#!/bin/bash

set -euo pipefail

SSL_DIR="${SOS_VAULT_SSL_DIR:-/etc/nginx/ssl/sos-vault.com}"
CORP_CA_DIR="${SOS_VAULT_CORP_CA_DIR:-/usr/local/share/ca-certificates}"

CP=/bin/cp
MKDIR=/bin/mkdir
CHMOD=/bin/chmod
OPENSSL=/usr/bin/openssl

cmd="${1:-}"
shift || true

usage() {
    cat >&2 <<EOF
usage: cert-helper {inspect|install <fullchain> <privkey>|self-signed|install-corp-ca <ca-file>}
EOF
    exit 1
}

validate_path() {
    local p="$1"
    if [[ ! "$p" =~ ^/[A-Za-z0-9./_-]+$ ]]; then
        echo "invalid path: $p" >&2
        exit 2
    fi
    if [[ ! -f "$p" ]]; then
        echo "no such file: $p" >&2
        exit 2
    fi
}

case "$cmd" in
    inspect)
        cert="$SSL_DIR/fullchain.pem"
        if [[ ! -f "$cert" ]]; then
            echo "missing: $cert" >&2
            exit 1
        fi
        "$OPENSSL" x509 -in "$cert" -noout -subject -issuer -enddate
        ;;

    self-signed)
        "$MKDIR" -p "$SSL_DIR"
        "$OPENSSL" req -x509 -newkey rsa:2048 -nodes -days 365 \
            -keyout "$SSL_DIR/privkey.pem" \
            -out "$SSL_DIR/fullchain.pem" \
            -subj '/CN=sos-vault.local'
        "$CHMOD" 644 "$SSL_DIR/fullchain.pem"
        "$CHMOD" 600 "$SSL_DIR/privkey.pem"
        ;;

    install)
        fullchain="${1:-}"
        privkey="${2:-}"
        validate_path "$fullchain"
        validate_path "$privkey"
        "$OPENSSL" x509 -in "$fullchain" -noout >/dev/null
        "$OPENSSL" pkey -in "$privkey" -noout >/dev/null
        "$MKDIR" -p "$SSL_DIR"
        "$CP" "$fullchain" "$SSL_DIR/fullchain.pem"
        "$CP" "$privkey" "$SSL_DIR/privkey.pem"
        "$CHMOD" 644 "$SSL_DIR/fullchain.pem"
        "$CHMOD" 600 "$SSL_DIR/privkey.pem"
        ;;

    install-corp-ca)
        ca="${1:-}"
        validate_path "$ca"
        "$OPENSSL" x509 -in "$ca" -noout >/dev/null
        base="$(basename "$ca")"
        target="$CORP_CA_DIR/${base%.*}.crt"
        "$MKDIR" -p "$CORP_CA_DIR"
        "$CP" "$ca" "$target"
        "$CHMOD" 644 "$target"
        ;;

    *)
        usage
        ;;
esac
