#!/bin/sh
set -eu

fail() {
  echo "Redis secret-file validation failed" >&2
  exit 78
}

if [ "${REDIS_AUTH_ENABLED:-false}" = "true" ]; then
  secret=/run/secrets/redis_password
  [ -f "$secret" ] && [ -r "$secret" ] || fail
  [ -s "$secret" ] || fail
  mode="$(stat -c '%a' "$secret" 2>/dev/null || true)"
  case "$mode" in 400|600) ;; *) fail ;; esac
  [ "$(stat -c '%u' "$secret" 2>/dev/null || true)" = "${SECRET_EXPECTED_UID:?}" ] || fail
  [ "$(stat -c '%g' "$secret" 2>/dev/null || true)" = "${SECRET_EXPECTED_GID:?}" ] || fail
  password="$(tr -d '\r\n' < "$secret")"
  [ -n "$password" ] || fail
  umask 077
  {
    printf 'save ""\nappendonly no\nmaxmemory-policy allkeys-lru\nrequirepass '
    printf '%s' "$password" | sed 's/\\/\\\\/g; s/"/\\"/g'
    printf '\n'
  } > /run/itworx/redis.conf
  unset password
  exec redis-server /run/itworx/redis.conf
fi

exec redis-server --save "" --appendonly no --maxmemory-policy allkeys-lru