#!/bin/sh
set -e

CERT_DIR="/certs"
CERT_FILE="$CERT_DIR/baikal.crt"
KEY_FILE="$CERT_DIR/baikal.key"
CN="${CADDY_CERT_CN:-baikal.local}"

mkdir -p "$CERT_DIR"

if [ ! -f "$CERT_FILE" ] || [ ! -f "$KEY_FILE" ]; then
	echo "[entrypoint] Kein Zertifikat unter $CERT_DIR gefunden - erstelle neues, 100 Jahre gueltiges Zertifikat fuer CN=$CN ..."

	openssl req -x509 -nodes -newkey rsa:4096 -sha256 \
		-days 36500 \
		-keyout "$KEY_FILE" \
		-out "$CERT_FILE" \
		-subj "/C=DE/ST=Niedersachsen/L=Oldenburg/O=HackerSoft/CN=${CN}" \
		-addext "subjectAltName=DNS:${CN},DNS:localhost,IP:127.0.0.1"

	chmod 600 "$KEY_FILE"
	chmod 644 "$CERT_FILE"

	echo "[entrypoint] Zertifikat erstellt (gueltig fuer 36500 Tage / 100 Jahre)."
else
	echo "[entrypoint] Bestehendes Zertifikat in $CERT_DIR gefunden, wird weiterverwendet."
fi

exec caddy run --config /etc/caddy/Caddyfile --adapter caddyfile