#!/usr/bin/env bash
set -Eeuo pipefail

usage() {
  echo '用法：generate-env.sh --public-host admin.example.com --files-host files.example.com [--output /etc/lehuo/lehuo.env]'
}

public_host=''
files_host=''
output='/etc/lehuo/lehuo.env'
while (($#)); do
  case "$1" in
    --public-host) public_host="${2:-}"; shift 2 ;;
    --files-host) files_host="${2:-}"; shift 2 ;;
    --output) output="${2:-}"; shift 2 ;;
    -h|--help) usage; exit 0 ;;
    *) usage >&2; exit 1 ;;
  esac
done

[[ "$public_host" =~ ^[A-Za-z0-9.-]+$ ]] || { echo 'PUBLIC_HOST 格式无效。' >&2; exit 1; }
[[ "$files_host" =~ ^[A-Za-z0-9.-]+$ ]] || { echo 'FILES_HOST 格式无效。' >&2; exit 1; }
[[ "$public_host" != "$files_host" ]] || { echo '管理后台/API 域名与文件域名必须不同。' >&2; exit 1; }
command -v openssl >/dev/null 2>&1 || { echo '缺少 openssl。' >&2; exit 1; }
command -v git >/dev/null 2>&1 || { echo '缺少 git。' >&2; exit 1; }

if [[ -e "$output" ]]; then
  printf '拒绝覆盖已有环境文件：%s\n' "$output" >&2
  exit 1
fi

install -d -m 0700 "$(dirname -- "$output")"
umask 077

mysql_password="$(openssl rand -hex 24)"
mysql_root_password="$(openssl rand -hex 32)"
redis_password="$(openssl rand -hex 32)"
minio_password="$(openssl rand -hex 32)"
session_secret="$(openssl rand -hex 32)"
session_pepper="$(openssl rand -hex 32)"
audit_key="$(openssl rand -hex 32)"
field_key="$(openssl rand -base64 32 | tr -d '\n')"
image_tag="$(git -C "$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../../.." && pwd)" rev-parse --short=12 HEAD)"

cat > "$output" <<EOF
IMAGE_TAG=${image_tag}
PUBLIC_HOST=${public_host}
FILES_HOST=${files_host}
TLS_CERT_PATH=/opt/lehuo/shared/tls/fullchain.pem
TLS_KEY_PATH=/opt/lehuo/shared/tls/privkey.pem
BACKUP_DIR=/opt/lehuo/backups
MYSQL_DATABASE=lehuo
MYSQL_USER=lehuo
MYSQL_PASSWORD=${mysql_password}
MYSQL_ROOT_PASSWORD=${mysql_root_password}
DATABASE_URL=mysql://lehuo:${mysql_password}@mysql:3306/lehuo
REDIS_PASSWORD=${redis_password}
REDIS_URL=redis://:${redis_password}@redis:6379
MINIO_ROOT_USER=lehuo_storage
MINIO_ROOT_PASSWORD=${minio_password}
OBJECT_STORAGE_ENDPOINT=https://${files_host}
OBJECT_STORAGE_REGION=auto
OBJECT_STORAGE_BUCKET=lehuo-private
OBJECT_STORAGE_ACCESS_KEY=lehuo_storage
OBJECT_STORAGE_SECRET_KEY=${minio_password}
SESSION_SECRET=${session_secret}
SESSION_TOKEN_PEPPER=${session_pepper}
AUDIT_IP_HASH_KEY=${audit_key}
FIELD_ENCRYPTION_KEY=${field_key}
ADMIN_WEB_ORIGIN=https://${public_host}
AUTH_SESSION_TTL_SECONDS=28800
WECHAT_SESSION_TTL_SECONDS=7200
WECHAT_APP_ID=
WECHAT_APP_SECRET=
WECHAT_TEMPLATE_APPLICATION_SUBMITTED=
WECHAT_TEMPLATE_APPLICATION_ACCEPTED=
WECHAT_TEMPLATE_SERVICE_ARRANGED=
WECHAT_TEMPLATE_SERVICE_COMPLETED=
WECHAT_TEMPLATE_FOLLOW_UP_PENDING=
WECHAT_TEMPLATE_ACTIVITY_REGISTRATION_RESULT=
NOTIFICATION_WORKER_ENABLED=false
EOF
chmod 600 "$output"

install -d -m 0700 /opt/lehuo/shared/tls /opt/lehuo/backups /opt/lehuo/releases
printf '环境文件已生成：%s\n' "$output"
echo '下一步：放置覆盖两个域名的 TLS 证书，然后运行 preflight.sh。'