#!/bin/bash
set -e

# Парсинг аргументов
while [[ "$#" -gt 0 ]]; do
    case $1 in
        --ip) IP="$2"; shift ;;
        --hostname) HOSTNAME="$2"; shift ;;
        --passphrase) PASSPHRASE="$2"; shift ;;
        --container-engine) CONTAINER_ENGINE="$2"; shift ;;
        *) echo "Unknown parameter passed: $1"; exit 1 ;;
    esac
    shift
done

# Если IP не передан, используйте первый IP из вывода hostname -I
if [ -z "$IP" ]; then
    IP=$(hostname -I | awk '{print $1}')
fi

# Если HOSTNAME не передан, используйте текущий hostname
if [ -z "$HOSTNAME" ]; then
    HOSTNAME=$(hostname)
fi

if [ -z "$CONTAINER_ENGINE" ]; then
    CONTAINER_ENGINE="podman"
fi

# Создайте директорию certs, если она существует, удалите ее
if [ -d "./certs" ]; then
    rm -rf ./certs
fi
mkdir ./certs

# Генерация корневого ключа и сертификата
openssl genrsa -out ./certs/harbor_internal_ca.key 4096
if [ -z "$PASSPHRASE" ]; then
    openssl req -x509 -new -nodes -key ./certs/harbor_internal_ca.key -sha512 -days 3650 -out ./certs/harbor_internal_ca.crt -subj "/C=RU/L=Moscow/O=Platform V DropApp/CN=dropapp_internal_ca"
else
    openssl req -x509 -new -key ./certs/harbor_internal_ca.key -sha512 -days 3650 -out ./certs/harbor_internal_ca.crt -subj "/C=RU/L=Moscow/O=Platform V DropApp/CN=dropapp_internal_ca" -passin pass:"$PASSPHRASE"
fi

# Генерация ключа для сертификата приложения
openssl genrsa -out ./certs/harbor.key 4096

# Создание конфигурационного файла для расширений сертификата
cat > ./certs/v3.ext <<-EOF
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
subjectAltName = @alt_names

[alt_names]
IP.1 = $IP
DNS.1 = $HOSTNAME
DNS.2 = portal
DNS.3 = core
DNS.4 = registry
DNS.5 = job_service
DNS.6 = trivy_adapter
DNS.7 = harbor_db
DNS.8 = redis
DNS.9 = registryctl
DNS.8 = proxy
EOF

# Генерация CSR для сертификата приложения
openssl req -new -key ./certs/harbor.key -out ./certs/harbor.csr -subj "/C=RU/L=Moscow/O=Platform V DropApp/CN=$HOSTNAME"

# Подписание сертификата приложения корневым сертификатом
if [ -z "$PASSPHRASE" ]; then
    openssl x509 -req -in ./certs/harbor.csr -CA ./certs/harbor_internal_ca.crt -CAkey ./certs/harbor_internal_ca.key -CAcreateserial -out ./certs/harbor.crt -days 3650 -sha512 -extfile ./certs/v3.ext
else
    openssl x509 -req -in ./certs/harbor.csr -CA ./certs/harbor_internal_ca.crt -CAkey ./certs/harbor_internal_ca.key -CAcreateserial -out ./certs/harbor.crt -days 3650 -sha512 -extfile ./certs/v3.ext -passin pass:"$PASSPHRASE"
fi

for NAME in portal core registry job_service trivy_adapter harbor_db redis proxy registryctl; do
    cp ./certs/harbor.crt "./certs/${NAME}.crt"
    cp ./certs/harbor.key "./certs/${NAME}.key"
done

echo "Сертификаты успешно созданы в директории ./certs"

echo "Скопируйте harbor.crt в директорию /etc/containers/certs.d/$HOSTNAME"
sudo rm -rf /etc/containers/certs.d/$HOSTNAME
sudo mkdir -p /etc/containers/certs.d/$HOSTNAME
sudo cp ./certs/harbor.crt /etc/containers/certs.d/$HOSTNAME/ca.crt

# Условие для container-engine
if [[ "$CONTAINER_ENGINE" == "docker" ]]; then
    echo "Скопируйте harbor.crt в директорию /etc/docker/certs.d/$HOSTNAME"
    sudo rm -rf /etc/docker/certs.d/$HOSTNAME
    sudo mkdir -p /etc/docker/certs.d/$HOSTNAME
    sudo cp ./certs/harbor.crt /etc/docker/certs.d/$HOSTNAME/ca.crt
    sudo systemctl restart docker
fi

if [[ "$CONTAINER_ENGINE" == "podman" ]]; then    
    sudo systemctl restart podman
fi