#!/bin/bash
# Decrypt SOPS secrets to .env.local for local development
# Usage: ./scripts/decrypt-secrets.sh

set -e

SOPS_AGE_KEY_FILE="${SOPS_AGE_KEY_FILE:-$HOME/.sops/key.txt}"

if [ ! -f "$SOPS_AGE_KEY_FILE" ]; then
  echo "Error: Age key not found at $SOPS_AGE_KEY_FILE"
  exit 1
fi

if [ ! -f "secrets.enc.yaml" ]; then
  echo "Error: secrets.enc.yaml not found"
  exit 1
fi

echo "Decrypting secrets..."
SOPS_AGE_KEY_FILE="$SOPS_AGE_KEY_FILE" sops --decrypt secrets.enc.yaml | \
  sed 's/: /=/' > .env.local

echo "Created .env.local"