#!/usr/bin/env bash
set -euo pipefail

project_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
env_file="${project_dir}/.env.dev"

if [[ -e "${env_file}" ]]; then
    echo "Keeping existing ${env_file}"
    exit 0
fi

umask 077

generate_secret() {
    if command -v openssl >/dev/null 2>&1; then
        openssl rand -hex 32
    else
        python3 -c 'import secrets; print(secrets.token_hex(32))'
    fi
}

postgres_password="$(generate_secret)"
jwt_secret="$(generate_secret)"
agent_secret="$(generate_secret)"

{
    echo "APP_ENV=development"
    echo "APP_TIMEZONE=America/Winnipeg"
    echo "POSTGRES_DB=minerops_dev"
    echo "POSTGRES_USER=minerops_dev"
    echo "POSTGRES_PASSWORD=${postgres_password}"
    echo "POSTGRES_HOST=postgres"
    echo "POSTGRES_PORT=5432"
    echo "DATABASE_URL=postgresql://minerops_dev:${postgres_password}@postgres:5432/minerops_dev"
    echo "REDIS_URL=redis://redis:6379/0"
    echo "JWT_SECRET_KEY=${jwt_secret}"
    echo "MINEROPS_AGENT_SHARED_SECRET=${agent_secret}"
    echo "MINEROPS_DEV_PORT=18000"
    echo "SCHEDULED_SCAN_ENABLED=false"
    echo "MINEROPS_HUB_MODE=true"
    echo "MINEROPS_DISABLE_LOCAL_SCANNER=true"
    echo "MINEROPS_ENABLE_REAL_REBOOT=false"
    echo "MINEROPS_ENABLE_REAL_POWER_CONTROL=false"
} >"${env_file}"

chmod 0600 "${env_file}"
echo "Created ${env_file} with development-only secrets and safety interlocks."