#!/usr/bin/env bash
set -euo pipefail

NAMESPACE="la-huasca"
SECRET_NAME="la-huasca-db-secrets"
PROTECTED_FILE="$HOME/.lahuasca-db-pass.enc"
PIN="78963"

generate_password() {
  openssl rand -base64 48 | tr -dc 'a-zA-Z0-9' | head -c 32
}

decrypt_password() {
  openssl enc -aes-256-cbc -d -salt -pbkdf2 -iter 100000 -pass pass:"$PIN" -in "$PROTECTED_FILE" | tr -d '\n'
}

# Generate a secure random password if it doesn't already exist
if [ -f "$PROTECTED_FILE" ]; then
  echo "Protected password file already exists at $PROTECTED_FILE"
  echo "Run './deploy-db.sh reveal' to view it."
else
  PASSWORD=***
  if [ -z "$PASSWORD" ]; then
    echo "Failed to generate password. Is openssl installed?"
    exit 1
  fi
  echo -n "$PASSWORD" | openssl enc -aes-256-cbc -salt -pbkdf2 -iter 100000 -pass pass:"$PIN" -out "$PROTECTED_FILE"
  echo "Generated secure password and saved it to $PROTECTED_FILE"
fi

if [ "${1:-}" = "reveal" ]; then
  echo "Enter PIN to reveal the database password:"
  read -s USER_PIN
  if [ "$USER_PIN" != "$PIN" ]; then
    echo "Incorrect PIN."
    exit 1
  fi
  PASSWORD=***
  if [ -z "$PASSWORD" ]; then
    echo "Failed to decrypt password."
    exit 1
  fi
  echo "Database password: $PASSWORD"
  exit 0
fi

# Read password for deployment
PASSWORD=***
if [ -z "$PASSWORD" ]; then
  echo "Failed to decrypt password. Protected file may be corrupt."
  exit 1
fi

cat <<EOF | kubectl apply -f -
apiVersion: v1
kind: Secret
metadata:
  name: $SECRET_NAME
  namespace: $NAMESPACE
type: Opaque
stringData:
  POSTGRES_USER: lahuasca
  POSTGRES_PASSWORD: "$PASSWORD"
  POSTGRES_DB: lahuasca
  DATABASE_URL: "postgres://lahuasca:${PASSWORD}@postgres:5432/lahuasca"
EOF

echo "Database secret updated in namespace $NAMESPACE"