#!/bin/sh
# SPDX-FileCopyrightText: 2026 Bart Broere
# SPDX-License-Identifier: GPL-3.0-or-later
# Starts boltage. With BOLTAGE_TLS_SELF_SIGNED=true, it first generates a self-signed
# TLS certificate, or reuses the one from an earlier start, and points boltage at it.
set -eu

if [ "${BOLTAGE_TLS_SELF_SIGNED:-false}" = "true" ]; then
    if [ -n "${BOLTAGE_TLS_CERT:-}${BOLTAGE_TLS_KEY:-}" ]; then
        echo "boltage: BOLTAGE_TLS_CERT or BOLTAGE_TLS_KEY is set, not using a self-signed certificate" >&2
    else
        dir="${BOLTAGE_TLS_DIR:-/var/lib/boltage/tls}"
        cert="$dir/self-signed.crt"
        key="$dir/self-signed.key"

        # Host names and addresses the certificate is valid for.
        names="localhost,127.0.0.1,::1"
        [ -n "${BOLTAGE_ADVERTISED_HOST:-}" ] && names="$names,$BOLTAGE_ADVERTISED_HOST"
        [ -n "${BOLTAGE_TLS_HOSTNAMES:-}" ] && names="$names,$BOLTAGE_TLS_HOSTNAMES"
        is_ip() {
            case "$1" in
                *[!0-9.]*) ;;  # not IPv4
                *) return 0 ;;
            esac
            case "$1" in
                *:*) case "$1" in *[!0-9a-fA-F:.]*) return 1 ;; *) return 0 ;; esac ;;  # IPv6
            esac
            return 1
        }
        san=""
        for name in $(echo "$names" | tr ', ' '\n\n' | awk 'NF && !seen[$0]++'); do
            if is_ip "$name"; then
                san="${san:+$san,}IP:$name"
            else
                san="${san:+$san,}DNS:$name"
            fi
        done

        # Generate a new certificate on first start, when the names changed, or when the
        # stored one expires within 30 days.
        if [ ! -s "$key" ] || [ "$(cat "$dir/self-signed.names" 2>/dev/null)" != "$san" ] \
                || ! openssl x509 -in "$cert" -noout -checkend 2592000 >/dev/null 2>&1; then
            (umask 077 && mkdir -p "$dir")
            (umask 077 && openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:prime256v1 -nodes \
                -days 825 -subj "/CN=boltage" -addext "subjectAltName=$san" \
                -addext "extendedKeyUsage=serverAuth" \
                -keyout "$key.new" -out "$cert.new" 2>/dev/null)
            mv "$key.new" "$key"
            mv "$cert.new" "$cert"
            echo "$san" > "$dir/self-signed.names"
            echo "boltage: generated a self-signed TLS certificate for $san in $dir"
        fi
        echo "boltage: self-signed TLS certificate, $(openssl x509 -in "$cert" -noout -fingerprint -sha256)"
        export BOLTAGE_TLS_CERT="$cert" BOLTAGE_TLS_KEY="$key"
    fi
fi

exec /opt/boltage/venv/bin/boltage "$@"