#!/usr/bin/env bash
# 產生自簽 SSL 憑證供 Uvicorn HTTPS 使用
# 用法: bash certs/generate_cert.sh

set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
CERT_FILE="${SCRIPT_DIR}/cert.pem"
KEY_FILE="${SCRIPT_DIR}/key.pem"
DAYS=3650

if [ -f "$CERT_FILE" ] && [ -f "$KEY_FILE" ]; then
    echo "憑證已存在: ${CERT_FILE}, ${KEY_FILE}"
    echo "如需重新產生，請先刪除後再執行。"
    exit 0
fi

openssl req -x509 -newkey rsa:2048 -nodes \
    -keyout "$KEY_FILE" \
    -out "$CERT_FILE" \
    -days "$DAYS" \
    -subj "/CN=$(hostname)" \
    -addext "subjectAltName=DNS:$(hostname),IP:0.0.0.0"

echo "已產生自簽憑證（有效 ${DAYS} 天）:"
echo "  cert: ${CERT_FILE}"
echo "  key:  ${KEY_FILE}"