#!/usr/bin/env bash
# Generate all production secrets for MicProtocol self-hosted integrations
# Run this once during initial setup. Save output to .env.production

set -euo pipefail

echo "# ============================================================"
echo "# MicProtocol Production Secrets - Generated $(date -u +%Y-%m-%dT%H:%M:%SZ)"
echo "# ============================================================"
echo "# IMPORTANT: Save this output securely. Do not commit to git."
echo "# ============================================================"
echo ""

# Core Infrastructure
echo "# ─── Core Infrastructure ───────────────────────────────────"
POSTGRES_PASSWORD=$(openssl rand -base64 32 | tr -d '/+=' | cut -c1-32)
REDIS_PASSWORD=$(openssl rand -base64 32 | tr -d '/+=' | cut -c1-32)
MEILISEARCH_API_KEY=$(openssl rand -base64 32 | tr -d '/+=' | cut -c1-32)
MINIO_ROOT_USER="micprotocol_admin"
MINIO_ROOT_PASSWORD=$(openssl rand -base64 32 | tr -d '/+=' | cut -c1-32)
echo "POSTGRES_PASSWORD=${POSTGRES_PASSWORD}"
echo "REDIS_PASSWORD=${REDIS_PASSWORD}"
echo "MEILISEARCH_API_KEY=${MEILISEARCH_API_KEY}"
echo "MINIO_ROOT_USER=${MINIO_ROOT_USER}"
echo "MINIO_ROOT_PASSWORD=${MINIO_ROOT_PASSWORD}"
echo ""

# JWT/Encryption Keys (NEVER ROTATE THESE - data loss if rotated)
echo "# ─── Encryption Keys (NEVER ROTATE) ────────────────────────"
ENCRYPTION_KEY=$(openssl rand -hex 32)
JWT_SECRET=$(openssl rand -base64 64 | tr -d '/+=' | cut -c1-64)
NEXTAUTH_SECRET=$(openssl rand -base64 32)
echo "ENCRYPTION_KEY=${ENCRYPTION_KEY}"
echo "JWT_SECRET=${JWT_SECRET}"
echo "NEXTAUTH_SECRET=${NEXTAUTH_SECRET}"
echo ""

# Chatwoot
echo "# ─── Chatwoot (Customer Support) ──────────────────────────"
CHATWOOT_SECRET_KEY_BASE=$(openssl rand -hex 64)
CHATWOOT_WEBHOOK_SECRET=$(openssl rand -hex 32)
echo "CHATWOOT_SECRET_KEY_BASE=${CHATWOOT_SECRET_KEY_BASE}"
echo "CHATWOOT_WEBHOOK_SECRET=${CHATWOOT_WEBHOOK_SECRET}"
echo "# Generate these in Chatwoot UI after setup:"
echo "# CHATWOOT_INBOX_ID=<from Settings → Inboxes → Website>"
echo "# NEXT_PUBLIC_CHATWOOT_WEBSITE_TOKEN=<from Settings → Inboxes → Website → Configuration>"
echo ""

# Cal.com
echo "# ─── Cal.com (Scheduling) ──────────────────────────────────"
CALCOM_NEXTAUTH_SECRET=$(openssl rand -base64 32)
CALCOM_ENCRYPTION_KEY=$(openssl rand -hex 12)  # 24 chars, NEVER ROTATE
CALCOM_WEBHOOK_SECRET=$(openssl rand -hex 32)
echo "CALCOM_NEXTAUTH_SECRET=${CALCOM_NEXTAUTH_SECRET}"
echo "CALCOM_ENCRYPTION_KEY=${CALCOM_ENCRYPTION_KEY}"
echo "CALCOM_WEBHOOK_SECRET=${CALCOM_WEBHOOK_SECRET}"
echo "# Generate in Cal.com Admin → API Keys:"
echo "# CALCOM_API_KEY=cal_live_..."
echo ""

# Formbricks (v4 - 5 containers)
echo "# ─── Formbricks (Surveys & Feedback) ──────────────────────"
FORMBRICKS_NEXTAUTH_SECRET=$(openssl rand -base64 32)
FORMBRICKS_ENCRYPTION_KEY=$(openssl rand -hex 32)  # NEVER ROTATE
FORMBRICKS_CRON_SECRET=$(openssl rand -base64 16)
FORMBRICKS_HUB_API_KEY=$(openssl rand -hex 32)
FORMBRICKS_CUBE_API_SECRET=$(openssl rand -hex 32)
FORMBRICKS_WEBHOOK_SECRET=$(openssl rand -hex 32)
echo "FORMBRICKS_NEXTAUTH_SECRET=${FORMBRICKS_NEXTAUTH_SECRET}"
echo "FORMBRICKS_ENCRYPTION_KEY=${FORMBRICKS_ENCRYPTION_KEY}"
echo "FORMBRICKS_CRON_SECRET=${FORMBRICKS_CRON_SECRET}"
echo "FORMBRICKS_HUB_API_KEY=${FORMBRICKS_HUB_API_KEY}"
echo "FORMBRICKS_CUBE_API_SECRET=${FORMBRICKS_CUBE_API_SECRET}"
echo "FORMBRICKS_WEBHOOK_SECRET=${FORMBRICKS_WEBHOOK_SECRET}"
echo "# Generate in Formbricks UI after setup:"
echo "# NEXT_PUBLIC_FORMBRICKS_ENVIRONMENT_ID=<from Settings → Environments>"
echo "# FORMBRICKS_API_KEY=<from Settings → API Keys>"
echo ""

