#!/bin/bash
set -e

# SSL Certificate Generation
# For production, use Let's Encrypt or commercial certificate

echo "=== SSL Certificate Generation ==="

SSL_DIR="/home/bernt/.openclaw/workspace/iom/ssl"
mkdir -p $SSL_DIR

# Generate private key
echo "Generating private key..."
openssl genrsa -out $SSL_DIR/server.key 2048

# Generate CSR
echo "Generating CSR..."
openssl req -new -key $SSL_DIR/server.key -out $SSL_DIR/server.csr \
    -subj "/C=SE/ST=Stockholm/L=Stockholm/O=Landvex/OU=IOM/CN=*.landvex.com"

# Generate self-signed certificate (for development)
echo "Generating self-signed certificate..."
openssl x509 -req -days 365 -in $SSL_DIR/server.csr \
    -signkey $SSL_DIR/server.key -out $SSL_DIR/server.crt

# Set permissions
chmod 600 $SSL_DIR/server.key
chmod 644 $SSL_DIR/server.crt

echo "=== SSL Certificates Generated ==="
echo "Key: $SSL_DIR/server.key"
echo "Cert: $SSL_DIR/server.crt"
echo ""
echo "For production, replace with Let's Encrypt or commercial certificate"
echo "Let's Encrypt: certbot --nginx -d landvex.com -d api.landvex.com"