#!/usr/bin/env bash
set -euo pipefail

# ---------------------------------------------------------------------------
# generate-minio-tls.sh — One-time: generate CA + server cert for MinIO TLS
# ---------------------------------------------------------------------------
# Creates:
#   ConfigMap/minio-ca-cert    — CA public cert (mounted everywhere)
#   Secret/minio-tls           — server cert+key (mounted only by MinIO)
#
# SANs cover all K8s DNS forms for the minio Service in foxhunt namespace.
# Run from any machine with openssl + kubectl access to the cluster.
# ---------------------------------------------------------------------------

NAMESPACE="${NAMESPACE:-foxhunt}"
CA_DAYS=3650          # 10 years
SERVER_DAYS=730       # 2 years
WORK_DIR="$(mktemp -d)"
trap 'rm -rf "$WORK_DIR"' EXIT

echo "=== Generating MinIO TLS certs (workdir: $WORK_DIR) ==="

# --- CA (self-signed, 10 years) -------------------------------------------
openssl genrsa -out "$WORK_DIR/ca.key" 4096
openssl req -new -x509 \
  -key "$WORK_DIR/ca.key" \
  -out "$WORK_DIR/ca.crt" \
  -days "$CA_DAYS" \
  -subj "/CN=foxhunt-minio-ca/O=foxhunt"

# --- Server cert (signed by CA, 2 years) ----------------------------------
cat > "$WORK_DIR/server.cnf" <<EOF
[req]
default_bits = 2048
prompt = no
distinguished_name = dn
req_extensions = v3_req

[dn]
CN = minio

[v3_req]
subjectAltName = @alt_names

[alt_names]
DNS.1 = minio
DNS.2 = minio.${NAMESPACE}
DNS.3 = minio.${NAMESPACE}.svc
DNS.4 = minio.${NAMESPACE}.svc.cluster.local
EOF

openssl genrsa -out "$WORK_DIR/private.key" 2048
openssl req -new \
  -key "$WORK_DIR/private.key" \
  -out "$WORK_DIR/server.csr" \
  -config "$WORK_DIR/server.cnf"

openssl x509 -req \
  -in "$WORK_DIR/server.csr" \
  -CA "$WORK_DIR/ca.crt" \
  -CAkey "$WORK_DIR/ca.key" \
  -CAcreateserial \
  -out "$WORK_DIR/public.crt" \
  -days "$SERVER_DAYS" \
  -extensions v3_req \
  -extfile "$WORK_DIR/server.cnf"

echo "=== Verifying cert chain ==="
openssl verify -CAfile "$WORK_DIR/ca.crt" "$WORK_DIR/public.crt"

# --- Create K8s resources --------------------------------------------------
echo "=== Creating ConfigMap/minio-ca-cert ==="
kubectl -n "$NAMESPACE" create configmap minio-ca-cert \
  --from-file=ca.crt="$WORK_DIR/ca.crt" \
  --dry-run=client -o yaml | kubectl apply -f -

echo "=== Creating Secret/minio-tls ==="
kubectl -n "$NAMESPACE" create secret generic minio-tls \
  --from-file=public.crt="$WORK_DIR/public.crt" \
  --from-file=private.key="$WORK_DIR/private.key" \
  --dry-run=client -o yaml | kubectl apply -f -

echo "=== Done ==="
echo "ConfigMap: minio-ca-cert  (key: ca.crt)"
echo "Secret:   minio-tls       (keys: public.crt, private.key)"
echo ""
echo "Next steps:"
echo "  1. kubectl apply -f infra/k8s/minio/minio.yaml"
echo "  2. Verify: kubectl -n $NAMESPACE exec deploy/minio -- curl -s --cacert /root/.minio/certs/CAs/ca.crt https://localhost:9000/minio/health/ready"