#!/usr/bin/env bash
# nts-cert.sh — issue the NTS-KE server certificate for the fleet NTP server,
# signed by the fleet step-ca so booted hosts (secure_ntp=true) authenticate it
# against the SAME radius-ca.pem they already trust (closes F-03/P-18). Run once
# after the CA is up (serving/dot1x-bench bootstrap.sh), from serving/chrony/.
# Writes ./nts/{nts.crt,nts.key}, which docker-compose mounts at /etc/chrony/nts.
# Pairs with docs/secure-ntp-design.md. BENCH-VERIFY the `step` flags vs your version.
set -euo pipefail

cd "$(dirname "$0")"
OUT="nts"
# step-ca lives in the dot1x-bench compose project; reach it there (same pattern
# as dot1x-bench/step-ca/bootstrap.sh issuing the RADIUS cert).
BENCH="../dot1x-bench"
[ -d "$BENCH" ] || { echo "ERROR: $BENCH not found (need the step-ca compose project)." >&2; exit 1; }
[ -f "$BENCH/.env" ] && . "$BENCH/.env"
CA_PORT=${CA_PORT:-8443}
CA_CONNECT=${CA_CONNECT:-localhost}
CA_URL="https://${CA_CONNECT}:${CA_PORT}"
PROVISIONER=${PROVISIONER:-enrol}
# The DNS SAN the booted host uses. The image derives it at runtime as
# <ntp_prefix>.<DHCP-domain> (default ntp.<domain>), so this MUST equal
# ntp.${BOOT_DOMAIN} and resolve via the fleet dnsmasq (NTP_HOST -> SERVER_IP).
NTP_SAN=${NTP_HOST:-ntp.fleet.lab}

PKI="$BENCH/pki"
PW="$PKI/stepca/password"
[ -e "$PW" ] || { [ -e "$PKI/stepca/secrets/password" ] && PW="$PKI/stepca/secrets/password"; }
[ -r "$PW" ] || { echo "ERROR: CA password $PW missing — run dot1x-bench bootstrap.sh first." >&2; exit 1; }
CONTAINER_PW="/home/step/${PW#"$PKI/stepca/"}"

incca() { ( cd "$BENCH" && docker compose exec -T step-ca "$@" ); }

echo "==> issuing NTS-KE server cert (CN/SAN ${NTP_SAN}) from the fleet CA"
incca mkdir -p /export/nts
# Leaf with serverAuth (default) + the NTS server name as SAN. --not-after within
# the CA's max claim (bootstrap.sh raised it to 2160h).
incca step ca certificate "${NTP_SAN}" \
  /export/nts/nts.crt /export/nts/nts.key \
  --ca-url "$CA_URL" --root /export/root_ca.crt \
  --provisioner "${PROVISIONER}" --provisioner-password-file "$CONTAINER_PW" \
  --not-after 2160h --force

# The CA wrote into $BENCH/pki/nts via the /export mount; copy to ./nts for the
# ntp container's bind mount.
mkdir -p "$OUT"
cp "$PKI/nts/nts.crt" "$OUT/nts.crt"
cp "$PKI/nts/nts.key" "$OUT/nts.key"
chmod 0644 "$OUT/nts.crt"; chmod 0640 "$OUT/nts.key"
echo "==> wrote $OUT/nts.crt + $OUT/nts.key"
echo "    Ensure the image's ntp_server = ${NTP_SAN}, dnsmasq resolves ${NTP_SAN},"
echo "    open tcp/4460 (NTS-KE) on the boot NIC, and restart the ntp service."