#!/usr/bin/env bash
# gen-secrets.sh —— 首次在 EC2 生成并持久化密钥/证书(幂等)。
# 产物存于 ./secrets/(700,gitignore,绝不进仓库/CI 日志)。
#   - pangolin.env : UUID / REALITY 公私钥 / shortId / Hy2 口令
#   - hy2/hy2.crt, hy2/hy2.key : Hysteria2 自签证书(ECDSA)
set -euo pipefail
cd "$(dirname "$0")/.."   # -> deploy/

SECRETS_DIR="./secrets"
ENV_FILE="${SECRETS_DIR}/pangolin.env"
HY2_DIR="${SECRETS_DIR}/hy2"
XRAY_IMAGE="ghcr.io/xtls/xray-core:26.3.27"
MASQ_CN="www.bing.com"

mkdir -p "$HY2_DIR"
chmod 700 "$SECRETS_DIR"

if [[ -f "$ENV_FILE" ]]; then
  echo "[gen-secrets] $ENV_FILE 已存在,跳过密钥生成(幂等)"
else
  echo "[gen-secrets] 生成 REALITY 密钥对 / UUID / shortId / Hy2 口令 ..."
  # REALITY x25519 密钥对(从 xray 输出解析 Private/Public)
  KP="$(docker run --rm "$XRAY_IMAGE" x25519)"
  REALITY_PRIVATE_KEY="$(printf '%s\n' "$KP" | awk -F': ' '/Private/{print $2}')"
  REALITY_PUBLIC_KEY="$(printf '%s\n' "$KP" | awk -F': ' '/Public/{print $2}')"
  UUID="$(cat /proc/sys/kernel/random/uuid)"
  REALITY_SHORT_ID="$(openssl rand -hex 8)"
  HY2_PASSWORD="$(openssl rand -base64 18 | tr -d '/+=' | cut -c1-24)"

  umask 177
  cat > "$ENV_FILE" <<EOF
# pangolin Phase-0 secrets —— 切勿提交/外泄
UUID=${UUID}
REALITY_PRIVATE_KEY=${REALITY_PRIVATE_KEY}
REALITY_PUBLIC_KEY=${REALITY_PUBLIC_KEY}
REALITY_SHORT_ID=${REALITY_SHORT_ID}
HY2_PASSWORD=${HY2_PASSWORD}
EOF
  echo "[gen-secrets] 已写入 $ENV_FILE"
fi

# Hysteria2 自签证书(幂等)
if [[ -f "${HY2_DIR}/hy2.crt" && -f "${HY2_DIR}/hy2.key" ]]; then
  echo "[gen-secrets] Hy2 证书已存在,跳过"
else
  echo "[gen-secrets] 生成 Hy2 自签证书 (CN=${MASQ_CN}) ..."
  openssl ecparam -genkey -name prime256v1 -out "${HY2_DIR}/hy2.key"
  openssl req -new -x509 -days 3650 -key "${HY2_DIR}/hy2.key" \
    -out "${HY2_DIR}/hy2.crt" -subj "/CN=${MASQ_CN}"
  # sing-box 容器内以 root 运行,证书需可读
  chmod 644 "${HY2_DIR}/hy2.crt" "${HY2_DIR}/hy2.key"
  echo "[gen-secrets] 已写入 Hy2 证书"
fi