#!/bin/sh
set -eu

required="PUBLIC_HOST NGINX_RATE_LIMIT_API NGINX_RATE_LIMIT_AUTH NGINX_RATE_LIMIT_PUBLIC NGINX_RATE_LIMIT_POLLING NGINX_RATE_LIMIT_DOWNLOADS NGINX_RATE_LIMIT_BITRIX NGINX_RATE_LIMIT_SMS_CALLBACK NGINX_RATE_LIMIT_WS NGINX_CLIENT_MAX_BODY_SIZE NGINX_MESSAGE_READ_TIMEOUT_SEC"
for name in $required; do
  eval "value=\${$name:-}"
  if [ -z "$value" ]; then
    echo "nginx bootstrap: missing $name" >&2
    exit 64
  fi
done

case "${EXPO_DEV_SERVER_URL:-http://host.docker.internal:8081}" in
  http://*/*) echo "nginx bootstrap: EXPO_DEV_SERVER_URL must not contain a path" >&2; exit 64 ;;
  http://*) EXPO_DEV_SERVER_HOSTPORT=${EXPO_DEV_SERVER_URL#http://} ;;
  *) echo "nginx bootstrap: EXPO_DEV_SERVER_URL must use http:// Docker/host DNS" >&2; exit 64 ;;
esac
export EXPO_DEV_SERVER_HOSTPORT

if [ "${FRONTEND_DEV_PROXY_ENABLED:-false}" = "true" ] \
   && { [ "${APP_ENV:-}" = "production" ] || [ "${APP_ENV:-}" = "production-like" ]; }; then
  echo "nginx bootstrap: frontend dev proxy is forbidden in $APP_ENV" >&2
  exit 64
fi

umask 027
common_vars='${NGINX_RATE_LIMIT_API} ${NGINX_RATE_LIMIT_AUTH} ${NGINX_RATE_LIMIT_PUBLIC} ${NGINX_RATE_LIMIT_POLLING} ${NGINX_RATE_LIMIT_DOWNLOADS} ${NGINX_RATE_LIMIT_BITRIX} ${NGINX_RATE_LIMIT_SMS_CALLBACK} ${NGINX_RATE_LIMIT_WS} ${NGINX_CLIENT_MAX_BODY_SIZE} ${EXPO_DEV_SERVER_HOSTPORT}'
site_vars='${PUBLIC_HOST} ${NGINX_TLS_CERTIFICATE} ${NGINX_TLS_CERTIFICATE_KEY} ${NGINX_MESSAGE_READ_TIMEOUT_SEC} ${BITRIX_FRAME_ANCESTORS}'
security_vars='${NGINX_HSTS_MAX_AGE} ${S3_CONNECT_SRC}'

envsubst "$common_vars" < /etc/nginx/templates-src/nginx.conf.template > /tmp/nginx.conf
envsubst "$security_vars" < /etc/nginx/templates-src/sites/security-headers.conf.template \
  > /etc/nginx/generated/security-headers.conf

if [ "${FRONTEND_DEV_PROXY_ENABLED:-false}" = "true" ]; then
  cp /etc/nginx/templates-src/sites/frontend-dev.conf.template /etc/nginx/generated/frontend-location.conf
else
  cp /etc/nginx/templates-src/sites/frontend-static.conf.template /etc/nginx/generated/frontend-location.conf
fi

if [ "${NGINX_TLS_ENABLED:-true}" = "true" ]; then
  for certificate in "${NGINX_TLS_CERTIFICATE:-}" "${NGINX_TLS_CERTIFICATE_KEY:-}"; do
    if [ ! -r "$certificate" ]; then
      echo "nginx bootstrap: TLS file is not readable: $certificate" >&2
      exit 78
    fi
  done
  envsubst "$site_vars" < /etc/nginx/templates-src/sites/site-tls.conf.template \
    > /etc/nginx/generated/site.conf
else
  envsubst '${PUBLIC_HOST}' < /etc/nginx/templates-src/sites/site-bootstrap.conf.template \
    > /etc/nginx/generated/site.conf
fi

nginx -t -c /tmp/nginx.conf
exec nginx -c /tmp/nginx.conf -g 'daemon off;'