#!/usr/bin/env bash
# Generates the SSH keypair (controller -> agents) and the Jenkins admin
# password consumed by docker-compose.yml as Docker secrets. Safe to re-run;
# it skips anything that already exists.
set -euo pipefail
cd "$(dirname "$0")/.."

mkdir -p secrets

if [ ! -f secrets/agent_ssh_key ]; then
    ssh-keygen -t ed25519 -f secrets/agent_ssh_key -N "" -C "jenkins-agent"
    echo "Generated secrets/agent_ssh_key(.pub)"
else
    echo "secrets/agent_ssh_key already exists, skipping"
fi

if [ ! -f secrets/jenkins_admin_password.txt ]; then
    openssl rand -base64 18 > secrets/jenkins_admin_password.txt
    echo "Generated Jenkins admin password (saved to secrets/jenkins_admin_password.txt):"
    cat secrets/jenkins_admin_password.txt
else
    echo "secrets/jenkins_admin_password.txt already exists, skipping"
fi