#!/bin/sh
set -eu

fail_secret() {
  echo "PostgreSQL secret-file validation failed" >&2
  exit 78
}

source_root=/run/secrets
runtime_root=/run/itworx-secrets
runtime_uid="$(id -u postgres)"
runtime_gid="$(id -g postgres)"

install -d -o root -g "$runtime_gid" -m 0750 "$runtime_root"

for name in postgres_superuser_password hub_database_password contextforge_database_password; do
  source="$source_root/$name"
  target="$runtime_root/$name"
  [ -f "$source" ] && [ ! -L "$source" ] && [ -r "$source" ] && [ -s "$source" ] || fail_secret
  mode="$(stat -c '%a' "$source" 2>/dev/null || true)"
  case "$mode" in 400|600) ;; *) fail_secret ;; esac
  [ "$(stat -c '%u' "$source" 2>/dev/null || true)" = "${SECRET_EXPECTED_UID:?}" ] || fail_secret
  [ "$(stat -c '%g' "$source" 2>/dev/null || true)" = "${SECRET_EXPECTED_GID:?}" ] || fail_secret
  [ "$(wc -c < "$source")" -le 8192 ] || fail_secret
  value="$(tr -d '\r\n' < "$source")"
  [ -n "$value" ] || fail_secret
  unset value
  install -o "$runtime_uid" -g "$runtime_gid" -m 0400 "$source" "$target"
done

export POSTGRES_PASSWORD_FILE="$runtime_root/postgres_superuser_password"
export POSTGRES_SECRET_ROOT="$runtime_root"
export POSTGRES_SECRET_EXPECTED_UID="$runtime_uid"
export POSTGRES_SECRET_EXPECTED_GID="$runtime_gid"

exec /usr/local/bin/docker-entrypoint.sh "$@"