#!/usr/bin/env bash
# Generates a random OIDC client secret and prints:
#   - the plaintext  → goes in the app's .env as OIDC_CLIENT_SECRET
#   - the Authelia hash → goes in Authelia's configuration.yml client_secret field
# Run this on the Authelia host (needs openssl + authelia in PATH).
set -euo pipefail

SECRET=$(openssl rand -base64 48 | tr -d '/+=' | cut -c1-64)

echo "=== Plaintext secret (app .env → OIDC_CLIENT_SECRET) ==="
echo "$SECRET"
echo ""
echo "=== Authelia hash (configuration.yml → client_secret) ==="
authelia crypto hash generate argon2 --password "$SECRET"