#!/bin/sh
# Radicle seed node entrypoint. Idempotent: generates the node identity and
# writes an initial config.json on first run only. On later deploys the key and
# config persist in the RAD_HOME volume and are left untouched.
set -eu

: "${RAD_HOME:=/var/lib/radicle}"
export RAD_HOME
export PATH="/usr/local/bin:${PATH}"

# Key passphrase from the mounted secret. An empty value produces an
# unencrypted key (acceptable: the volume is the trust boundary).
if [ -f /run/secrets/keypass ]; then
  RAD_PASSPHRASE="$(cat /run/secrets/keypass)"
else
  RAD_PASSPHRASE=""
fi
export RAD_PASSPHRASE

mkdir -p "$RAD_HOME"

# First run: generate the Ed25519 node identity non-interactively.
if [ ! -f "$RAD_HOME/keys/radicle" ]; then
  echo "radicle: generating node identity (alias=${RAD_ALIAS:-seed})"
  rad auth --alias "${RAD_ALIAS:-seed}"
fi

# First run: write the seed configuration. Guarded by a sentinel so operators
# can edit config.json in the volume afterwards without it being overwritten.
if [ ! -f "$RAD_HOME/.seed-configured" ]; then
  echo "radicle: writing seed config.json"
  if [ "${RAD_SEEDING_POLICY:-allow}" = "allow" ]; then
    SEEDING_POLICY="{ \"default\": \"allow\", \"scope\": \"${RAD_SEEDING_SCOPE:-all}\" }"
  else
    SEEDING_POLICY="{ \"default\": \"block\" }"
  fi
  cat > "$RAD_HOME/config.json" <<EOF
{
  "node": {
    "alias": "${RAD_ALIAS:-seed}",
    "listen": ["0.0.0.0:${RAD_P2P_PORT:-8776}"],
    "externalAddresses": ["${RAD_EXTERNAL_ADDRESS}"],
    "seedingPolicy": ${SEEDING_POLICY}
  }
}
EOF
  touch "$RAD_HOME/.seed-configured"
fi

echo "radicle: node id $(rad self --nid 2>/dev/null || echo '<unknown>')"

# Canonical launch (mirrors the upstream systemd unit).
exec radicle-node --listen "0.0.0.0:${RAD_P2P_PORT:-8776}" --force