#!/bin/sh
set -eu

fail() {
	echo "edge configuration rejected: $1" >&2
	exit 64
}

host=${TRUF_EDGE_HOST:-}
prefix=${TRUF_ADMIN_PREFIX:-}
user=${TRUF_ADMIN_USER:-}
password_hash=${TRUF_ADMIN_PASSWORD_HASH:-}
edge_marker=${TRUF_ADMIN_EDGE_MARKER:-}
edge_mode=${TRUF_EDGE_MODE:-standalone-edge-v1}
ingress_marker=${TRUF_SHARED_INGRESS_MARKER:-}
tls_include=${TRUF_EDGE_TLS_INCLUDE:-}

case "$edge_mode" in
	standalone-edge-v1) caddyfile=/etc/caddy/Caddyfile ;;
	shared-host-edge-v1)
		caddyfile=/etc/caddy/Caddyfile.shared-host
		[ "${#ingress_marker}" -eq 64 ] || fail "TRUF_SHARED_INGRESS_MARKER must encode 256 random bits"
		printf '%s' "$ingress_marker" | grep -Eq '^[0-9a-f]{64}$' \
			|| fail "TRUF_SHARED_INGRESS_MARKER must encode 256 random bits"
		;;
	*) fail "TRUF_EDGE_MODE is unsupported" ;;
esac

if [ "$host" = localhost ]; then
	[ -n "$tls_include" ] || fail "localhost requires an explicit static TLS include"
else
	case "$host" in
		''|*://*|*/*|*:*|.*|*..*|*.) fail "TRUF_EDGE_HOST must be one DNS hostname" ;;
	esac
	printf '%s' "$host" | awk -F. '
		length($0) > 253 || NF < 2 { exit 1 }
		{ for (i = 1; i <= NF; i++) if (length($i) > 63 || $i !~ /^[A-Za-z0-9-]+$/ || $i ~ /^-/ || $i ~ /-$/) exit 1 }
	' \
		|| fail "TRUF_EDGE_HOST must be one DNS hostname"
fi

if [ -n "$tls_include" ]; then
	case "$tls_include" in
		/etc/caddy/tls/*.caddy) ;;
		*) fail "TRUF_EDGE_TLS_INCLUDE must be an absolute Caddy TLS include" ;;
	esac
	[ -f "$tls_include" ] && [ ! -L "$tls_include" ] \
		|| fail "TRUF_EDGE_TLS_INCLUDE must be a regular non-link file"
fi

[ "${#prefix}" -eq 64 ] || fail "TRUF_ADMIN_PREFIX must encode 256 random bits"
printf '%s' "$prefix" | grep -Eq '^[0-9a-f]{64}$' \
	|| fail "TRUF_ADMIN_PREFIX must encode 256 random bits"

printf '%s' "$user" | grep -Eq '^[A-Za-z0-9_.-]{1,64}$' \
	|| fail "TRUF_ADMIN_USER has an unsupported form"
printf '%s' "$password_hash" | grep -Eq '^\$2[aby]\$(0[4-9]|[12][0-9]|3[01])\$[./A-Za-z0-9]{53}$' \
	|| fail "TRUF_ADMIN_PASSWORD_HASH must be a supported bcrypt hash"
[ "${#edge_marker}" -eq 64 ] || fail "TRUF_ADMIN_EDGE_MARKER must encode 256 random bits"
printf '%s' "$edge_marker" | grep -Eq '^[0-9a-f]{64}$' \
	|| fail "TRUF_ADMIN_EDGE_MARKER must encode 256 random bits"

[ -f /etc/caddy/denylist/admin-denylist.caddy ] \
	|| fail "the managed admin denylist snippet is missing"
[ ! -L /etc/caddy/denylist/admin-denylist.caddy ] \
	|| fail "the managed admin denylist snippet must not be a link"
[ -d /var/log/caddy ] && [ -w /var/log/caddy ] \
	|| fail "the authentication log directory is not writable"

umask 077
exec caddy run --config "$caddyfile" --adapter caddyfile