#!/usr/bin/env bash
# Rend config.yml, garage.toml, cantaloupe.properties et .env à partir des templates + secrets.
source "$(dirname "$0")/lib.sh"
load_secrets

command -v envsubst >/dev/null || { echo "❌ 'envsubst' requis (paquet gettext)"; exit 1; }

log "Rendu des fichiers de configuration (DOMAIN=$DOMAIN)…"
export DOMAIN SECRET_KEY PG_PASS GK_ID GK_SECRET GARAGE_RPC GARAGE_ADMIN_TOKEN

envsubst '${DOMAIN} ${SECRET_KEY} ${PG_PASS} ${GK_ID} ${GK_SECRET}' \
  < "$ROOT/templates/config.yml.tmpl" > "$ROOT/config.yml"
envsubst '${DOMAIN} ${GARAGE_RPC} ${GARAGE_ADMIN_TOKEN}' \
  < "$ROOT/templates/garage.toml.tmpl" > "$ROOT/garage.toml"
envsubst '${DOMAIN}' \
  < "$ROOT/templates/cantaloupe.properties.tmpl" > "$ROOT/cantaloupe.properties"

cat > "$ROOT/.env" <<EOF
PG_PASS=${PG_PASS}
GK_ID=${GK_ID}
GK_SECRET=${GK_SECRET}
EOF

# Le backend tourne en uid 2000 : les fichiers montés doivent être lisibles (644).
chmod 644 "$ROOT/config.yml" "$ROOT/garage.toml" "$ROOT/cantaloupe.properties"
chmod 600 "$ROOT/.env"
ok "config.yml, garage.toml, cantaloupe.properties, .env générés."