#!/bin/sh
# Prints freshly generated secrets for the reference deployment's env files (ADR 0044). Writes
# nothing: paste each line into the file named above it, then install that file root-owned with
# mode 600.
#
#   sh deploy/scripts/gen-secrets.sh
#
# Every value is URL-safe (hexadecimal), so the database password needs no percent-encoding in
# DATABASE_URL.

set -eu

command -v openssl >/dev/null 2>&1 || {
	echo "gen-secrets: openssl is required." >&2
	exit 69
}

hex() {
	openssl rand -hex "$1"
}

postgres_password=$(hex 24)
s3_access_key=$(hex 10)
s3_secret_key=$(hex 32)

cat <<EOF
# ekklesia.env
EKKLESIA_IDENTITY_SECRET=$(hex 32)
DATABASE_URL=postgresql://ekklesia:$postgres_password@postgres:5432/ekklesia
S3_ACCESS_KEY=$s3_access_key
S3_SECRET_KEY=$s3_secret_key

# postgres.env
POSTGRES_PASSWORD=$postgres_password

# object-storage.env
AWS_ACCESS_KEY_ID=$s3_access_key
AWS_SECRET_ACCESS_KEY=$s3_secret_key
EOF