#!/usr/bin/env bash
# Generate a self-signed cert for prometheus.x and print its DER sha256.
#
# The sha256 is what you register as the `tls` record on chain for the name.
# Theseus and Ariadne refuse any certificate whose DER sha256 does not match
# that value, which is the whole point of the pinning model.
#
# Run on the VPS. Writes to /etc/ssl/prometheus-x/, so sudo.
#
# Usage:
#   sudo bash deploy/make-tls-cert.sh
#   -> prints:  tls fingerprint: 9671bd5f44047f74203a76439430bda7bcf7c36d913c0fbd4cc75e24e374dde3
#
# To rotate: run again; it overwrites the files and prints the new fingerprint.
# Then: node Argus/src/register.js prometheus.x '{"ip":"<ip>","tls":"<new fp>"}'
# After the record TX confirms (~5 min on chipnet, longer on mainnet), the
# clients see the new cert.

set -euo pipefail

DIR=/etc/ssl/prometheus-x
mkdir -p "$DIR"

# ECDSA P-256 — small and fast. 10-year expiry; the on-chain pin, not the cert
# metadata, is what expires. SAN includes both the BNS name and the "localhost"
# proxy destination so a sanity-check curl against the vhost works.
openssl req \
  -x509 -nodes \
  -newkey ec \
  -pkeyopt ec_paramgen_curve:P-256 \
  -keyout "$DIR/privkey.pem" \
  -out    "$DIR/fullchain.pem" \
  -days 3650 \
  -subj  "/CN=prometheus.x" \
  -addext "subjectAltName=DNS:prometheus.x,DNS:localhost" \
  2>/dev/null

chmod 600 "$DIR/privkey.pem"
chmod 644 "$DIR/fullchain.pem"

FP=$(openssl x509 -in "$DIR/fullchain.pem" -outform DER | openssl dgst -sha256 | awk '{print $NF}')

echo "cert path:       $DIR/fullchain.pem"
echo "key path:        $DIR/privkey.pem"
echo "tls fingerprint: $FP"
echo
echo "Register with:   node Argus/src/register.js prometheus.x '{\"ip\":\"<ip>\",\"tls\":\"$FP\"}'"