#!/usr/bin/env bash
set -euo pipefail

export GPG_TTY=$(tty)

function ensure_secret() {
  local path=$1
  local description=$2
  local generate=${3:-false}

  if ! gopass show "$path" >/dev/null 2>&1; then
    echo "Missing secret: $description ($path)"
    if [ "$generate" = "true" ]; then
      local val=$(openssl rand -hex 32)
      gopass insert -f "$path" <<< "$val"
      echo "Generated and stored."
    else
      echo "Please enter the value for $description:"
      read -rs val
      gopass insert -f "$path" <<< "$val"
    fi
  fi
}

ensure_secret "projects/firecrawl-dokploy/dev/api_key" "Firecrawl API Key" true
ensure_secret "projects/firecrawl-dokploy/dev/bull_auth_key" "Bull Auth Key" true
ensure_secret "projects/firecrawl-dokploy/dev/postgres_password" "PostgreSQL Password" true
ensure_secret "projects/firecrawl-dokploy/dev/searxng_secret_key" "SearXNG Secret Key" true
ensure_secret "projects/firecrawl-dokploy/dev/openai_api_key" "OpenAI API Key (optional, press enter to skip)" false

echo "Dev secrets ensured."