.PHONY: secrets-keygen secrets-encrypt secrets-decrypt secrets-edit scan-image scan-image-full \
        certs certs-db certs-redis preflight up backup restore

SECRETS_PLAIN = secrets.json
SECRETS_ENC   = secrets.enc.json

## Generate a new age keypair (run once per developer/server)
secrets-keygen:
	@age-keygen -o keys.txt
	@echo "Key written to keys.txt"
	@echo "Add the PUBLIC key (age1...) to .sops.yaml and commit."
	@echo "Keep keys.txt SECRET — never commit it."

## Encrypt secrets.json → secrets.enc.json (safe to commit)
secrets-encrypt:
	sops --encrypt $(SECRETS_PLAIN) > $(SECRETS_ENC)
	@echo "Encrypted → $(SECRETS_ENC) (safe to commit)"

## Decrypt secrets.enc.json → stdout (for inspection)
secrets-decrypt:
	@sops --decrypt $(SECRETS_ENC)

## Edit encrypted secrets in-place (opens $EDITOR)
secrets-edit:
	sops $(SECRETS_ENC)

## Scan the Docker image for vulnerabilities (requires trivy: brew install trivy)
scan-image:
	docker build -t vercre:local .
	trivy image --severity CRITICAL,HIGH --ignore-unfixed --exit-code 1 vercre:local

## Scan with full report (all severities, no exit-code failure)
scan-image-full:
	docker build -t vercre:local .
	trivy image --ignore-unfixed vercre:local

## Generate TLS certificates for YugabyteDB
certs-db:
	@bash scripts/generate-db-certs.sh

## Generate TLS certificates for Redis
certs-redis:
	@bash scripts/generate-redis-certs.sh

## Generate all TLS certificates (database + redis)
certs: certs-db certs-redis

## Pre-flight check: verify certs, .env, and secrets.enc.json exist before docker compose up
preflight:
	@echo "==> Checking TLS certificates..."
	@test -f certs/redis/ca.crt        || (echo "ERROR: certs/redis/ca.crt missing. Run: make certs-redis" && exit 1)
	@test -f certs/redis/redis.crt     || (echo "ERROR: certs/redis/redis.crt missing. Run: make certs-redis" && exit 1)
	@test -f certs/redis/redis.key     || (echo "ERROR: certs/redis/redis.key missing. Run: make certs-redis" && exit 1)
	@echo "    OK"
	@echo "==> Checking .env file..."
	@test -f .env || (echo "ERROR: .env missing. Run: cp .env.example .env and fill in real values." && exit 1)
	@grep -q "CHANGE_ME" .env && (echo "ERROR: .env still contains CHANGE_ME placeholders. Fill in real values." && exit 1) || true
	@echo "    OK"
	@echo "==> Checking encrypted secrets..."
	@test -f secrets.enc.json || (echo "ERROR: secrets.enc.json missing. Run: make secrets-keygen, update .sops.yaml, then make secrets-encrypt" && exit 1)
	@echo "    OK"
	@echo "==> Pre-flight checks passed."

## Run pre-flight checks then start the stack
up: preflight
	docker compose up -d

## Take a database backup (Docker Compose)
backup:
	@bash scripts/yb-backup.sh

## Restore from a backup (Docker Compose)
restore:
	@test -n "$(BACKUP)" || (echo "Usage: make restore BACKUP=./backups/dump_YYYYMMDD_HHMMSS" && exit 1)
	@bash scripts/yb-restore.sh $(BACKUP)
