set -e

echo "=========================================="

echo "TimeTracker HTTPS Startup"

echo "=========================================="

echo ""

if [[ "$OSTYPE" == "darwin"* ]]; then

LOCAL_IP=$(ipconfig getifaddr en0 || ipconfig getifaddr en1 || echo "192.168.1.100")

elif [[ "$OSTYPE" == "linux-gnu"* ]]; then

LOCAL_IP=$(hostname -I | awk '{print $1}' || echo "192.168.1.100")

LOCAL_IP="192.168.1.100"

echo "🌐 Local IP detected: $LOCAL_IP"

echo ""

if [ ! -f nginx/conf.d/https.conf ]; then

echo "📝 Creating nginx HTTPS configuration..."

mkdir -p nginx/conf.d

cat > nginx/conf.d/https.conf << 'NGINX_EOF'

echo "✅ nginx configuration created"

echo ""

if [ -f .env ]; then

echo "🔧 Updating .env with HTTPS settings..."

# Backup .env

cp .env .env.backup 2>/dev/null || true

# Update settings

sed -i.bak 's/^WTF_CSRF_SSL_STRICT=.*/WTF_CSRF_SSL_STRICT=true/' .env 2>/dev/null || echo "WTF_CSRF_SSL_STRICT=true" >> .env

sed -i.bak 's/^SESSION_COOKIE_SECURE=.*/SESSION_COOKIE_SECURE=true/' .env 2>/dev/null || echo "SESSION_COOKIE_SECURE=true" >> .env

sed -i.bak 's/^CSRF_COOKIE_SECURE=.*/CSRF_COOKIE_SECURE=true/' .env 2>/dev/null || echo "CSRF_COOKIE_SECURE=true" >> .env

# Clean up

rm -f .env.bak

echo "✅ .env updated"

echo ""

export HOST_IP=$LOCAL_IP

echo "Select certificate method:"

echo " 1) Self-signed (works immediately, shows browser warning)"

echo " 2) mkcert (trusted certificates, requires one-time CA install)"

echo ""

read -p "Choice [1]: " CERT_METHOD

CERT_METHOD=${CERT_METHOD:-1}

echo ""

if [ "$CERT_METHOD" = "2" ]; then

# Check if mkcert is available

if command -v mkcert >/dev/null 2>&1; then

echo "🔐 Using mkcert for trusted certificates..."

docker-compose -f docker-compose.yml -f docker/docker-compose.https-mkcert.yml up -d

else

echo "⚠️ mkcert not found on host. Using self-signed certificates instead."

echo " Install mkcert for trusted certificates: brew install mkcert (Mac) or choco install mkcert (Windows)"

echo ""

docker-compose -f docker-compose.yml -f docker/docker-compose.https-auto.yml up -d

fi

echo "🔐 Using self-signed certificates..."

docker-compose -f docker-compose.yml -f docker/docker-compose.https-auto.yml up -d

echo ""

echo "=========================================="

echo "✅ TimeTracker is starting with HTTPS!"

echo "=========================================="

echo ""

echo "Access your application at:"

echo " https://localhost"

echo " https://$LOCAL_IP"

echo ""

if [ "$CERT_METHOD" = "1" ] || ! command -v mkcert >/dev/null 2>&1; then

echo "⚠️ Browser Warning Expected:"

echo " Self-signed certificates will show a security warning."

echo " Click 'Advanced' → 'Proceed to localhost (unsafe)' to continue."

echo ""

echo " For no warnings, run: bash setup-https-mkcert.sh"

echo "📋 To avoid browser warnings:"

echo " Install the CA certificate from: nginx/ssl/rootCA.pem"

echo " See instructions above or in HTTPS_MKCERT_GUIDE.md"

echo ""

echo "View logs:"

echo " docker-compose logs -f"

echo ""

echo "Stop services:"

echo " docker-compose down"

echo ""