#!/bin/bash
set -e

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m' # No Color

echo -e "${GREEN}Docker Secrets Creation Script${NC}"
echo "==============================="

# Function to create or update a secret
create_secret() {
    local secret_name=$1
    local secret_value=$2
    
    # Check if secret exists
    if docker secret ls | grep -q $secret_name; then
        echo -e "${YELLOW}Secret '$secret_name' already exists. Skipping...${NC}"
    else
        echo "$secret_value" | docker secret create $secret_name -
        echo -e "${GREEN}Created secret: $secret_name${NC}"
    fi
}

# Function to generate random password
generate_password() {
    openssl rand -base64 32 | tr -d "=+/" | cut -c1-25
}

# Check if in swarm mode
if ! docker info | grep -q "Swarm: active"; then
    echo -e "${RED}Docker is not in swarm mode. Run init-swarm.sh first.${NC}"
    exit 1
fi

# Load environment variables if .env.production exists
if [ -f "../../.env.production" ]; then
    echo -e "${GREEN}Loading environment variables from .env.production${NC}"
    source ../../.env.production
fi

# JWT Secret
if [ -z "$JWT_SECRET" ]; then
    JWT_SECRET=$(generate_password)
    echo -e "${YELLOW}Generated JWT_SECRET: $JWT_SECRET${NC}"
fi
create_secret "jwt_secret" "$JWT_SECRET"

# Database credentials
if [ -z "$DB_USER" ]; then
    DB_USER="photoapp"
fi
if [ -z "$DB_PASSWORD" ]; then
    DB_PASSWORD=$(generate_password)
    echo -e "${YELLOW}Generated DB_PASSWORD: $DB_PASSWORD${NC}"
fi
create_secret "db_user" "$DB_USER"
create_secret "db_password" "$DB_PASSWORD"

# SMTP credentials
if [ -z "$SMTP_USER" ]; then
    read -p "Enter SMTP username: " SMTP_USER
fi
if [ -z "$SMTP_PASS" ]; then
    read -sp "Enter SMTP password: " SMTP_PASS
    echo
fi
create_secret "smtp_user" "$SMTP_USER"
create_secret "smtp_pass" "$SMTP_PASS"

# Traefik dashboard auth (username:password)
if [ -z "$TRAEFIK_USER" ]; then
    TRAEFIK_USER="admin"
fi
if [ -z "$TRAEFIK_PASSWORD" ]; then
    TRAEFIK_PASSWORD=$(generate_password)
    echo -e "${YELLOW}Generated TRAEFIK_PASSWORD: $TRAEFIK_PASSWORD${NC}"
fi
# Generate htpasswd format
TRAEFIK_AUTH=$(docker run --rm httpd:alpine htpasswd -nb $TRAEFIK_USER $TRAEFIK_PASSWORD)
create_secret "traefik_dashboard_auth" "$TRAEFIK_AUTH"

# OAuth secrets (optional)
if [ ! -z "$OAUTH_CLIENT_SECRET" ]; then
    create_secret "oauth_client_secret" "$OAUTH_CLIENT_SECRET"
fi

if [ ! -z "$OAUTH_SECRET" ]; then
    create_secret "oauth_secret" "$OAUTH_SECRET"
fi

# Drone CI secrets
if [ ! -z "$DRONE_RPC_SECRET" ]; then
    create_secret "drone_rpc_secret" "$DRONE_RPC_SECRET"
fi

echo ""
echo -e "${GREEN}Secrets creation complete!${NC}"
echo ""
echo -e "${YELLOW}Important: Save these generated values in a secure location:${NC}"
echo "JWT_SECRET=$JWT_SECRET"
echo "DB_PASSWORD=$DB_PASSWORD"
echo "TRAEFIK_USER=$TRAEFIK_USER"
echo "TRAEFIK_PASSWORD=$TRAEFIK_PASSWORD"
echo ""
echo -e "${GREEN}Next steps:${NC}"
echo "1. Update .env.production with the generated values"
echo "2. Deploy Traefik: ./deploy-traefik.sh"
echo "3. Deploy the application: ./deploy.sh"