#!/usr/bin/env bash
set -euo pipefail

cd /opt/tracecd
umask 077

if [[ -e stack.env || -e app.env ]]; then
  echo "Refusing to overwrite existing secret environment files." >&2
  exit 1
fi

mysql_root_password="$(openssl rand -hex 24)"
mysql_app_password="$(openssl rand -hex 24)"
app_default_password="$(openssl rand -hex 16)"

{
  printf 'MYSQL_ROOT_PASSWORD=%s\n' "$mysql_root_password"
  printf 'MYSQL_PASSWORD=%s\n' "$mysql_app_password"
  printf 'GITEA_HOST=156.238.122.140\n'
} > stack.env

{
  printf '%s\n' 'SPRING_DATASOURCE_URL=jdbc:mysql://mysql:3306/tracecd?useUnicode=true&characterEncoding=utf-8&serverTimezone=Asia/Shanghai&createDatabaseIfNotExist=true'
  printf 'SPRING_DATASOURCE_USERNAME=tracecd\n'
  printf 'SPRING_DATASOURCE_PASSWORD=%s\n' "$mysql_app_password"
  printf 'DEEPSEEK_API_KEY=\n'
  printf 'MIMO_API_KEY=\n'
  printf 'APP_DEFAULT_PASSWORD=%s\n' "$app_default_password"
} > app.env

chmod 600 stack.env app.env
ln -s stack.env .env
echo "Created protected environment files."