The FAPI trusted directory

#!/usr/bin/env bash

DOCKER_IMAGE="gcr.io/forgerock-io/ig-sample-trusted-directory:2026.6.0"
SECRETS_DIR="trusted-directory/secrets"
KEYSTORE_FILE="${SECRETS_DIR}/trusted-directory-keystore.p12"

checkForDocker() {
  OUT=$(docker --version)
  RC=$?
  if [ $RC -ne 0 ]; then
      echo "### 'docker' command not found. The sample trusted directory requires Docker to run."
      exit $RC
  else
    echo "Found ${OUT}"
  fi
}

checkForKeytool() {
  OUT=$(keytool --version)
  RC=$?
  if [ $RC -ne 0 ]; then
      echo "### 'keytool' command not found. The sample trusted directory requires keytool to create test keys."
      exit $RC
  else
    echo "Found ${OUT}"
  fi
}

createKeys() {
  echo "### Creating trusted directory keystore ${PWD}/${KEYSTORE_FILE}..."
  echo
  mkdir -p "${SECRETS_DIR}"

  echo "### Generating CA keys..."
  echo
  keytool -keystore "${KEYSTORE_FILE}" -storetype PKCS12 \
          -genkeypair -alias ca -ext bc=ca:true -keyalg RSA -keysize 4096 -validity 365 \
          -dname "CN=PingGateway Sample Trusted Directory Root CA" \
          -storepass changeit -keypass changeit

  echo
  echo "### Generating JWT Signing keys..."
  echo
  keytool -keystore "${KEYSTORE_FILE}" -storetype PKCS12 \
          -genkeypair -alias jwt-signer -keyalg RSA -keysize 4096 -validity 365 \
          -dname "CN=PingGateway Sample Trusted Directory JWT Signer" \
          -storepass changeit -keypass changeit

  echo
  echo "### Listing keystore contents..."
  echo
  keytool -keystore "${KEYSTORE_FILE}" -storetype PKCS12 -list -storepass changeit

  echo
  echo "### Exporting CA certificate..."
  echo
  keytool -exportcert -alias ca -rfc -file "${SECRETS_DIR}/trusted-directory-ca.pem" \
          -keystore "${KEYSTORE_FILE}" -storetype PKCS12 -storepass changeit

  echo
  echo "### Done."
}

initializeDataDir() {
    echo "### Initializing trusted directory data directory..."
    echo
    mkdir -p "${PWD}/trusted-directory/data"
}

runTestTrustedDirectory() {
  echo "### Running sample trusted directory in Docker..."
  echo

  docker pull "${DOCKER_IMAGE}"

  docker run \
  --detach \
  --init \
  --tty \
  --rm \
  --mount type=bind,src="${PWD}/trusted-directory",dst="/var/trusted-directory" \
  --env TD_CONFIG_PATH="/var/trusted-directory/config/config.yml" \
  --env TD_SIGNING_KEYSTORE_PWD=changeit \
  --env TD_SIGNING_KEYSTORE_KEY_PWD=changeit \
  --env TD_CA_KEYSTORE_PWD=changeit \
  --env TD_CA_KEYSTORE_KEY_PWD=changeit \
  --name sample-trusted-directory \
  --publish 9080:8080 \
  "${DOCKER_IMAGE}"
}

checkForDocker

if [ ! -f "${KEYSTORE_FILE}" ]; then
  checkForKeytool
  createKeys
else
  echo "### Sample trusted directory keystore already exists, skipping key creation."
  echo
fi

initializeDataDir

runTestTrustedDirectory

keytool -keystore secrets/keystore.p12 -storetype PKCS12 \
        -importcert -trustcacerts -alias ca -rfc \
        -file trusted-directory/secrets/trusted-directory-ca.pem -storepass:file secrets/keystore.pin -noprompt