#!/usr/bin/env bash
# Generates a WireGuard keypair for one peer (run once on the VPS, once on
# the Pi). Requires the `wireguard-tools` package (provides `wg`).
#
# Usage: ./generate-keys.sh <peer-name>
# Writes <peer-name>.privatekey and <peer-name>.publickey into this
# directory. Never commit the .privatekey file — it's gitignored.
set -euo pipefail

peer_name="${1:?Usage: $0 <peer-name>}"
dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

umask 077
wg genkey | tee "$dir/$peer_name.privatekey" | wg pubkey > "$dir/$peer_name.publickey"

echo "Wrote $dir/$peer_name.privatekey (keep this secret, never commit it)"
echo "Wrote $dir/$peer_name.publickey (paste this into the other peer's config)"