set fallback

# Run a localhost relay server without authentication.
default:
    cargo run --bin moq-relay -- localhost.toml

# Run a cluster of relay servers.
#
# The relays grant anonymous access (see *.toml), so no JWT is needed locally.

# Cluster peers still authenticate to each other via mTLS (the cert/ca recipes).
cluster:
    bun install

    bun run concurrently --kill-others --names root,leaf0,leaf1,bbb,tos,web --prefix-colors auto \
    	"just root" \
    	"just wait http://localhost:4443/certificate.sha256 && just leaf0" \
    	"just wait http://localhost:4443/certificate.sha256 && just leaf1" \
    	"just wait http://localhost:4444/certificate.sha256 && just pub bbb http://localhost:4444" \
    	"just wait http://localhost:4443/certificate.sha256 && just pub tos http://localhost:4443" \
    	"just wait http://localhost:4445/certificate.sha256 && VITE_RELAY_URL=http://localhost:4445 bun --cwd ../web --bun vite"

# Run a localhost root server, accepting connections from leaf nodes.
root: (cert "root")
    cargo run --bin moq-relay -- root.toml

# Run a localhost leaf, connecting to the root server.
leaf0: (cert "leaf0")
    cargo run --bin moq-relay -- leaf0.toml

# Run a second localhost leaf, connecting to the root server.
leaf1: (cert "leaf1")
    cargo run --bin moq-relay -- leaf1.toml

# Generate a self-signed CA
ca:
    #!/usr/bin/env bash
    set -euo pipefail
    umask 077

    [ -f ca.pem ] && [ -f ca.key ] && exit 0
    rm -f ca.pem ca.key
    printf '[req]\ndistinguished_name = req_dn\n[req_dn]\n' > ca.cnf
    export OPENSSL_CONF="ca.cnf"
    openssl req -x509 -sha256 -newkey ec -pkeyopt ec_paramgen_curve:prime256v1 -nodes \
    	-days 365 -subj "/CN=moq cluster CA" \
    	-keyout ca.key -out ca.pem

# Generate a self-signed certificate using the root CA.

# Chrome requires a <=14 day validity for self-signed certs.
cert name: ca
    #!/usr/bin/env bash
    set -euo pipefail
    umask 077

    export OPENSSL_CONF="ca.cnf"
    openssl req -newkey ec -pkeyopt ec_paramgen_curve:prime256v1 -nodes \
    	-subj "/CN={{ name }}" \
    	-keyout "{{ name }}.key" -out "{{ name }}.csr"
    openssl x509 -req -sha256 -in "{{ name }}.csr" \
    	-CA ca.pem -CAkey ca.key -CAcreateserial \
    	-days 14 -extfile <(printf "subjectAltName=DNS:localhost\n") \
    	-out "{{ name }}.crt"
    rm "{{ name }}.csr"

# Generate a random secret key for authentication.
key:
    #!/usr/bin/env bash
    set -euo pipefail
    umask 077

    [ -f root.jwk ] && exit 0
    rm -f *.jwt
    cargo run --bin moq-token -- generate --out root.jwk

# Generate authentication tokens for local development.
token: key
    #!/usr/bin/env bash
    set -euo pipefail
    umask 077

    if [ ! -f demo-web.jwt ]; then
        cargo run --quiet --bin moq-token -- sign --key root.jwk \
    		--root demo --subscribe "" --publish me \
    		> demo-web.jwt
    fi

    if [ ! -f demo-cli.jwt ]; then
        cargo run --quiet --bin moq-token -- sign --key root.jwk \
    		--root demo --publish "" \
    		> demo-cli.jwt
    fi
