#!/usr/bin/env bash
# ============================================================
# setup.sh — First-time deployment of medium-proxy
#
# Run once from /root/medium-proxy on the Postiz LXC (192.168.1.90).
# After this, docker compose up -d --build is enough for updates.
#
# What it does:
#   1. Generates a local CA cert + a server cert for api.medium.com
#   2. Builds and starts the medium-proxy Docker container
#   3. Prints the snippet to add to /root/postiz/docker-compose.yaml
# ============================================================
set -euo pipefail

CERT_DIR="./certs"
PROXY_IP="172.19.0.100"
POSTIZ_COMPOSE="/root/postiz/docker-compose.yaml"

# ── 1. Generate TLS certs ────────────────────────────────────────────────────
mkdir -p "$CERT_DIR"

echo "→ Generating CA certificate..."
openssl genrsa -out "$CERT_DIR/ca.key" 4096 2>/dev/null
openssl req -new -x509 \
    -key "$CERT_DIR/ca.key" \
    -out "$CERT_DIR/ca.crt" \
    -days 3650 \
    -subj "/CN=Medium Proxy CA/O=Homelab" 2>/dev/null
echo "  ✓ $CERT_DIR/ca.crt"

echo "→ Generating server certificate for api.medium.com..."
openssl genrsa -out "$CERT_DIR/server.key" 2048 2>/dev/null
openssl req -new \
    -key "$CERT_DIR/server.key" \
    -out "$CERT_DIR/server.csr" \
    -subj "/CN=api.medium.com" 2>/dev/null

# SAN extension required — modern TLS clients reject certs without it
cat > "$CERT_DIR/server.ext" <<'EXTEOF'
subjectAltName=DNS:api.medium.com
EXTEOF

openssl x509 -req \
    -in "$CERT_DIR/server.csr" \
    -CA "$CERT_DIR/ca.crt" \
    -CAkey "$CERT_DIR/ca.key" \
    -CAcreateserial \
    -out "$CERT_DIR/server.crt" \
    -days 3650 \
    -extfile "$CERT_DIR/server.ext" 2>/dev/null
echo "  ✓ $CERT_DIR/server.crt"

# ── 2. Build and start the proxy ─────────────────────────────────────────────
echo "→ Building and starting medium-proxy..."
docker compose up -d --build
echo "  ✓ medium-proxy running at $PROXY_IP:443"

# ── 3. Print the Postiz docker-compose patch ─────────────────────────────────
cat << PATCHEOF

════════════════════════════════════════════════════════════════
 Add this to the 'postiz' service in $POSTIZ_COMPOSE
════════════════════════════════════════════════════════════════

    extra_hosts:
      - "api.medium.com:${PROXY_IP}"
    environment:
      NODE_EXTRA_CA_CERTS: /certs/ca.crt
    volumes:
      - /root/medium-proxy/certs/ca.crt:/certs/ca.crt:ro

Then restart only the postiz service (no data loss):
    cd /root/postiz && docker compose up -d postiz

════════════════════════════════════════════════════════════════
PATCHEOF