.PHONY: don't forget to put your non-file/folder based makefile targets here!

DOCKER ?= docker
KUBECTL ?= kubectl
BASE64 ?= base64
ENVSUBST ?= envsubst

PROJECT_NAME ?= waaard
ENVIRONMENT ?= staging

K8S_NAMESPACE ?= $(PROJECT_NAME)-$(ENVIRONMENT)

all: secrets registry-login deploy

check-ENV-ENVIRONMENT:
ifeq (,$(ENVIRONMENT))
	$(error "ENVIRONMENT not specified")
endif

check-tool-base64:
ifeq (,$(shell which $(BASE64)))
	$(error "base64 binary must be installed")
endif

clean: clean-generated-secrets

## EXAMPLE: Per-project (folder) docker credentials
## (this is best used with direnv and git-crypt!)

CONTAINER_REGISTRY ?= registry.gitlab.com

RSS_API_REGISTRY_DOCKER_SECRET_FOLDER ?= ./secrets/docker

RSS_API_REGISTRY_PASSWORD_SECRET_PATH ?= ./secrets/gitlab/rss-api/deploy-tokens/registry-password.secret
RSS_API_REGISTRY_USERNAME_SECRET_PATH ?= ./secrets/gitlab/rss-api/deploy-tokens/registry-username.secret

registry-folders:
	@mkdir -p $(RSS_API_REGISTRY_DOCKER_SECRET_FOLDER)

registry-login: secret-folders registry-folders registry-rss-api-login

registry-rss-api-login:
	@if [ ! -f "$(RSS_API_REGISTRY_USERNAME_SECRET_PATH)" ] ; then \
		echo -e "\n[info] Please enter a username for pulling the rss-api docker container:"; \
		read REGISTRY_USERNAME && \
			echo "[info] registry username to => [$$REGISTRY_USERNAME]" && \
			echo "[info] Writing registry username to relevant secret files..." && \
			echo $$REGISTRY_USERNAME | tr -d '[:space:]' > $(RSS_API_REGISTRY_USERNAME_SECRET_PATH); \
	fi

	@if [ ! -f "$(RSS_API_REGISTRY_PASSWORD_SECRET_PATH)" ] ; then \
		echo -e "\n[info] Please enter a password for pulling the rss-api docker container:"; \
		read REGISTRY_PASSWORD && \
			echo "[info] registry password to => [$$REGISTRY_PASSWORD]" && \
			echo "[info] Writing registry password to relevant secret files..." && \
			echo $$REGISTRY_PASSWORD | tr -d '[:space:]' > $(RSS_API_REGISTRY_PASSWORD_SECRET_PATH); \
	fi

	@if [ -f "$(RSS_API_REGISTRY_DOCKER_JSON_PATH)" ] ; then \
		echo "[info] file @ [$(RSS_API_REGISTRY_DOCKER_JSON_PATH)] already exists, skipping..."; \
	else \
		echo "\n[info] logging into docker..."; \
		export DOCKER_CONFIG=$(RSS_API_REGISTRY_DOCKER_SECRET_FOLDER) && \
		export DOCKER_USERNAME=$$(cat $(RSS_API_REGISTRY_USERNAME_SECRET_PATH)) && \
			cat $(RSS_API_REGISTRY_PASSWORD_SECRET_PATH) \
				| $(DOCKER) login $(CONTAINER_REGISTRY) -u $$DOCKER_USERNAME --password-stdin; \
		cp $(RSS_API_REGISTRY_DOCKER_JSON_PATH) $(RSS_API_REGISTRY_DOCKER_SECRET_FOLDER)/.dockerconfigjson; \
	fi

clean-registry-rss-api-login:
	@rm ./$(RSS_API_REGISTRY_USERNAME_SECRET_PATH) || true
	@rm ./$(RSS_API_REGISTRY_PASSWORD_SECRET_PATH) || true
	@rm $(RSS_API_REGISTRY_DOCKER_JSON_PATH) || true

## EXAMPLE: Generating random secrets

## Random secret generation!
secret-gen-random-alpha:
	@cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 32 | head -n 1 | tr -d \\n

## Files that can be randomly generated
RANDOMIZED_SECRET_PATHS ?= secrets/$(ENVIRONMENT)/BASIC_AUTH_PASSWORD.secret \
	secrets/pulumi/password-encryption.secret \
	secrets/$(ENVIRONMENT)/db/users.readysetsaas.PASSWORD.secret \
	$(API_POSTGRES_PASSWORD_SECRET_PATH) \
	path/to/another/file.secret

clean-secrets-generated:
	@echo -e "[info] Removing generated random-ok secrets..."
	@for SECRET_PATH in $(RANDOMIZED_SECRET_PATHS) ; do \
			[ ! -f $$SECRET_PATH ] && echo -e "[info] file @ [$$SECRET_PATH] does not exist" && continue; \
			echo -e "[info] removing random secret @ [$$SECRET_PATH]..."; \
			rm -rf $$SECRET_PATH; \
	done

secrets-generated: secret-folders
	@echo -e "[info] Generating known random-ok secrets..."
	@for SECRET_PATH in $(RANDOMIZED_SECRET_PATHS) ; do \
			[ -f $$SECRET_PATH ] && echo -e "[info] file @ [$$SECRET_PATH] already exists" && continue; \
			echo -e "[info] Generating random secret @ [$$SECRET_PATH]..."; \
			$(MAKE) -s --no-print-directory secret-gen-random-alpha > $$SECRET_PATH; \
	done

## Example: Manual secrets that a user needs to enter

secrets-manual: secret-folders check-environment

# Administrator email
	@if [ ! -f $(SECRET_ADMIN_EMAIL_ADDRESS_PATH) ] ; then \
		echo -e "\n[info] Please enter the enter the email address of the administrator:"; \
		read ADMIN_EMAIL && \
			echo "[info] Administrator email set to => [$$ADMIN_EMAIL]" && \
			echo "[info] Writing email to relevant secret files..." && \
			echo $$ADMIN_EMAIL | tr -d '[:space:]' > $(SECRET_ADMIN_EMAIL_ADDRESS_PATH) && \
			echo $$ADMIN_EMAIL | tr -d '[:space:]' > secrets/$(ENVIRONMENT)/analytics/FATHOM_ROOT_USER_NAME.secret && \
			echo $$ADMIN_EMAIL | tr -d '[:space:]' > secrets/$(ENVIRONMENT)/rss-api/ROOT_ADMIN_EMAIL_ADDRESS.secret; \
	fi

## Example: generating DKIM secrets

dkim:
	@echo -e "\n[info] generating DKIM keys for use with email..."

	@if [ ! -f "$(DKIM_PRIVATE_KEY_PATH)" ] ; then \
		echo "[info] DKIM private key not found @  [$(DKIM_PRIVATE_KEY_PATH)], creating new key..."; \
		$(OPENSSL) genrsa -f4 -out $(DKIM_PRIVATE_KEY_PATH); \
	fi
	@echo -e "[info] private key @ [$(DKIM_PRIVATE_KEY_PATH)]"

	@if [ ! -f "$(DKIM_PUBLIC_KEY_PATH)" ] ; then \
		echo "[info] DKIM public key not found @  [$(DKIM_PUBLIC_KEY_PATH)], creating new key..."; \
		$(OPENSSL) rsa -in $(DKIM_PRIVATE_KEY_PATH) -outform PEM -pubout -out $(DKIM_PUBLIC_KEY_PATH); \
	fi
	@echo -e "[info] public key @ [$(DKIM_PUBLIC_KEY_PATH)]"