#!/usr/bin/env bash

# One-time helper for the existing arschrock deployment. It copies credentials
# from live resources into one Kubernetes Secret without printing them.
set -euo pipefail

namespace=${NAMESPACE:-gramps}
workdir=$(mktemp --directory)
trap 'rm -rf "${workdir}"' EXIT HUP INT TERM
chmod 0700 "${workdir}"

extract_env() {
  local deployment=$1 name=$2 destination=$3
  kubectl --namespace "${namespace}" get deployment "${deployment}" --output=json \
    | jq --raw-output --join-output --arg name "${name}" \
      '.spec.template.spec.containers[0].env[] | select(.name == $name) | .value' \
      > "${destination}"
  test -s "${destination}"
}

extract_secret() {
  local source_secret=$1 key=$2 destination=$3
  kubectl --namespace "${namespace}" get secret "${source_secret}" --output=json \
    | jq --raw-output --join-output --arg key "${key}" '.data[$key]' \
    | base64 --decode > "${destination}"
  test -s "${destination}"
}

extract_env grampsweb-celery GRAMPSWEB_SECRET_KEY "${workdir}/app-secret-key" \
  || openssl rand -hex 32 > "${workdir}/app-secret-key"
extract_env grampsweb GRAMPSWEB_POSTGRES_PASSWORD "${workdir}/password"
extract_env grampsweb GRAMPSWEB_USER_DB_URI "${workdir}/user-database-uri"
extract_env grampsweb GRAMPSWEB_SEARCH_INDEX_DB_URI "${workdir}/search-index-database-uri"
extract_env grampsweb GRAMPSWEB_OIDC_CLIENT_SECRET "${workdir}/oidc-client-secret"
extract_env grampsweb AWS_ACCESS_KEY_ID "${workdir}/aws-access-key-id"
extract_env grampsweb AWS_SECRET_ACCESS_KEY "${workdir}/aws-secret-access-key"
extract_secret postgresql postgres-password "${workdir}/postgres-password"
extract_secret valkey valkey-password "${workdir}/valkey-password"

kubectl --namespace "${namespace}" create secret generic gramps-runtime \
  --from-file="${workdir}/app-secret-key" \
  --from-file="${workdir}/user-database-uri" \
  --from-file="${workdir}/search-index-database-uri" \
  --from-file="${workdir}/oidc-client-secret" \
  --from-file="${workdir}/aws-access-key-id" \
  --from-file="${workdir}/aws-secret-access-key" \
  --dry-run=client --output=yaml \
  | kubectl apply --filename=-
kubectl --namespace "${namespace}" create secret generic gramps-postgresql \
  --from-file="${workdir}/postgres-password" \
  --from-file="${workdir}/password" \
  --dry-run=client --output=yaml \
  | kubectl apply --filename=-
kubectl --namespace "${namespace}" create secret generic gramps-valkey \
  --from-file="${workdir}/valkey-password" \
  --dry-run=client --output=yaml \
  | kubectl apply --filename=-

echo "Runtime, PostgreSQL, and Valkey Secrets are ready; no values were printed."