#!/bin/bash
# 生成自签名证书脚本
# 用于 OPENCLAW AKS 部署的 HTTPS 访问

set -e

# 配置变量
DOMAIN="${1:-openclaw.yourdomain.com}"  # 从命令行参数获取域名，默认为 openclaw.yourdomain.com
NAMESPACE="${2:-openclaw}"              # Kubernetes 命名空间
SECRET_NAME="${3:-openclaw-tls}"        # Kubernetes Secret 名称
CERT_DIR="./certs"
DAYS_VALID=365                          # 证书有效期（天）

echo "=========================================="
echo "生成自签名证书 for OPENCLAW"
echo "=========================================="
echo "域名: $DOMAIN"
echo "命名空间: $NAMESPACE"
echo "Secret 名称: $SECRET_NAME"
echo "=========================================="

# 创建证书目录
mkdir -p "$CERT_DIR"

# 生成私钥
echo "1. 生成私钥..."
openssl genrsa -out "$CERT_DIR/tls.key" 2048

# 生成证书签名请求 (CSR)
echo "2. 生成证书签名请求..."
openssl req -new -key "$CERT_DIR/tls.key" -out "$CERT_DIR/tls.csr" \
  -subj "/C=CN/ST=Beijing/L=Beijing/O=OpenClaw/CN=$DOMAIN"

# 生成自签名证书
echo "3. 生成自签名证书..."
openssl x509 -req -days $DAYS_VALID -in "$CERT_DIR/tls.csr" -signkey "$CERT_DIR/tls.key" \
  -out "$CERT_DIR/tls.crt" \
  -extensions v3_req \
  -extfile <(cat <<EOF
[req]
distinguished_name = req_distinguished_name
req_extensions = v3_req

[v3_req]
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
subjectAltName = @alt_names

[alt_names]
DNS.1 = $DOMAIN
DNS.2 = *.$DOMAIN
DNS.3 = localhost
IP.1 = 127.0.0.1
EOF
)

# 清理 CSR 文件
rm -f "$CERT_DIR/tls.csr"

echo "4. 证书生成完成！"
echo ""
echo "证书文件："
echo "  - 私钥: $CERT_DIR/tls.key"
echo "  - 证书: $CERT_DIR/tls.crt"
echo ""

# 创建 Kubernetes Secret
echo "5. 创建 Kubernetes Secret..."
kubectl create secret tls "$SECRET_NAME" \
  --cert="$CERT_DIR/tls.crt" \
  --key="$CERT_DIR/tls.key" \
  --namespace="$NAMESPACE" \
  --dry-run=client -o yaml | kubectl apply -f -

echo ""
echo "=========================================="
echo "✅ 完成！"
echo "=========================================="
echo "Secret '$SECRET_NAME' 已创建在命名空间 '$NAMESPACE' 中"
echo ""
echo "下一步："
echo "1. 更新 deploay.yaml 中的 Ingress 配置，添加 TLS 部分"
echo "2. 将域名 '$DOMAIN' 指向你的 AKS Ingress IP"
echo "3. 访问 https://$DOMAIN (浏览器会显示安全警告，这是正常的)"
echo ""
echo "注意：自签名证书会在浏览器中显示安全警告，"
echo "      需要手动接受证书才能访问。"
echo "=========================================="