#!/bin/bash
set -e

echo "=== Generating SSL Certificates ==="

SSL_DIR="/home/bernt/.openclaw/workspace/iom/ssl"
mkdir -p "$SSL_DIR"

# Generate private key
openssl genrsa -out "$SSL_DIR/server.key" 2048

# Generate CSR
cat > "$SSL_DIR/server.cnf" << 'EOF'
[req]
distinguished_name = req_distinguished_name
x509_extensions = v3_req
prompt = no

[req_distinguished_name]
CN = api.quixzoom.com

[v3_req]
keyUsage = keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names

[alt_names]
DNS.1 = api.quixzoom.com
DNS.2 = api.landvex.com
DNS.3 = localhost
IP.1 = 127.0.0.1
EOF

openssl req -new -key "$SSL_DIR/server.key" -out "$SSL_DIR/server.csr" -config "$SSL_DIR/server.cnf"

# Generate self-signed certificate (valid for 365 days)
openssl x509 -req -days 365 -in "$SSL_DIR/server.csr" -signkey "$SSL_DIR/server.key" -out "$SSL_DIR/server.crt" -extensions v3_req -extfile "$SSL_DIR/server.cnf"

# Set permissions
chmod 600 "$SSL_DIR/server.key"
chmod 644 "$SSL_DIR/server.crt"

echo "=== SSL Certificates Generated ==="
echo "Certificate: $SSL_DIR/server.crt"
echo "Private Key: $SSL_DIR/server.key"
echo ""
echo "For production, use Let's Encrypt:"
echo "certbot --nginx -d api.quixzoom.com -d api.landvex.com"