#!/bin/sh
# Writes halkyon.li's first deploy/.env (ADR 0039; first-start.md, step 4), as deploy,
# on the instance's host at home:
#
#   sh deploy/host/halkyon-li-env.sh deploy/.env
#
# Every secret is made here and now (32 random bytes, in hex), and never leaves the
# host but into Proton Pass (vault Infra, a note "halkyon.li .env", the whole file).
# It refuses to write over an existing file: the session peppers and the database
# passwords must never change once the instance runs (.env.example says why for each).
# The settings are the developer's choices of 8 Nov 2026; .env.example explains each
# one. SimpleLogin's client ID and secret stay empty until its app is registered
# (first-start.md, step 5).
set -eu

target=${1:?usage: halkyon-li-env.sh <path of the new .env>}
if [ -e "$target" ]; then
  echo "Error: $target exists; its secrets must stay as they are." >&2
  exit 1
fi

secret() { openssl rand -hex 32; }

umask 077
cat >"$target" <<EOF
# halkyon.li's .env, written by deploy/host/halkyon-li-env.sh on $(date -u +%Y-%m-%d).
# Its secrets are in Proton Pass (Infra, "halkyon.li .env"). .env.example explains each
# setting.

# Names (ADR 0039, D7): handles on halkyon.li itself.
LEARN_DOMAIN=learn.halkyon.li
LEARN_PUBLIC_HOST=learn.halkyon.li
ACCOUNT_DOMAIN=halkyon.li
TRAIN_DOMAIN=train.halkyon.li
TODO_DOMAIN=todo.halkyon.li
MEDITATE_DOMAIN=meditate.halkyon.li
JELLYFIN_DOMAIN=jellyfin.halkyon.li

# Everything runs, behind ramiel's forward (compose.forwarded.yaml last, its ports win).
COMPOSE_FILE=compose.learn.yaml:compose.jellyfin.yaml:compose.languagetool.yaml:compose.train.yaml:compose.maps.yaml:compose.search.yaml:compose.todo.yaml:compose.todo-search.yaml:compose.meditate.yaml:compose.forwarded.yaml

# The register (ADR 0016), which the four services share.
INSTANCE_SECRET=$(secret)

# Who comes in: SimpleLogin alone, approved by an operator (ADR 0039, D4). No mail, so
# neither email codes nor passwords.
SIGN_IN_WAYS=simplelogin
SIGN_UP=approval
SIGN_IN_DECOY_KEY=$(secret)
# From SimpleLogin's app (first-start.md, step 5).
SIMPLELOGIN_CLIENT_ID=
SIMPLELOGIN_CLIENT_SECRET=

# Learn: the instance's PostgreSQL superuser and Learn's session pepper.
LEARN_POSTGRES_PASSWORD=$(secret)
LEARN_SESSION_KEY_HASH_PEPPER=$(secret)

# Train, with BRouter, its own map and Photon. Until the Instance console cuts regions
# (ADR 0040): the map and routes over southern Bavaria, the search over Germany, the
# smallest Photon's databases come in, with memory to fit beside the rest.
TRAIN_POSTGRES_PASSWORD=$(secret)
TRAIN_SESSION_KEY_HASH_PEPPER=$(secret)
BROUTER_REGION=10,45,15,50
MAP_KEY_SECRET=$(secret)
MAP_REGION=10,47.2,13.9,49
PHOTON_REGION=europe/germany
PHOTON_HEAP=2g
PHOTON_MEMORY=3g

# Todo and Meditate (no library yet).
TODO_POSTGRES_PASSWORD=$(secret)
TODO_SESSION_KEY_HASH_PEPPER=$(secret)
MEDITATE_POSTGRES_PASSWORD=$(secret)
MEDITATE_SESSION_KEY_HASH_PEPPER=$(secret)

# Jellyfin's library on the HDD (sidecars/README.md, Jellyfin on halkyon.li).
JELLYFIN_MEDIA=/data/media

# What the app tells people: the iMac at home and the Storage Box, both in Germany.
DATA_LOCATION=DE
BACKUP_LOCATION=DE
EOF
echo "Written: $target"