#!/bin/bash

# Usage: ./ioscert CertName

CERT_NAME="$1"
FILE="/var/ipfire/ovpn/certs/${CERT_NAME}.p12"
OVPN_FILE="${CERT_NAME}.ovpn"

if [ -z "$CERT_NAME" ]; then
    echo "Error: Missing certificate name" >&2
    echo "Syntax: $0 CertName" >&2
    echo "CertName = what you input as cert name in the IPFire dialog" >&2
    exit 1
fi

if [ ! -f "$FILE" ]; then
    echo "File $FILE does not exist" >&2
    echo "Syntax: $0 CertName" >&2
    echo "CertName = what you input as cert name in the IPFire dialog" >&2
    exit 1
fi

# Start fresh
> "$OVPN_FILE"

cat <<EOF >> "$OVPN_FILE"
client
dev tun
remote !!!YOUR_IP_OR_DOMAIN_NAME_HERE!!! 1194
verify-x509-name !!!YOUR_IP_OR_DOMAIN_NAME_HERE!!! name
proto udp
remote-cert-tls server
mssfix 0
auth SHA256
EOF

# === CA CERTIFICATE ===
echo "<ca>" >> "$OVPN_FILE"
# Extract the exact PEM block from cacert.pem
sed -n '/^-----BEGIN CERTIFICATE-----/,/^-----END CERTIFICATE-----/p' /var/ipfire/ovpn/ca/cacert.pem >> "$OVPN_FILE"
echo "</ca>" >> "$OVPN_FILE"

# === CLIENT CERTIFICATE ===
echo "<cert>" >> "$OVPN_FILE"
# openssl outputs extra "Bag Attributes" lines before the actual cert.
# awk grabs ONLY the PEM block (BEGIN → END inclusive).
openssl pkcs12 -in "$FILE" -clcerts -nokeys -passin pass: 2>/dev/null \
    | awk '/^-----BEGIN/,/^-----END/' >> "$OVPN_FILE"
echo "</cert>" >> "$OVPN_FILE"

# === PRIVATE KEY ===
echo "<key>" >> "$OVPN_FILE"
# Same trick works perfectly for the private key (RSA PRIVATE KEY or PRIVATE KEY block)
openssl pkcs12 -in "$FILE" -nocerts -nodes -passin pass: 2>/dev/null \
    | awk '/^-----BEGIN/,/^-----END/' >> "$OVPN_FILE"
echo "</key>" >> "$OVPN_FILE"

# === TLS KEY ===
echo "<tls-auth>" >> "$OVPN_FILE"
less /var/ipfire/ovpn/certs/ta.key >> "$OVPN_FILE"
echo "</tls-auth>" >> "$OVPN_FILE"

echo "Generated $OVPN_FILE successfully!"