@echo off
REM ============================================================
REM gen-cert.bat - genereaza cert self-signed pt HTTPS local
REM ============================================================
REM Folosit doar pentru DEV LOCAL (cand rulati docker compose pe laptop).
REM Pentru DEPLOY pe student-dev.ro NU aveti nevoie - nginx-ul cursului
REM se ocupa de cert Let's Encrypt automat.
REM
REM Output: server.crt + server.key in folderul curent (certs/).
REM Browser-ul va da warning "Connection not private" - normal pt self-signed.
REM ============================================================

setlocal
cd /d "%~dp0"

REM Cauta openssl: pe PATH sau in Git for Windows
where openssl >nul 2>&1
if %errorlevel%==0 (
    set "OPENSSL=openssl"
) else if exist "C:\Program Files\Git\usr\bin\openssl.exe" (
    set "OPENSSL=C:\Program Files\Git\usr\bin\openssl.exe"
) else (
    echo [ERROR] OpenSSL nu e instalat. Instalati Git for Windows ^(include openssl^) sau OpenSSL standalone.
    exit /b 1
)

echo Generez cert self-signed pentru localhost ^(valabilitate 365 zile^)...

REM -x509     = self-signed (nu CSR)
REM -newkey   = genereaza si cheie privata
REM rsa:4096  = RSA 4096 bits (foarte sigur, dar mai lent)
REM -keyout   = unde scrie cheia privata
REM -out      = unde scrie certul public
REM -days     = valabilitate
REM -nodes    = no DES (cheia NU e encrypted - usor pt dev, niciodata pt prod)
REM -subj     = subject (CN = Common Name = hostname-ul pt care e valid certul)
"%OPENSSL%" req -x509 -newkey rsa:4096 ^
    -keyout server.key ^
    -out server.crt ^
    -days 365 ^
    -nodes ^
    -subj "/CN=localhost"

if %errorlevel% neq 0 (
    echo [ERROR] Generarea certului a esuat.
    exit /b 1
)

echo.
echo [OK] Cert generat: server.crt + server.key
echo Acum puteti rula: docker compose up -d --build
endlocal
