%%%-------------------------------------------------------------------
%%% @author anlicheng
%%% @copyright (C) 2026, <COMPANY>
%%% @doc
%%%
%%% @end
%%% Created : 03. 5月 2026 13:31
%%%-------------------------------------------------------------------
-module(sdlan_ssl_server).
-author("anlicheng").

%% API
-export([start/0]).

%% 启动ssl服务
-spec start() -> ok.
start() ->
    {ok, Props} = application:get_env(sdlan, ssl_server),
    Acceptors = proplists:get_value(acceptors, Props, 50),
    MaxConnections = proplists:get_value(max_connections, Props, 10240),
    Backlog = proplists:get_value(backlog, Props, 1024),
    Port = proplists:get_value(port, Props),
    Limits = proplists:get_value(limits, Props, []),

    %% 证书配置
    {CertFile, KeyFile} = sdlan_util:certificate_config(),

    TransOpts = #{
        max_connections => MaxConnections,
        num_acceptors => Acceptors,
        shutdown => 2000,
        socket_opts => [
            binary,
            {active, false},
            {nodelay, true},
            {backlog, Backlog},
            {port, Port},
            {send_timeout, 30000},
            {send_timeout_close, true},
            {certfile, CertFile},
            {keyfile, KeyFile},
            {verify, verify_none},
            {alpn_preferred_protocols, [<<"punchnet/1.0">>]},
            {versions, ['tlsv1.3', 'tlsv1.2']},
            {secure_renegotiate, true},
            {reuse_sessions, true},
            {honor_cipher_order, true},
            {client_renegotiation, false}
        ]
    },
    {ok, Pid} = ranch:start_listener(ssl_server, ranch_ssl, TransOpts, sdlan_ssl_transport, Limits),
    logger:debug("[sdlan_ssl_server] the ssl server start at: ~p, pid is: ~p", [Port, Pid]).