#!/usr/bin/env bash
# Make throwaway secrets for a CI or local end-to-end run of compose.ci.yaml.
# Every value is random and new on each run. Nothing here is ever committed:
# deploy/ci/ci-secrets/ and deploy/ci/ci-backups/ are gitignored and dockerignored.
# Also makes an empty CA bundle placeholder (phase 1 swaps in the Samba DC's CA)
# and an empty backup folder for the worker's read-only mount.
set -euo pipefail

here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
out="$here/ci-secrets"
backups="$here/ci-backups"

umask 077
mkdir -p "$out" "$backups"

rand() {
  # 32 random bytes as hex. No newline, so the file holds exactly the value.
  od -An -N32 -tx1 /dev/urandom | tr -d ' \n'
}

for name in \
  postgres_superuser_password postgres_migrate_password postgres_app_password \
  visualkit_password mfileskit_password ldap_bind_password \
  session_key seal_key
do
  rand > "$out/$name"
done

: > "$out/ca.pem"

# CI only: the containers run as uid 10001 and uid 999 (postgres), not as the runner's
# user, so the throwaway files are world-readable. Production files are root:10001 0440.
chmod 0755 "$out" "$backups"
chmod 0444 "$out"/*

echo "make-secrets: wrote $(ls "$out" | wc -l) files to $out"