#!/bin/sh
# elevenlabs.io/docker-entrypoint.sh
# Generates Caddy access-control fragments from environment variables at container start.
set -e

CONF_DIR="/etc/caddy"
MATCHERS="${CONF_DIR}/matchers.caddy"
GUARD="${CONF_DIR}/guard.caddy"

: > "${MATCHERS}"
: > "${GUARD}"

# --- 0. Required settings ---
if [ -z "${DOMAIN}" ]; then
    echo "[entrypoint] FATAL: DOMAIN is not set (e.g. proxy.example.com)" >&2
    exit 1
fi
if [ -z "${ACME_EMAIL}" ]; then
    echo "[entrypoint] FATAL: ACME_EMAIL is not set — Let's Encrypt account needs it" >&2
    exit 1
fi

# --- 1. IP allowlist ---
if [ -z "${ALLOWED_CIDR}" ]; then
    echo "[entrypoint] ALLOWED_CIDR is empty — allowing all IPs (dev mode)"
else
    CIDR_LIST=$(echo "${ALLOWED_CIDR}" | tr ',' ' ' | tr -s ' ')
    cat >> "${MATCHERS}" <<MATCH
@denied_ip not remote_ip ${CIDR_LIST}
MATCH
    cat >> "${GUARD}" <<GUARDRULE
respond @denied_ip \`{"error":"ip_not_allowed"}\` 403 {
	close
}
GUARDRULE
    echo "[entrypoint] IP allowlist configured: ${CIDR_LIST}"
fi

# --- 2. Token auth ---
if [ -z "${PROXY_SECRET}" ]; then
    echo "[entrypoint] PROXY_SECRET is not set — token auth disabled (open mode)"
else
    cat >> "${MATCHERS}" <<MATCH
@bad_token not header X-Proxy-Token "${PROXY_SECRET}"
MATCH
    cat >> "${GUARD}" <<GUARDRULE
respond @bad_token \`{"error":"invalid_token"}\` 403 {
	close
}
GUARDRULE
    echo "[entrypoint] Token auth configured"
fi

# --- 3. Validate and start ---
caddy validate --config /etc/caddy/Caddyfile --adapter caddyfile
echo "[entrypoint] Starting caddy (domain: ${DOMAIN})..."
exec caddy run --config /etc/caddy/Caddyfile --adapter caddyfile