#!/usr/bin/env bash
set -euo pipefail

CERT_URL="${CERT_URL:-https://gitea.wheelytho.com/Wheelz/Docker-Install/raw/branch/main/caddy-local-root.crt}"
CERT_NAME="${CERT_NAME:-wheelz-caddy-local-root.crt}"
EXPECTED_SHA256="${EXPECTED_SHA256:-d4b15cd45c797fd329df47b634d0fc7e9f858e9506ed572c64d00332ea5cf388}"

if [ "${EUID}" -ne 0 ]; then
  echo "Run as root, e.g. curl -fsSL ... | sudo bash" >&2
  exit 1
fi

if ! command -v curl >/dev/null 2>&1; then
  apt-get update
  apt-get install -y curl ca-certificates
fi

tmp="$(mktemp)"
trap 'rm -f "$tmp"' EXIT
curl -fsSL "$CERT_URL" -o "$tmp"
actual="$(sha256sum "$tmp" | awk '{print $1}')"
if [ "$actual" != "$EXPECTED_SHA256" ]; then
  echo "CA certificate sha256 mismatch: got $actual expected $EXPECTED_SHA256" >&2
  exit 1
fi

if command -v update-ca-certificates >/dev/null 2>&1; then
  CERT_DIR="/usr/local/share/ca-certificates"
  mkdir -p "$CERT_DIR"
  install -m 0644 "$tmp" "${CERT_DIR}/${CERT_NAME}"
  update-ca-certificates
elif command -v trust >/dev/null 2>&1; then
  trust anchor "$tmp"
else
  echo "Unsupported distro: no update-ca-certificates or trust command found." >&2
  exit 1
fi

echo "Installed Wheelz Caddy local root CA."
echo "Verified SHA256: ${EXPECTED_SHA256}"