#!/usr/bin/env bash
# Usage: bash manifests/home-services/alert-bridge-secret.sh
# Description: Regenerates the alert-bridge SealedSecret from .env
#
# Deliberately reads prefixed ALERT_BRIDGE_* variable names from the shared
# .env, unlike ha-gateway-secret.sh/discord-bot-secret.sh's unprefixed
# HA_TOKEN/DISCORD_TOKEN - "API_KEY" alone is too generic a name to trust to
# this repo's single flat .env namespace shared across every service's
# secret.sh script.
set -euo pipefail

source "$(dirname "$0")/../../.env"

kubectl create secret generic alert-bridge-secret \
  --namespace=home-services \
  --from-literal=API_KEY="${ALERT_BRIDGE_API_KEY}" \
  --from-literal=DISCORD_WEBHOOK_URL="${ALERT_BRIDGE_DISCORD_WEBHOOK_URL}" \
  --from-literal=MENTION_USER_ID="${ALERT_BRIDGE_MENTION_USER_ID}" \
  --dry-run=client -o yaml \
  | kubeseal --controller-namespace=kube-system \
           --controller-name=sealed-secrets-controller \
           --format=yaml \
  > "$(dirname "$0")/alert-bridge-sealed.yaml"

echo "alert-bridge-sealed.yaml regenerated — commit to repo"