#!/usr/bin/env bash
set -euo pipefail

# runit's run script for smallwebwaf, run again whenever smallwebwaf
# exits; the wait spaces out the restarts. The state directory and every
# file in it are given to the smallwebwaf user, so that a volume mounted
# there needs no change of owner; chown -R changes a symbolic link itself,
# never what it points to. When SWWAF_STATE_DIR, in either form, cannot be
# read or is not the absolute path of a directory, no owner is changed,
# and smallwebwaf starts and stops with a message naming the setting. A
# change of owner that fails, as on a volume mounted read-only, does not
# end the script either: smallwebwaf reports a directory it cannot write.
# exec, so that the signal `sv stop` sends reaches smallwebwaf itself.
main() {
    sleep 1
    local dir
    if dir="$(state_dir)" && [[ "$dir" == /* && -d "$dir" ]]; then
        chown -R smallwebwaf:smallwebwaf "$dir" || true
    fi
    exec chpst -u smallwebwaf:smallwebwaf /usr/local/bin/smallwebwaf
}

# state_dir prints SWWAF_STATE_DIR, /var/lib/smallwebwaf when it is unset,
# or what is in the file SWWAF_STATE_DIR_FILE names, less every newline at
# its end. It fails when both are set or the file cannot be read.
state_dir() {
    if [[ ! -v SWWAF_STATE_DIR_FILE ]]; then
        printf '%s\n' "${SWWAF_STATE_DIR-/var/lib/smallwebwaf}"
    elif [[ ! -v SWWAF_STATE_DIR ]]; then
        cat -- "$SWWAF_STATE_DIR_FILE" 2>/dev/null
    else
        return 1
    fi
}

main "$@"