#!/usr/bin/env bash
#
# Generates a .env file with freshly generated secrets.
#
#   ./docs/generate-env.sh          # writes ./.env
#   ./docs/generate-env.sh --print  # prints to stdout instead
#
# Every generated value is hex or base64, neither of which contains "$".
# A literal "$" in a value would be read by Docker Compose as a variable
# reference and silently dropped, so avoid one if you edit these by hand.

set -euo pipefail

OUT=".env"
PRINT_ONLY=0

for arg in "$@"; do
  case "$arg" in
    --print) PRINT_ONLY=1 ;;
    -h|--help) sed -n '2,12p' "$0" | sed 's/^# \{0,1\}//'; exit 0 ;;
    *) echo "unknown option: $arg" >&2; exit 1 ;;
  esac
done

if ! command -v openssl >/dev/null 2>&1; then
  echo "openssl is required but was not found on PATH." >&2
  exit 1
fi

if [ "$PRINT_ONLY" -eq 0 ] && { [ -e "$OUT" ] || [ -L "$OUT" ]; }; then
  echo "$OUT already exists. Move or delete it first, or use --print." >&2
  exit 1
fi

# ENCRYPTION_KEY must be exactly 64 hex characters; the others are free-form.
JWT_SECRET="$(openssl rand -base64 48)"
DB_PASSWORD="$(openssl rand -base64 24)"
ENCRYPTION_KEY="$(openssl rand -hex 32)"
SESSION_SECRET="$(openssl rand -base64 48)"
MINIO_SECRET_KEY="$(openssl rand -base64 24)"

render() {
cat <<ENV
# Generated by docs/generate-env.sh
#
# Secrets below are freshly generated. Replace the URLs with your own domain
# before starting the stack.
#
# Do not put a literal dollar sign in any value: Docker Compose reads it as a
# variable reference and silently drops it. Double it to escape one.

NODE_ENV=production
JWT_SECRET=${JWT_SECRET}
DB_NAME=maxun
DB_USER=postgres
DB_PASSWORD=${DB_PASSWORD}
DB_HOST=postgres
DB_PORT=5432
ENCRYPTION_KEY=${ENCRYPTION_KEY}
SESSION_SECRET=${SESSION_SECRET}
MINIO_ENDPOINT=minio
MINIO_PORT=9000
MINIO_CONSOLE_PORT=9001
MINIO_ACCESS_KEY=minio
MINIO_SECRET_KEY=${MINIO_SECRET_KEY}
REDIS_HOST=maxun-redis
REDIS_PORT=6379
REDIS_PASSWORD=
BACKEND_PORT=8080
FRONTEND_PORT=5173
BACKEND_URL=https://maxun.my.domain
PUBLIC_URL=https://maxun.my.domain
VITE_BACKEND_URL=https://maxun.my.domain
VITE_PUBLIC_URL=https://maxun.my.domain
GOOGLE_CLIENT_ID=
GOOGLE_CLIENT_SECRET=
GOOGLE_REDIRECT_URI=
AIRTABLE_CLIENT_ID=
AIRTABLE_REDIRECT_URI=
MAXUN_TELEMETRY=true
ENV
}

if [ "$PRINT_ONLY" -eq 1 ]; then
  render
else
  (umask 077; render > "$OUT")
  chmod 600 "$OUT"
  echo "Wrote $OUT with generated secrets."
  echo "Edit the BACKEND_URL / PUBLIC_URL lines to match your domain before starting."
fi