CA (RSA-4096, 10 years)..."

openssl req -x509 -newkey rsa:4096 -sha256 \
    -days 3650 \
    -keyout ca.key \
    -out ca.crt \
    -nodes \
    -subj "/CN=EMS Private CA/O=FamFi/C=DE" \
    -addext "basicConstraints=critical,CA:TRUE,pathlen:0" \
    -addext "keyUsage=critical,keyCertSign,cRLSign" \
    -addext "subjectKeyIdentifier=hash"

chmod 600 ca.key

echo ""
echo "Done."
echo "  ca.crt  — distribute to devices (install as trusted root)"
echo "  ca.key  — KEEP SECRET: store in encrypted backup, remove from Synology after cert issuance"
echo ""
echo "Next steps:"
echo "  ./gen-server-cert.sh          # server cert for Traefik"
echo "  ./issue-client-cert.sh <name> # one per device"