#!/usr/bin/env bash
set -euo pipefail

CA_URL="${1:-https://ca.konrad.home}"
CERTS=("site-a-root.crt" "site-b-root.crt")
TMP_DIR=$(mktemp -d)
trap 'rm -rf "$TMP_DIR"' EXIT

detect_os() {
    case "$(uname -s)" in
        Darwin) echo "macos" ;;
        Linux)  echo "linux" ;;
        *)      echo "unsupported" ;;
    esac
}

install_macos() {
    echo "🔐 macOS erkannt — installiere in System-Keychain..."
    for cert in "${CERTS[@]}"; do
        local path="$TMP_DIR/$cert"
        curl -sSfL "$CA_URL/$cert" -o "$path"
        local name
        name=$(openssl x509 -in "$path" -noout -subject 2>/dev/null | sed 's/.*CN = //' | sed 's/,.*//')
        if security find-certificate -c "$name" /Library/Keychains/System.keychain &>/dev/null; then
            echo "  ✅ $name — bereits installiert"
        else
            sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain "$path"
            echo "  ✅ $name — installiert"
        fi
    done
    echo "✅ macOS-Installation abgeschlossen. Browser neustarten."
}

install_linux() {
    echo "🐧 Linux erkannt — installiere in System-CA-Store..."
    local ca_dir="/usr/local/share/ca-certificates/konrad-home"
    sudo mkdir -p "$ca_dir"
    for cert in "${CERTS[@]}"; do
        local path="$TMP_DIR/$cert"
        curl -sSfL "$CA_URL/$cert" -o "$path"
        local dest="$ca_dir/$cert"
        if [ -f "$dest" ] && cmp -s "$path" "$dest"; then
            echo "  ✅ $cert — bereits aktuell"
        else
            sudo cp "$path" "$dest"
            echo "  ✅ $cert — installiert"
        fi
    done
    sudo update-ca-certificates --fresh
    echo "✅ Linux-Installation abgeschlossen. Browser neustarten."
}

case "$(detect_os)" in
    macos)  install_macos ;;
    linux)  install_linux ;;
    *)
        echo "❌ Nicht unterstütztes Betriebssystem: $(uname -s)"
        echo "   Manuelle Installation:"
        echo "   - Lade die .crt-Dateien von $CA_URL herunter"
        echo "   - Installiere sie im System-Trust-Store deiner Distribution"
        exit 1
        ;;
esac

echo ""
echo "Danach sind https://*.konrad.home und https://*.mini.konrad.home"
echo "ohne Zertifikatswarnung erreichbar."