# Listmonk
echo "# ─── Listmonk (Email Marketing) ───────────────────────────"
LISTMONK_ADMIN_PASSWORD=$(openssl rand -base64 24 | tr -d '/+=' | cut -c1-24)
echo "LISTMONK_ADMIN_PASSWORD=${LISTMONK_ADMIN_PASSWORD}"
echo "# Generate in Listmonk Admin → Settings → API:"
echo "# LISTMONK_API_TOKEN=<from API Keys page>"
echo "# Create a list in Listmonk Admin → Lists → Copy UUID:"
echo "# NEXT_PUBLIC_LISTMONK_LIST_UUID=<list-uuid>"
echo ""

# Documenso (if used)
echo "# ─── Documenso (E-Signatures) ─────────────────────────────"
DOCUMENSO_NEXTAUTH_SECRET=$(openssl rand -base64 32)
DOCUMENSO_ENCRYPTION_KEY=$(openssl rand -hex 32)  # NEVER ROTATE
DOCUMENSO_WEBHOOK_SECRET=$(openssl rand -hex 32)
echo "DOCUMENSO_NEXTAUTH_SECRET=${DOCUMENSO_NEXTAUTH_SECRET}"
echo "DOCUMENSO_ENCRYPTION_KEY=${DOCUMENSO_ENCRYPTION_KEY}"
echo "DOCUMENSO_WEBHOOK_SECRET=${DOCUMENSO_WEBHOOK_SECRET}"
echo "# Generate in Documenso Admin → Settings → API:"
echo "# DOCUMENSO_API_KEY=<from API Keys>"
echo ""

# LiveKit
echo "# ─── LiveKit (Recording Studio) ───────────────────────────"
LIVEKIT_API_KEY="devkey"
LIVEKIT_API_SECRET=$(openssl rand -base64 32 | tr -d '/+=' | cut -c1-32)
LIVEKIT_WEBHOOK_SECRET=$(openssl rand -hex 32)
echo "LIVEKIT_API_KEY=${LIVEKIT_API_KEY}"
echo "LIVEKIT_API_SECRET=${LIVEKIT_API_SECRET}"
echo "LIVEKIT_WEBHOOK_SECRET=${LIVEKIT_WEBHOOK_SECRET}"
echo ""

# Email (SMTP)
echo "# ─── Email (SMTP) ─────────────────────────────────────────"
echo "# Configure your production SMTP provider:"
echo "# SMTP_HOST=smtp.sendgrid.net"
echo "# SMTP_PORT=587"
echo "# SMTP_USER=apikey"
echo "# SMTP_PASSWORD=SG.xxx"
echo "# EMAIL_FROM=MicProtocol <noreply@yourdomain.com>"
echo ""

# Clerk (Auth)
echo "# ─── Clerk (Authentication) ───────────────────────────────"
echo "# Get from Clerk Dashboard → API Keys:"
echo "# NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY=pk_live_..."
echo "# CLERK_SECRET_KEY=sk_live_..."
echo "# CLERK_WEBHOOK_SECRET=whsec_... (from Clerk → Webhooks)"
echo ""

# Sentry (Optional)
echo "# ─── Sentry (Error Tracking) ──────────────────────────────"
echo "# SENTRY_DSN=https://xxx@sentry.io/xxx"
echo "# SENTRY_ORG=your-org"
echo "# SENTRY_PROJECT=micprotocol"
echo "# SENTRY_AUTH_TOKEN=xxx (for source maps upload)"
echo ""

# Umami (Analytics)
echo "# ─── Umami (Analytics) ────────────────────────────────────"
UMAMI_APP_SECRET=$(openssl rand -base64 32)
echo "UMAMI_APP_SECRET=${UMAMI_APP_SECRET}"
echo "# Generate in Umami UI after setup:"
echo "# NEXT_PUBLIC_UMAMI_WEBSITE_ID=<website-id>"
echo ""

echo "# ============================================================"
echo "# End of generated secrets"
echo "# ============================================================"