#!/usr/bin/env bash
# gen-secrets.sh —— 幂等生成本台所需密钥/证书,持久化到 ./secrets/(700,gitignore)。
#   - pangolin.env       : HY2_PASSWORD
#   - hy2/hy2.crt,hy2.key: Hysteria2 自签证书(ECDSA)
#   - cloudflare.ini     : 由 $CF_API_TOKEN 渲染(证书续期用),600
set -euo pipefail
cd "$(dirname "$0")/.."   # -> deploy/

SECRETS_DIR="./secrets"
ENV_FILE="${SECRETS_DIR}/pangolin.env"
HY2_DIR="${SECRETS_DIR}/hy2"
MASQ_CN="www.bing.com"

mkdir -p "$HY2_DIR"
chmod 700 "$SECRETS_DIR"

# Hy2 口令
if [[ -f "$ENV_FILE" ]]; then
  echo "[gen-secrets] $ENV_FILE 已存在,跳过"
else
  HY2_PASSWORD="$(openssl rand -base64 18 | tr -d '/+=' | cut -c1-24)"
  umask 177
  printf 'HY2_PASSWORD=%s\n' "$HY2_PASSWORD" > "$ENV_FILE"
  echo "[gen-secrets] 已写入 $ENV_FILE"
fi

# Hy2 自签证书
if [[ -f "${HY2_DIR}/hy2.crt" && -f "${HY2_DIR}/hy2.key" ]]; then
  echo "[gen-secrets] Hy2 证书已存在,跳过"
else
  openssl ecparam -genkey -name prime256v1 -out "${HY2_DIR}/hy2.key"
  openssl req -new -x509 -days 3650 -key "${HY2_DIR}/hy2.key" \
    -out "${HY2_DIR}/hy2.crt" -subj "/CN=${MASQ_CN}"
  chmod 644 "${HY2_DIR}/hy2.crt" "${HY2_DIR}/hy2.key"
  echo "[gen-secrets] 已写入 Hy2 证书"
fi

# Cloudflare 续期凭据(有 token 才渲染)
if [[ -n "${CF_API_TOKEN:-}" ]]; then
  umask 177
  sed "s|__CF_API_TOKEN__|${CF_API_TOKEN}|g" ./certbot/cloudflare.ini.tmpl > "${SECRETS_DIR}/cloudflare.ini"
  echo "[gen-secrets] 已渲染 cloudflare.ini"
else
  echo "[gen-secrets] 未设置 CF_API_TOKEN,跳过 cloudflare.ini(续期前需补)"
fi