#!/bin/bash
die() { echo >&2 "$@" ; exit 1 ; }

DIRNAME="$(dirname $0)"
cd "$DIRNAME"
source ../env.production || die "no top level env?"
source env.production || die "no local env?"

BASE="https://$KEYCLOAK_HOSTNAME/realms/$REALM/protocol/openid-connect"
SECRETS="../data/grafana/env.secrets"

if [ -r "$SECRETS" ]; then
	docker-compose up -d || die "grafana: unable to start container"
	exit 0
fi

docker-compose down 2>/dev/null

GRAFANA_CLIENT_SECRET="$(openssl rand -hex 32)"
GRAFANA_ADMIN_PASSWORD="$(openssl rand -hex 4)"

echo "Generating secrets: admin password $GRAFANA_ADMIN_PASSWORD"
mkdir -p "$(dirname "$SECRETS")"
cat <<EOF > "$SECRETS"
# Do not check in!
GF_SECURITY_ADMIN_PASSWORD=$GRAFANA_ADMIN_PASSWORD
GF_SERVER_ROOT_URL=https://$GRAFANA_HOSTNAME/
GF_SERVER_DOMAIN=$GRAFANA_HOSTNAME
GF_AUTH_GENERIC_OAUTH_AUTH_URL=$BASE/auth
GF_AUTH_GENERIC_OAUTH_TOKEN_URL=$BASE/token
GF_AUTH_GENERIC_OAUTH_API_URL=$BASE/userinfo
GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET=$GRAFANA_CLIENT_SECRET
EOF


../keycloak/client-delete 'grafana' 2>/dev/null

../keycloak/client-create << EOF || die "unable to create client id"
{
	"clientId": "grafana",
	"rootUrl": "https://$GRAFANA_HOSTNAME/",
	"adminUrl": "https://$GRAFANA_HOSTNAME/",
	"redirectUris": [ "https://$GRAFANA_HOSTNAME/*" ],
	"webOrigins": [ "https://$GRAFANA_HOSTNAME" ],
	"clientAuthenticatorType": "client-secret",
	"secret": "$GRAFANA_CLIENT_SECRET"
}
EOF

docker-compose up -d || die "grafana: unable to bring up container"