#!/usr/bin/env bash
# Generate a 10-year self-signed wildcard certificate for pre-switch testing and upload it to
# Nginx Proxy Manager as custom certificate "selfsigned-wildcard".
#   selfsigned-wildcard.sh [domain ...]   (default: logship.de blut24.com)
set -euo pipefail
HERE="$(cd "$(dirname "$0")" && pwd)"; source "$HERE/npm-api.sh"
DOMAINS=("$@"); [ ${#DOMAINS[@]} -gt 0 ] || DOMAINS=(logship.de blut24.com)
san=""; for d in "${DOMAINS[@]}"; do san="${san:+$san,}DNS:*.$d,DNS:$d"; done
tmp=$(mktemp -d)
openssl req -x509 -newkey rsa:2048 -sha256 -days 3650 -nodes \
  -keyout "$tmp/key.pem" -out "$tmp/cert.pem" \
  -subj "/O=LogYou GmbH/OU=edge-proxy self-signed/CN=*.${DOMAINS[0]}" \
  -addext "subjectAltName=$san" -addext "basicConstraints=CA:FALSE" -addext "keyUsage=digitalSignature,keyEncipherment" \
  -addext "extendedKeyUsage=serverAuth" 2>/dev/null
npm_login
existing=$(npm_cert_id_by_name selfsigned-wildcard)
if [ -n "$existing" ]; then echo "certificate 'selfsigned-wildcard' exists as #$existing — delete it in the UI first to replace"; exit 0; fi
id=$(npm_cert_upload selfsigned-wildcard "$tmp/cert.pem" "$tmp/key.pem")
rm -rf "$tmp"
echo "uploaded self-signed wildcard ($san) as certificate #$id"