#!/bin/bash
# First-time setup for the secrets-issuance deploy webhook. Generates a
# secret, installs the systemd unit, and starts it.
set -euo pipefail

SECRET_DIR=/etc/secrets-issuance-deploy
SECRET=$SECRET_DIR/secret
UNIT=secrets-issuance-deploy.service

install -d -m 700 "$SECRET_DIR"
if [ ! -s "$SECRET" ]; then
    head -c 32 /dev/urandom | base64 > "$SECRET"
    chmod 600 "$SECRET"
    echo "[install] generated webhook secret at $SECRET"
fi

systemctl daemon-reload
systemctl enable --now "$UNIT"
systemctl status "$UNIT" --no-pager | head -10

cat <<EOF

[install] webhook listening on :9821/deploy.
Configure Gitea (dtoro/Homelab-Docs → Settings → Webhooks → Add Webhook → Gitea):
  Target URL:   http://<lxc-105-mesh-ip>:9821/deploy
  HTTP Method:  POST
  Content-Type: application/json
  Secret:       $(cat $SECRET)
  Trigger:      Push events
EOF