#!/bin/bash
# Regenerate self-signed server certificate for ShopDB nginx
# Run this script from the repository root: bash certs/regenerate-server-cert.sh

set -e

CERT_DIR="certs"
DAYS_VALID=365

echo "=== ShopDB Server Certificate Generator ==="
echo ""

# Check if running from repo root
if [ ! -f "docker-compose.yml" ]; then
    echo "ERROR: Must run from repository root"
    echo "Usage: bash certs/regenerate-server-cert.sh"
    exit 1
fi

# Backup old certificate
if [ -f "$CERT_DIR/server.crt" ]; then
    echo "Backing up existing certificate..."
    cp "$CERT_DIR/server.crt" "$CERT_DIR/server.crt.backup"
    cp "$CERT_DIR/server.key" "$CERT_DIR/server.key.backup"
    OLD_EXPIRY=$(openssl x509 -in "$CERT_DIR/server.crt" -noout -enddate)
    echo "  Old certificate: $OLD_EXPIRY"
fi

# Generate new certificate
echo ""
echo "Generating new self-signed certificate (valid $DAYS_VALID days)..."
openssl req -x509 -newkey rsa:2048 -nodes \
  -keyout "$CERT_DIR/server.key" \
  -out "$CERT_DIR/server.crt" \
  -days $DAYS_VALID \
  -config "$CERT_DIR/openssl.cnf" 2>/dev/null

echo ""
echo "Certificate generated successfully!"
echo ""

# Show certificate details
echo "=== Certificate Details ==="
openssl x509 -in "$CERT_DIR/server.crt" -noout -subject -dates -fingerprint -sha256

echo ""
echo "=== Next Steps ==="
echo "1. Restart nginx: docker-compose restart nginx"
echo "2. If agents use ServerCertThumbprint pinning:"
echo "   - Update appsettings.json with new thumbprint (shown above)"
echo "   - Restart all agents BEFORE old certificate expires"
echo ""