#!/usr/bin/env bash
# gen-server-cert.sh — Generate the Traefik server cert for ems.famfi.dyndns.org.
#
# Signed by the private CA. Once ca.crt is trusted on a device,
# this cert is accepted without warnings.
# Renew annually (before 825-day expiry) by re-running this script.
set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
cd "$SCRIPT_DIR"

DOMAIN="${1:-ems.famfi.dyndns.org}"

if [[ ! -f ca.key ]]; then
    echo "ERROR: ca.key not found. Run gen-ca.sh first."
    exit 1
fi

echo "Generating server cert for ${DOMAIN}..."

openssl req -newkey rsa:2048 -nodes \
    -keyout server.key \
    -out server.csr \
    -subj "/CN=${DOMAIN}/O=FamFi/C=DE"

openssl x509 -req \
    -in server.csr \
    -CA ca.crt \
    -CAkey ca.key \
    -CAcreateserial \
    -out server.crt \
    -days 825 \
    -sha256 \
    -extfile <(printf "basicConstraints=CA:FALSE\nkeyUsage=critical,digitalSignature,keyEncipherment\nextendedKeyUsage=serverAuth\nsubjectAltName=DNS:%s\nsubjectKeyIdentifier=hash\nauthorityKeyIdentifier=keyid" "$DOMAIN")

chmod 600 server.key
rm -f server.csr

echo ""
echo "Done: server.crt + server.key for ${DOMAIN}"
echo ""
echo "Deploy certs to Synology (run from infra/ca/):"
echo "  ssh user@synology 'mkdir -p /etc/ems/certs'"
echo "  scp ca.crt server.crt server.key user@synology:/etc/ems/certs/"
echo "  ssh user@synology 'chmod 600 /etc/ems/certs/server.key'"
echo ""
echo "Traefik will pick up the new cert on next container restart."