#!/usr/bin/env bash
# Gera valores fortes para os segredos do .env.
# Uso: ./scripts/generate-secrets.sh   (imprime pares KEY=VALUE para colar no .env)
set -euo pipefail

rand_hex() { openssl rand -hex "${1:-32}"; }
rand_b64() { openssl rand -base64 "${1:-32}"; }

echo "POSTGRES_PASSWORD=$(rand_hex 24)"
echo "REDIS_PASSWORD=$(rand_hex 24)"
echo "JWT_ACCESS_SECRET=$(rand_hex 64)"
echo "JWT_REFRESH_SECRET=$(rand_hex 64)"
echo "SECRETS_MASTER_KEY=$(rand_b64 32)"
echo "AMI_SECRET=$(rand_hex 24)"
echo "ARI_SECRET=$(rand_hex 24)"