#!/usr/bin/env bash
# ============================================================
# gen-cert.sh - genereaza cert self-signed pt HTTPS local
# ============================================================
# Folosit doar pentru DEV LOCAL (cand rulati docker compose pe laptop).
# Pentru DEPLOY pe student-dev.ro NU aveti nevoie - nginx-ul cursului
# se ocupa de cert Let's Encrypt automat.
#
# Output: server.crt + server.key in folderul curent (certs/).
# Browser-ul va da warning "Connection not private" - normal pt self-signed.
# ============================================================
set -euo pipefail

cd "$(dirname "$0")"

if ! command -v openssl &>/dev/null; then
    echo "[ERROR] OpenSSL nu e instalat."
    echo "  - macOS: vine preinstalat"
    echo "  - Linux: sudo apt install openssl"
    echo "  - Windows: foloseste gen-cert.bat"
    exit 1
fi

echo "Generez cert self-signed pentru localhost (valabilitate 365 zile)..."

# -x509     = self-signed (nu CSR)
# -newkey   = genereaza si cheie privata
# rsa:4096  = RSA 4096 bits (foarte sigur, dar mai lent)
# -keyout   = unde scrie cheia privata
# -out      = unde scrie certul public
# -days     = valabilitate
# -nodes    = no DES (cheia NU e encrypted - usor pt dev, niciodata pt prod)
# -subj     = subject (CN = Common Name = hostname-ul pt care e valid certul)
openssl req -x509 -newkey rsa:4096 \
    -keyout server.key \
    -out server.crt \
    -days 365 \
    -nodes \
    -subj "/CN=localhost"

echo ""
echo "[OK] Cert generat: server.crt + server.key"
echo "Acum puteti rula: docker compose up -d --build"
