#!/bin/sh
set -eu

: "${TROCH_DC1_IP:?TROCH_DC1_IP must be set in .env}"
: "${TROCH_DC2_IP:?TROCH_DC2_IP must be set in .env}"
: "${OSWALD_DC_IP:?OSWALD_DC_IP must be set in .env}"

envsubst '${TROCH_DC1_IP} ${TROCH_DC2_IP} ${OSWALD_DC_IP}' \
  < /etc/unbound/unbound.conf.template \
  > /etc/unbound/unbound.conf

# DNSSEC root trust anchor for public resolution (exit 1 just means "updated")
unbound-anchor -a /etc/unbound/root.key || true
chown unbound:unbound /etc/unbound/root.key

unbound-checkconf /etc/unbound/unbound.conf
exec unbound -d -c /etc/unbound/unbound.conf