#!/bin/bash
# Genera un certificado TLS autofirmado válido para koha.local y koha-intra.local.
# El .crt se puede importar al navegador/sistema para evitar warnings de SSL.
set -euo pipefail

CERTS_DIR="$(cd "$(dirname "$0")" && pwd)/certs"
mkdir -p "${CERTS_DIR}"

openssl req -x509 -nodes -days 825 -newkey rsa:2048 \
  -keyout "${CERTS_DIR}/local.key" \
  -out    "${CERTS_DIR}/local.crt" \
  -subj   "/CN=koha.local/O=Humboldt Local Dev" \
  -addext "subjectAltName=DNS:koha.local,DNS:koha-intra.local"

chmod 600 "${CERTS_DIR}/local.key"

echo ""
echo "Certificados generados en ${CERTS_DIR}/"
echo ""
echo "Para que el navegador confíe en el cert (sin warnings):"
echo "  macOS:   sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain ${CERTS_DIR}/local.crt"
echo "  Linux:   sudo cp ${CERTS_DIR}/local.crt /usr/local/share/ca-certificates/koha-local.crt && sudo update-ca-certificates"
echo "  Windows: Importar ${CERTS_DIR}/local.crt en 'Trusted Root Certification Authorities'"
