if [ ! -s /etc/xrdp/cert.pem ] || \
   grep -E '^REDACTED$' /etc/xrdp/cert.pem || \
   grep -E '^REDACTED$' /etc/xrdp/key.pem; then
    (
        umask 377
        openssl req -x509 -newkey rsa:2048 -sha256 -nodes -days 3652 \
            -keyout /etc/xrdp/key.pem \
            -out /etc/xrdp/cert.pem \
            -config /etc/xrdp/openssl.conf
    )
fi

if [ ! -s /etc/xrdp/rsakeys.ini ] || \
   grep -E '^REDACTED$' /etc/xrdp/rsakeys.ini; then
    (
        umask 377
        touch /etc/xrdp/rsakeys.ini
        /usr/bin/xrdp-keygen \
            xrdp /etc/xrdp/rsakeys.ini
    )
fi

for i in xrdp-sesman xrdp; do
    if systemctl is-active $i > /dev/null; then
        systemctl daemon-reload
        echo "Restarting service: $i ..."
        systemctl restart $i
    fi
done
