#!/usr/bin/env bash
# Regenerate Nomad TLS material for the single-node agent.
#
# Usage (on the services VPS, from the repo root):
#   sudo deploy/nomad/gen-tls.sh <VPS_PUBLIC_IP>
#
# Produces /etc/nomad.d/tls/{nomad-ca.crt, server.crt, server.key} and leaves
# the new CA in a temp dir for copying to the Forgejo runner (NOMAD_CACERT).
# Requirements: SAN must contain server.global.vps.nomad (region.global,
# datacenter vps — matches deploy/nomad/nomad.hcl) + the addresses clients
# use to reach the API.

set -euo pipefail

ip="${1:?usage: gen-tls.sh <VPS_PUBLIC_IP>}"

tls_dir=/etc/nomad.d/tls
work=$(mktemp -d)
trap 'rm -rf "$work"' EXIT
cd "$work"

# 1. mini CA
openssl req -x509 -newkey rsa:2048 -nodes -days 3650 \
  -keyout nomad-ca.key -out nomad-ca.crt \
  -subj "/CN=Contract-Check Nomad CA"

# 2. server cert (serverAuth+clientAuth: the agent uses it for both roles).
#    With verify_server_hostname=true the RPC name is server.<REGION>.nomad
#    (NOT server.<region>.<dc>.nomad) — region here is "global" (nomad.hcl).
openssl req -newkey rsa:2048 -nodes \
  -keyout server.key -out server.csr \
  -subj "/CN=server.global.nomad"

cat > server.ext <<EOF
subjectAltName = DNS:server.global.nomad, DNS:server.global.vps.nomad, DNS:localhost, IP:127.0.0.1, IP:${ip}
extendedKeyUsage = serverAuth, clientAuth
EOF

openssl x509 -req -in server.csr \
  -CA nomad-ca.crt -CAkey nomad-ca.key -CAcreateserial \
  -out server.crt -days 825 -extfile server.ext

# 3. self-check before installing
openssl verify -CAfile nomad-ca.crt server.crt
openssl x509 -in server.crt -noout -ext subjectAltName

# 4. install
install -d -m 755 "$tls_dir"
install -m 644 nomad-ca.crt server.crt "$tls_dir/"
install -m 600 server.key "$tls_dir/"

cat <<EOF

OK. Now:
  1. systemctl restart nomad && journalctl -u nomad -f   (handshake errors should stop)
  2. export NOMAD_ADDR=https://127.0.0.1:4646 NOMAD_CACERT=$tls_dir/nomad-ca.crt
  3. nomad server members && nomad node status
  4. copy $tls_dir/nomad-ca.crt to the Forgejo repo secret NOMAD_CACERT
     (runner verifies the server with it; the CA key never leaves this host)
EOF