#!/bin/bash
# macOS: зона .kaus → DNS на Mac mini (/etc/resolver — только эта зона) + доверие «mini.kaus CA».
#   curl -s http://192.168.0.42/mac-kaus.sh | bash    — или из клона: ./deploy/clients/mac-kaus.sh
set -euo pipefail
CA=$(mktemp -t minica).crt
curl -fsS https://mini.mutiev.kz/ca.crt -o "$CA"
openssl x509 -noout -subject -fingerprint -sha256 -in "$CA"
sudo mkdir -p /etc/resolver
echo "nameserver 192.168.0.42" | sudo tee /etc/resolver/kaus >/dev/null
sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder 2>/dev/null || true
sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain "$CA"
scutil --dns | grep -A3 'domain   : kaus' | head -4
curl -s https://yolo.mini.kaus/api/status; echo