#!/usr/bin/env bash
# Generate every secret on first boot. Values stay on this VM and are never printed.
# Idempotent: an existing /etc/aegis/aegis.env is never overwritten (it holds the signing key).
set -euo pipefail
umask 077
. /etc/aegis/kit.env
[ -f /etc/aegis/aegis.env ] && exit 0

rnd() { openssl rand -hex 32; }
SIGNING=$(rnd); IDENT=$(rnd); CLIENT="sk-aegis-$(rnd)"; AUDIT="sk-audit-$(rnd)"; REDIS_PW=$(rnd)

# Strict mode requires an explicit principal mapping per client key (digests only).
PRINCIPALS=$(printf '{"%s":{"tenant_id":"default","roles":["proxy_user"],"scopes":["proxy:completions"]}}' "$CLIENT" |
  AEGIS_AUTH_IDENTITY_HMAC_KEY="$IDENT" docker run --rm -i -e AEGIS_AUTH_IDENTITY_HMAC_KEY \
    --entrypoint python "$AEGIS_IMAGE" -m aegis.auth.principal)

{
  echo "AEGIS_SIGNING_KEY=$SIGNING"
  echo "AEGIS_AUTH_IDENTITY_HMAC_KEY=$IDENT"
  echo "AEGIS_API_KEYS=$CLIENT"
  echo "AEGIS_AUDIT_API_KEYS=$AUDIT"
  echo "AEGIS_API_KEY_PRINCIPALS_JSON=$PRINCIPALS"
  echo "AEGIS_BACKEND_API_KEY=unset-run-aegis-set-backend-key"
  echo "REDIS_PASSWORD=$REDIS_PW"
  echo "AEGIS_REDIS_URL=redis://:$REDIS_PW@redis:6379/0"
} > /etc/aegis/aegis.env
echo "REDIS_PASSWORD=$REDIS_PW" > /etc/aegis/redis.env
chmod 600 /etc/aegis/aegis.env /etc/aegis/redis.env
