#!/bin/sh
set -eu

for item in \
  REDIS_API_PASSWORD:redis_api_password \
  REDIS_SAFETY_PASSWORD:redis_safety_password \
  REDIS_HEALTH_PASSWORD:redis_health_password
do
  name=${item%%:*}
  file=/run/secrets/${item#*:}
  if [ ! -r "$file" ]; then
    echo "redis bootstrap: missing secret file for $name" >&2
    exit 66
  fi
  value=$(cat "$file")
  if [ "${#value}" -lt 16 ] || printf '%s' "$value" | grep -Eq '[[:space:]]'; then
    echo "redis bootstrap: $name must be at least 16 characters without whitespace" >&2
    exit 64
  fi
  export "$name=$value"
done

umask 077
envsubst '${REDIS_API_PASSWORD} ${REDIS_SAFETY_PASSWORD} ${REDIS_HEALTH_PASSWORD}' \
  < /etc/han-redis/users.acl.template > /tmp/users.acl
unset REDIS_API_PASSWORD REDIS_SAFETY_PASSWORD REDIS_HEALTH_PASSWORD

exec redis-server /etc/han-redis/redis.conf \
  --aclfile /tmp/users.acl \
  --maxmemory "${REDIS_MAXMEMORY:-384mb}" \
  --maxmemory-policy "${REDIS_EVICTION_POLICY:-volatile-lru}"