#!/bin/sh
set -eu

umask 077

TEMPLATE_PATH=/opt/netbird/config.template.yaml
RENDERED_PATH=/run/netbird/config.yaml
RELAY_SECRET_PATH=/run/secrets/relay_auth_secret
ENCRYPTION_KEY_PATH=/run/secrets/datastore_encryption_key

is_valid_proxy_subnet() {
  candidate="$1"
  case "$candidate" in
    0.0.0.0/0)
      return 1
      ;;
    */*)
      address="${candidate%%/*}"
      prefix="${candidate#*/}"
      ;;
    *)
      return 1
      ;;
  esac

  case "$prefix" in
    0|[1-9]|[1-2][0-9]|3[0-2]) ;;
    *)
      return 1
      ;;
  esac

  old_ifs="$IFS"
  IFS=.
  # shellcheck disable=SC2086
  set -- $address
  IFS="$old_ifs"
  [ "$#" -eq 4 ] || return 1

  for octet do
    case "$octet" in
      0|[1-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5]) ;;
      *)
        return 1
        ;;
    esac
  done
}

read_secret() {
  secret_path="$1"

  if [ ! -r "$secret_path" ]; then
    echo "Required secret is not readable: $secret_path" >&2
    exit 1
  fi

  secret_value="$(cat "$secret_path")"
  if [ -z "$secret_value" ]; then
    echo "Required secret is empty: $secret_path" >&2
    exit 1
  fi

  printf '%s' "$secret_value"
}

if [ -z "${NETBIRD_DOMAIN:-}" ]; then
  echo "NETBIRD_DOMAIN must be set" >&2
  exit 1
fi

case "$NETBIRD_DOMAIN" in
  *[!A-Za-z0-9.-]*)
    echo "NETBIRD_DOMAIN contains unsupported characters" >&2
    exit 1
    ;;
esac

if [ -z "${NETBIRD_PROXY_SUBNET:-}" ] || [ "$NETBIRD_PROXY_SUBNET" = "auto" ]; then
  echo "NETBIRD_PROXY_SUBNET must be an explicit IPv4 CIDR; run netbird/setup.sh first" >&2
  exit 1
fi
if ! is_valid_proxy_subnet "$NETBIRD_PROXY_SUBNET"; then
  echo "NETBIRD_PROXY_SUBNET must be a non-default IPv4 CIDR, for example 172.20.0.0/16" >&2
  exit 1
fi

if [ "$#" -ne 2 ] || [ "$1" != "--config" ] || [ "$2" != "$RENDERED_PATH" ]; then
  echo "Expected: --config $RENDERED_PATH" >&2
  exit 1
fi

relay_secret="$(read_secret "$RELAY_SECRET_PATH")"
encryption_key="$(read_secret "$ENCRYPTION_KEY_PATH")"

mkdir -p "$(dirname "$RENDERED_PATH")"
sed \
  -e "s|__NETBIRD_DOMAIN__|${NETBIRD_DOMAIN}|g" \
  -e "s|__NETBIRD_AUTH_SECRET__|${relay_secret}|g" \
  -e "s|__NETBIRD_ENCRYPTION_KEY__|${encryption_key}|g" \
  -e "s|__NETBIRD_PROXY_SUBNET__|${NETBIRD_PROXY_SUBNET}|g" \
  "$TEMPLATE_PATH" >"$RENDERED_PATH"

if grep -q '__NETBIRD_' "$RENDERED_PATH"; then
  echo "Rendered NetBird configuration still contains unresolved placeholders" >&2
  exit 1
fi

exec /go/bin/netbird-server "$@"