#!/bin/bash
# Redeploy the admin stack (Authelia SSO + portal). Secrets are regenerated
# from the gitignored files in configs/ so nothing sensitive is committed.
# First-time setup: run scripts/gen-admin-secrets.sh before this.
set -euo pipefail
cd "$(dirname "$0")/.."

HASH=$(/tmp/opencode/authelia/authelia crypto hash generate argon2 \
        --password "$(cat configs/admin-password.txt)" 2>/dev/null | grep -o '\$argon2id\$.*')
SESSION=$(cat configs/authelia-session-secret.txt)
JWT=$(cat configs/authelia-jwt-secret.txt)
ENCKEY=$(openssl rand -base64 24 | tr -d "=+/" | cut -c1-32)

export HASH SESSION JWT ENCKEY
for f in manifests/admin/*.yaml; do
  envsubst '\$HASH \$SESSION \$JWT \$ENCKEY' < "$f" | kubectl apply -f -
done

kubectl -n admin set env deployment/authelia \
  AUTHELIA_SESSION_SECRET="$SESSION" \
  AUTHELIA_STORAGE_ENCRYPTION_KEY="$ENCKEY" \
  AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET="$JWT" \
  >/dev/null
echo "admin stack deployed"