#!/bin/sh

# ===================================
# SSL Certificates Setup Script
# ===================================

CUSTOM_CERTS_DIR="/etc/ssl/certs/netfree"  
if [ ! -d "$CUSTOM_CERTS_DIR" ]; then
    echo "Creating custom certificates directory..."
    mkdir -p "$CUSTOM_CERTS_DIR"
    echo "✓ Directory created: $CUSTOM_CERTS_DIR"
fi

echo "Downloading custom certificates..."
cd "$CUSTOM_CERTS_DIR" || exit 1

sudo wget https://netfree.link/cacert/united/x2/root_ca_x2_rsa.crt --no-check-certificate
sudo wget https://netfree.link/cacert/united/x2/root_ca_x2_ed25519.crt --no-check-certificate
sudo wget https://netfree.link/cacert/united/x2/root_ca_x2_prime256v1.crt --no-check-certificate
sudo wget https://netfree.link/cacert/united/x2/root_ca_x2_secp384r1.crt --no-check-certificate
sudo wget https://netfree.link/cacert/united/x2/root_ca_x2_rsa_2037.crt --no-check-certificate



CUSTOM_CERTS_DIR="/etc/ssl/certs/netfree"  

CA_BUNDLE="/etc/ssl/certs/ca-certificates.crt"
CERTS_DIR="/etc/ssl/certs"

echo "Starting SSL certificates setup..."

if [ ! -f "$CA_BUNDLE" ] || [ ! -s "$CA_BUNDLE" ]; then
    echo "CA bundle missing or empty, downloading..."
    curl -k -o "$CA_BUNDLE" https://curl.se/ca/cacert.pem
    if [ $? -eq 0 ]; then
        echo "✓ CA bundle downloaded successfully"
    else
        echo "✗ Failed to download CA bundle"
    fi
fi

if [ ! -f "$CA_BUNDLE.backup" ]; then
    cp "$CA_BUNDLE" "$CA_BUNDLE.backup"
    echo "✓ Backup created"
fi

if [ -d "$CUSTOM_CERTS_DIR" ]; then
    echo "Adding custom certificates from $CUSTOM_CERTS_DIR..."
    
    for cert in "$CUSTOM_CERTS_DIR"/*.crt "$CUSTOM_CERTS_DIR"/*.pem; do
        if [ -f "$cert" ]; then
            cert_name=$(basename "$cert")
            
            if ! grep -q "BEGIN CERTIFICATE" "$cert" 2>/dev/null; then
                echo "⚠ Skipping $cert_name - not a valid certificate"
                continue
            fi
            
            cert_subject=$(openssl x509 -subject -noout -in "$cert" 2>/dev/null | head -1)
            if ! grep -q "$cert_subject" "$CA_BUNDLE" 2>/dev/null; then
                echo "" >> "$CA_BUNDLE"
                echo "# $cert_name" >> "$CA_BUNDLE"
                cat "$cert" >> "$CA_BUNDLE"
                echo "✓ Added: $cert_name"
            else
                echo "- Already exists: $cert_name"
            fi
            
            # העתק לתיקיית certs
            cp "$cert" "$CERTS_DIR/" 2>/dev/null
        fi
    done
else
    echo "⚠ Custom certs directory not found: $CUSTOM_CERTS_DIR"
fi

echo "Creating certificate hash symlinks..."
cd "$CERTS_DIR" || exit 1

for cert in *.crt *.pem; do
    if [ -f "$cert" ]; then
        hash=$(openssl x509 -hash -noout -in "$cert" 2>/dev/null)
        if [ -n "$hash" ]; then
            # אם יש כבר symlink עם אותו hash, הוסף .1, .2 וכו'
            suffix=0
            while [ -e "$hash.$suffix" ] && [ "$(readlink "$hash.$suffix")" != "$cert" ]; do
                suffix=$((suffix + 1))
            done
            ln -sf "$cert" "$hash.$suffix"
        fi
    fi
done

echo "✓ Symlinks created"

export CURL_CA_BUNDLE="$CA_BUNDLE"
export SSL_CERT_FILE="$CA_BUNDLE"
export SSL_CERT_DIR="$CERTS_DIR"



echo "================================"
echo "SSL certificates setup completed!"
echo "================================"
echo "Total certificates in bundle: $(grep -c "BEGIN CERTIFICATE" "$CA_BUNDLE")"
echo ""

# 7. בדיקת חיבור (אופציונלי)
if command -v curl > /dev/null 2>&1; then
    echo "Testing connection to Google APIs..."
    if curl -s --max-time 5 https://www.googleapis.com > /dev/null 2>&1; then
        echo "✓ Connection successful!"
    else
        echo "✗ Connection failed - check your certificates"
    fi
fi