#!/bin/sh
set -e

# Default environment variables
DB_HOST="${DB_HOST:-postgres}"
DB_PORT="${DB_PORT:-5432}"
DB_USER="${DB_USER:-radius}"
DB_PASS="${DB_PASS:-radpass}"
DB_NAME="${DB_NAME:-radius}"
RADIUS_SECRET="${RADIUS_SECRET:-radpass}"

echo "================================================="
echo " Starting RADIUS Controller & FreeRADIUS Stack"
echo " DB Host: $DB_HOST:$DB_PORT | Database: $DB_NAME"
echo " RADIUS Secret: $RADIUS_SECRET (Allows all IP addresses)"
echo "================================================="

# Dynamically update FreeRADIUS SQL configuration with DB settings
SQL_CONF="/etc/freeradius/3.0/mods-enabled/sql"
if [ -f "$SQL_CONF" ]; then
    sed -i "s/server = .*/server = \"$DB_HOST\"/" "$SQL_CONF"
    sed -i "s/port = .*/port = $DB_PORT/" "$SQL_CONF"
    sed -i "s/login = .*/login = \"$DB_USER\"/" "$SQL_CONF"
    sed -i "s/password = .*/password = \"$DB_PASS\"/" "$SQL_CONF"
    sed -i "s/radius_db = .*/radius_db = \"$DB_NAME\"/" "$SQL_CONF"
fi

# Dynamically update RADIUS shared secret for all client networks from env
CLIENTS_CONF="/etc/freeradius/3.0/clients.conf"
if [ -f "$CLIENTS_CONF" ]; then
    sed -i "s/secret = .*/secret = $RADIUS_SECRET/" "$CLIENTS_CONF"
fi

# Generate FreeRADIUS EAP certificates if missing
CERT_DIR="/etc/freeradius/3.0/certs"
if [ ! -f "$CERT_DIR/server.pem" ]; then
    echo "Generating FreeRADIUS EAP certificates..."
    mkdir -p "$CERT_DIR"

    # Generate CA key and certificate
    openssl req -new -x509 -keyout "$CERT_DIR/ca.key" -out "$CERT_DIR/ca.pem" \
        -days 3650 -nodes -subj "/CN=RADIUS CA" 2>/dev/null

    # Generate server key and CSR
    openssl req -new -keyout "$CERT_DIR/server.key" -out "$CERT_DIR/server.csr" \
        -nodes -subj "/CN=RADIUS Server" 2>/dev/null

    # Sign the server certificate with the CA
    openssl x509 -req -in "$CERT_DIR/server.csr" -CA "$CERT_DIR/ca.pem" \
        -CAkey "$CERT_DIR/ca.key" -CAcreateserial -out "$CERT_DIR/server.crt" \
        -days 3650 2>/dev/null

    # Combine server key + cert into server.pem
    cat "$CERT_DIR/server.key" "$CERT_DIR/server.crt" > "$CERT_DIR/server.pem"

    # Generate DH parameters (small size for speed, adequate for internal use)
    openssl dhparam -out "$CERT_DIR/dh" 1024 2>/dev/null

    # Clean up intermediate files
    rm -f "$CERT_DIR/server.csr" "$CERT_DIR/server.key" "$CERT_DIR/server.crt" "$CERT_DIR/ca.key" "$CERT_DIR/ca.srl"

    echo "EAP certificates generated successfully."
fi

# Ensure correct permissions for FreeRADIUS config directory
chown -R freerad:freerad /etc/freeradius/3.0/ || true

# Start FreeRADIUS daemon in background
echo "Starting FreeRADIUS service..."
freeradius -x &

# Wait briefly for FreeRADIUS to initialize
sleep 2

# Start ASP.NET Core Application
echo "Starting ASP.NET Core Web Controller..."
exec dotnet radiuscontroller.dll