#!/bin/bash
set -e

CERT_DIR=/etc/voice/certs
mkdir -p "$CERT_DIR"

LAN_IP=$(ip -4 route get 1.1.1.1 2>/dev/null | awk '{for(i=1;i<=NF;i++) if ($i=="src") print $(i+1)}')
[ -z "$LAN_IP" ] && LAN_IP=$(hostname -I 2>/dev/null | awk '{print $1}')
[ -z "$LAN_IP" ] && LAN_IP=127.0.0.1

# Only regenerate if cert is missing or was issued for a different IP
if [ ! -f "$CERT_DIR/cert.pem" ]; then
    openssl req -x509 -nodes -days 3650 -newkey rsa:2048 \
        -keyout "$CERT_DIR/key.pem" \
        -out "$CERT_DIR/cert.pem" \
        -subj "/CN=$LAN_IP" \
        -addext "subjectAltName=DNS:localhost,IP:127.0.0.1,IP:$LAN_IP" 2>/dev/null
    echo "voice cert generated for CN=$LAN_IP"
else
    existing_cn=$(openssl x509 -in "$CERT_DIR/cert.pem" -noout -subject 2>/dev/null | grep -o 'CN = [^,]*' | cut -d' ' -f3)
    if [ "$existing_cn" != "$LAN_IP" ]; then
        openssl req -x509 -nodes -days 3650 -newkey rsa:2048 \
            -keyout "$CERT_DIR/key.pem" \
            -out "$CERT_DIR/cert.pem" \
            -subj "/CN=$LAN_IP" \
            -addext "subjectAltName=DNS:localhost,IP:127.0.0.1,IP:$LAN_IP" 2>/dev/null
        echo "voice cert regenerated for CN=$LAN_IP (was $existing_cn)"
    else
        echo "voice cert already valid for CN=$LAN_IP"
    fi
fi

exec "$@"