#!/bin/bash
# Generate a Squid CA certificate for SSL bumping.
# Called during Docker image build to create a deterministic CA.
set -e

CERT_DIR=/etc/squid/ssl
mkdir -p "$CERT_DIR"

openssl req -new -newkey rsa:2048 -days 3650 -nodes -x509 \
    -subj "/C=US/ST=Test/L=E2E/O=Celilo E2E/CN=E2E Forward Proxy CA" \
    -keyout "$CERT_DIR/squid-ca.pem" \
    -out "$CERT_DIR/squid-ca.pem" 2>/dev/null

# Export just the certificate (no private key) for distribution to clients
openssl x509 -in "$CERT_DIR/squid-ca.pem" -out "$CERT_DIR/squid-ca.crt"

# Initialize Squid SSL certificate database
/usr/lib/squid/security_file_certgen -c -s /var/spool/squid/ssl_db -M 4MB 2>/dev/null || true

echo "Squid CA generated at $CERT_DIR/squid-ca.pem"