{% extends "base.html" %}
{% block title %} - Setup{% endblock %}
{% block content %}
<h1 class="text-2xl font-bold mb-2">Setup</h1>
<p class="text-gray-400 mb-6">Install the CA chain on client machines to trust certificates from this authority.</p>

<!-- Quick Install -->
<div class="bg-blue-900/50 rounded-lg p-6 border border-blue-700 mb-6">
    <h2 class="font-bold mb-3">Quick Install</h2>
    <p class="text-sm text-gray-300 mb-3">Run one command on any machine to download and install the CA chain automatically.</p>

    <div class="space-y-3">
        <div>
            <span class="text-sm text-gray-400">Linux / macOS</span>
            <pre class="bg-gray-900 rounded p-3 text-sm mt-1 overflow-x-auto"><code>curl -sL http://192.168.8.248/setup.sh | sudo bash</code></pre>
        </div>
        <div>
            <span class="text-sm text-gray-400">Windows (PowerShell)</span>
            <pre class="bg-gray-900 rounded p-3 text-sm mt-1 overflow-x-auto"><code>iwr http://192.168.8.248/setup.ps1 -UseBasicParsing | iex</code></pre>
        </div>
    </div>
</div>

<!-- Download CA Chain -->
<div class="bg-gray-800 rounded-lg p-6 border border-gray-700 mb-6">
    <h2 class="font-bold mb-4">Manual Download</h2>
    <p class="text-sm text-gray-400 mb-4">Contains the Intermediate + Root CA certificates.</p>
    <a href="/api/ca-chain" class="inline-block bg-blue-600 hover:bg-blue-500 px-4 py-2 rounded font-medium text-white">Download ca-chain.crt</a>
</div>

<!-- Platform Instructions -->
<div class="space-y-4">
    <h2 class="font-bold text-lg">Manual Installation</h2>

    <!-- Linux Debian/Ubuntu -->
    <div class="bg-gray-800 rounded-lg p-6 border border-gray-700">
        <h3 class="font-bold mb-2">Linux (Debian/Ubuntu)</h3>
        <pre class="bg-gray-900 rounded p-3 text-sm overflow-x-auto"><code>sudo cp ca-chain.crt /usr/local/share/ca-certificates/certauth.crt
sudo update-ca-certificates</code></pre>
    </div>

    <!-- Linux Fedora/RHEL -->
    <div class="bg-gray-800 rounded-lg p-6 border border-gray-700">
        <h3 class="font-bold mb-2">Linux (Fedora/RHEL)</h3>
        <pre class="bg-gray-900 rounded p-3 text-sm overflow-x-auto"><code># System trust store (curl, openssl)
sudo cp ca-chain.crt /etc/pki/ca-trust/source/anchors/certauth.crt
sudo update-ca-trust

# NSS database (Firefox, Thunderbird)
sudo certutil -A -n "CertAuth Root CA" -t "CT,Cu,Tu" -d sql:/etc/pki/nssdb/ -i ca-chain.crt</code></pre>
    </div>

    <!-- LibreWolf -->
    <div class="bg-gray-800 rounded-lg p-6 border border-gray-700">
        <h3 class="font-bold mb-2">LibreWolf</h3>
        <p class="text-sm text-gray-400 mb-2">LibreWolf uses its own NSS database and disables enterprise roots by default. Enable enterprise roots in <code class="bg-gray-700 px-1 rounded">about:config</code> → set <code class="bg-gray-700 px-1 rounded">security.enterprise_roots.enabled</code> to <code class="bg-gray-700 px-1 rounded">true</code>.</p>
        <pre class="bg-gray-900 rounded p-3 text-sm overflow-x-auto"><code># Import root CA to your LibreWolf profile
certutil -A -n "CertAuth Root CA" -t "CT,Cu,Tu" -d ~/.librewolf/&lt;profile&gt;/ -i ca-chain.crt

# Clear SSL state cache if you previously got a cert error
rm ~/.librewolf/&lt;profile&gt;/SiteSecurityServiceState.bin</code></pre>
    </div>

    <!-- macOS -->
    <div class="bg-gray-800 rounded-lg p-6 border border-gray-700">
        <h3 class="font-bold mb-2">macOS</h3>
        <pre class="bg-gray-900 rounded p-3 text-sm overflow-x-auto"><code>sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain ca-chain.crt</code></pre>
    </div>

    <!-- Windows -->
    <div class="bg-gray-800 rounded-lg p-6 border border-gray-700">
        <h3 class="font-bold mb-2">Windows</h3>
        <p class="text-sm text-gray-400 mb-2">Double-click <code class="bg-gray-700 px-1 rounded">ca-chain.crt</code>, then:</p>
        <pre class="bg-gray-900 rounded p-3 text-sm overflow-x-auto"><code>1. Click "Install Certificate"
2. Select "Local Machine" → Next
3. Select "Place all certificates in the following store"
4. Browse → "Trusted Root Certification Authorities"
5. OK → Next → Finish</code></pre>
    </div>

    <!-- Docker -->
    <div class="bg-gray-800 rounded-lg p-6 border border-gray-700">
        <h3 class="font-bold mb-2">Docker</h3>
        <pre class="bg-gray-900 rounded p-3 text-sm overflow-x-auto"><code>COPY ca-chain.crt /usr/local/share/ca-certificates/certauth.crt
RUN update-ca-certificates</code></pre>
    </div>
</div>
{% endblock %}