#!/bin/bash
# ============================================================
# opsx-loki Secure Entrypoint
# ============================================================
# Enforces required secrets at container startup
# Supports Docker Secrets file-based injection
# ============================================================
set -e

# ---- Docker Secrets support ----
# If *_FILE is provided, read the secret from that file path
# (Docker Swarm / Docker Compose secrets)
if [ -n "${JWT_SECRET_FILE:-}" ] && [ -r "$JWT_SECRET_FILE" ]; then
    JWT_SECRET=$(cat "$JWT_SECRET_FILE")
    export JWT_SECRET
fi

if [ -n "${ENCRYPTION_KEY_FILE:-}" ] && [ -r "$ENCRYPTION_KEY_FILE" ]; then
    ENCRYPTION_KEY=$(cat "$ENCRYPTION_KEY_FILE")
    export ENCRYPTION_KEY
fi

# ---- Runtime security validation ----
MISSING_VARS=()

# P0: JWT_SECRET must be provided at runtime
if [ -z "${JWT_SECRET:-}" ]; then
    MISSING_VARS+=("JWT_SECRET")
fi

# P0: ENCRYPTION_KEY must be provided at runtime for AES credential encryption
if [ -z "${ENCRYPTION_KEY:-}" ]; then
    MISSING_VARS+=("ENCRYPTION_KEY")
fi

if [ ${#MISSING_VARS[@]} -ne 0 ]; then
    echo "============================================================" >&2
    echo "FATAL: Missing required security environment variables" >&2
    echo "============================================================" >&2
    for var in "${MISSING_VARS[@]}"; do
        echo "  - $var" >&2
    done
    echo "" >&2
    echo "These MUST be provided at runtime. Examples:" >&2
    echo "" >&2
    echo '  docker run -e JWT_SECRET="$(openssl rand -hex 32)" -e ENCRYPTION_KEY="$(openssl rand -hex 32)" opsxloki' >&2
    echo "" >&2
    echo "Or via docker-compose secrets (recommended for production):" >&2
    echo '  secrets:' >&2
    echo '    - jwt_secret' >&2
    echo '    - encryption_key' >&2
    echo '  environment:' >&2
    echo '    JWT_SECRET_FILE: /run/secrets/jwt_secret' >&2
    echo '    ENCRYPTION_KEY_FILE: /run/secrets/encryption_key' >&2
    echo "============================================================" >&2
    exit 1
fi

# ---- Validate JWT_SECRET strength ----
SECRET_LEN=${#JWT_SECRET}
if [ "$SECRET_LEN" -lt 32 ]; then
    echo "WARNING: JWT_SECRET should be at least 32 characters long (current: $SECRET_LEN)" >&2
    echo "  Generate with: openssl rand -hex 32" >&2
fi

# ---- Validate ENCRYPTION_KEY strength ----
# config.go 在 ENCRYPTION_KEY < 32 字符时会 log.Fatal 拒绝启动；
# 此处前置硬校验，避免容器进入"entrypoint 通过但 Go 进程崩溃"的死循环。
KEY_LEN=${#ENCRYPTION_KEY}
if [ "$KEY_LEN" -lt 32 ]; then
    echo "============================================================" >&2
    echo "FATAL: ENCRYPTION_KEY must be at least 32 characters (current: $KEY_LEN)" >&2
    echo "  Generate with: openssl rand -hex 32" >&2
    echo "============================================================" >&2
    exit 1
fi

# ---- Signal handling for graceful shutdown ----
# Forward signals to the application
shutdown() {
    echo "Entrypoint received shutdown signal, forwarding to application..."
    kill -TERM "$child" 2>/dev/null || true
    wait "$child" 2>/dev/null || true
    exit 0
}
trap shutdown SIGTERM SIGINT

echo "opsx-loki starting with security configuration OK"
echo "Data directory: ${DATA_DIR}"
echo "Server port: ${SERVER_PORT}"

# ---- Start the main application ----
# Use exec to properly forward signals, but wrap with background + wait
# so this script's trap handler can intercept signals
"$@" &
child=$!
wait "$child"