#!/bin/sh
# Creates the legacy endpoint's self-signed certificate (10 years) and prints the SHA-256
# fingerprint to compare with what the phone shows when you tap "Trust".
#   ./make-cert.sh [name] [output-dir]
#   e.g. for Nginx Proxy Manager:  ./make-cert.sh nxc.anosanube.ovh /opt/npm/data/legacy-caldav
set -eu
NAME=${1:-caldav-bridge}
DIR=${2:-"$(dirname "$0")/certs"}
mkdir -p "$DIR"
if [ ! -f "$DIR/bridge.key" ]; then
  openssl req -x509 -newkey rsa:2048 -sha256 -days 3650 -nodes \
    -keyout "$DIR/bridge.key" -out "$DIR/bridge.crt" -subj "/CN=$NAME" 2>/dev/null
  chmod 600 "$DIR/bridge.key"
  echo "Created $DIR/bridge.crt"
fi
echo "SHA-256 fingerprint (must match the phone):"
openssl x509 -in "$DIR/bridge.crt" -noout -fingerprint -sha256 | cut -d= -f2