claude generated first pass

duo-authproxy/entrypoint.sh

@@ -0,0 +1,25 @@
+#!/bin/sh
+set -eu
+
+for v in TROCH_DC1_IP TROCH_DC2_IP DUO_IKEY DUO_SKEY DUO_API_HOST \
+         DUO_SVC_USER DUO_SVC_PASSWORD AD_SEARCH_DN RADIUS_SECRET; do
+  eval "val=\${$v:-}"
+  [ -n "$val" ] || { echo "ERROR: $v is not set (see .env.example)" >&2; exit 1; }
+done
+
+if [ ! -f /certs/ad-ldaps-ca.pem ]; then
+  echo "ERROR: /certs/ad-ldaps-ca.pem missing — export your AD LDAPS issuing" >&2
+  echo "CA chain into duo-authproxy/certs/ (see certs/README.md)" >&2
+  exit 1
+fi
+
+envsubst '${TROCH_DC1_IP} ${TROCH_DC2_IP} ${DUO_IKEY} ${DUO_SKEY} ${DUO_API_HOST} ${DUO_SVC_USER} ${DUO_SVC_PASSWORD} ${AD_SEARCH_DN} ${RADIUS_SECRET}' \
+  < /opt/duoauthproxy/conf/authproxy.cfg.template \
+  > /opt/duoauthproxy/conf/authproxy.cfg
+chmod 600 /opt/duoauthproxy/conf/authproxy.cfg
+
+# Optional pre-flight (LDAPS reachability, Duo API ping). Non-fatal so a
+# temporarily unreachable DC doesn't crash-loop the container.
+/opt/duoauthproxy/bin/authproxy_connectivity_tool || true
+
+exec /opt/duoauthproxy/bin/authproxy