#!/usr/bin/env bash
# =============================================================================
# up.sh — siapkan CA Trino (pakai openssl di HOST) lalu jalankan stack.
#
# Menjalankan `scripts/export-trino-ca.sh` (mengambil cert dari endpoint Trino
# yang hidup) bila `TRINO_CA_FETCH_HOST` di-set, lalu `docker compose up -d`.
# Tujuannya: CA selalu sinkron saat container dibuat/di-recreate — terutama di
# server baru, cukup satu perintah.
#
# Pemakaian:
#   ./up.sh                        # host gateway (docker-proxy+agent+nginx)
#   ./up.sh --profile panel        # host panel (menambahkan panel)
#
# Env di .env (lihat env.example):
#   TRINO_CA_FETCH_HOST=100.123.123.71:8443   → sumber cert (kosong = lewati)
#   TRINO_CA_DIR=../../.ca                    → direktori host berisi trino.crt
#                                               (di-mount ke /app/.ca panel)
# =============================================================================
set -euo pipefail
cd "$(dirname "${BASH_SOURCE[0]}")"
REPO_ROOT="$(cd ../.. && pwd)"

# Baca nilai dari .env per baris (TIDAK `source` — nilai JSON bisa merusak shell).
read_env() {
    [ -f .env ] && grep -E "^$1=" .env | head -1 | cut -d= -f2- || true
}

CA_FETCH_HOST="$(read_env TRINO_CA_FETCH_HOST)"
CA_DIR="$(read_env TRINO_CA_DIR)"

# Default: CA di <repo>/.ca ; file yang di-mount = <CA_DIR>/trino.crt
[ -z "$CA_DIR" ] && CA_DIR="$REPO_ROOT/.ca"
CA_FILE_HOST="$CA_DIR/trino.crt"

if [ -n "$CA_FETCH_HOST" ]; then
    echo "→ Ambil sertifikat Trino dari ${CA_FETCH_HOST} (openssl di host)"
    TRINO_CA_HOST="$CA_FETCH_HOST" TRINO_CA_FILE="$CA_FILE_HOST" \
        "$REPO_ROOT/scripts/export-trino-ca.sh"
else
    echo "! TRINO_CA_FETCH_HOST kosong — lewati pengambilan CA."
    echo "  Pastikan file CA sudah ada: ${CA_FILE_HOST}"
fi

echo "→ docker compose up -d $*"
docker compose "$@" up -d
echo
echo "✔ Selesai. Cek: docker compose ps"