#!/usr/bin/env bash
set -euo pipefail

deploy_dir="${1:-$(pwd)}"
certificate_dir="${deploy_dir}/proxy/certs"
certificate_file="${certificate_dir}/agentdock.crt"
key_file="${certificate_dir}/agentdock.key"

mkdir -p "${certificate_dir}"
chmod 755 "${certificate_dir}"

if [[ -f "${certificate_file}" && -f "${key_file}" ]]; then
  printf 'Existing AgentDock certificate kept: %s\n' "${certificate_file}"
  exit 0
fi

openssl req -x509 -nodes -newkey rsa:2048 -sha256 -days 3650 \
  -keyout "${key_file}" \
  -out "${certificate_file}" \
  -subj "/CN=192.168.200.36/O=AgentDock LAN" \
  -addext "subjectAltName=IP:192.168.200.36" \
  -addext "keyUsage=digitalSignature,keyEncipherment" \
  -addext "extendedKeyUsage=serverAuth"

chmod 644 "${key_file}"
chmod 644 "${certificate_file}"
printf 'AgentDock certificate created: %s\n' "${certificate_file}"