#!/bin/sh
set -eu

for v in TROCH_DC1_IP TROCH_DC2_IP DUO_IKEY DUO_SKEY DUO_API_HOST \
         DUO_SVC_USER DUO_SVC_PASSWORD AD_SEARCH_DN RADIUS_SECRET; do
  eval "val=\${$v:-}"
  [ -n "$val" ] || { echo "ERROR: $v is not set (see .env.example)" >&2; exit 1; }
done

if [ ! -f /certs/ad-ldaps-ca.pem ]; then
  echo "ERROR: /certs/ad-ldaps-ca.pem missing — export your AD LDAPS issuing" >&2
  echo "CA chain into duo-authproxy/certs/ (see certs/README.md)" >&2
  exit 1
fi

envsubst '${TROCH_DC1_IP} ${TROCH_DC2_IP} ${DUO_IKEY} ${DUO_SKEY} ${DUO_API_HOST} ${DUO_SVC_USER} ${DUO_SVC_PASSWORD} ${AD_SEARCH_DN} ${RADIUS_SECRET} ${DUO_SECURITY_GROUP_DN}' \
  < /opt/duoauthproxy/conf/authproxy.cfg.template \
  > /opt/duoauthproxy/conf/authproxy.cfg
chmod 600 /opt/duoauthproxy/conf/authproxy.cfg

# Optional pre-flight (LDAPS reachability, Duo API ping). Non-fatal so a
# temporarily unreachable DC doesn't crash-loop the container.
/opt/duoauthproxy/bin/authproxy_connectivity_tool || true

exec /opt/duoauthproxy/bin/authproxy