#!/bin/bash
set -euo pipefail

SYNC_CRON="${SYNC_CRON:-0 */6 * * *}"
GIT_SSH_KEY_PATH="${GIT_SSH_KEY_PATH:-/etc/mirror/git-deploy-key}"

export GNUPGHOME="${GNUPGHOME:-/etc/mirror-gpg}"
GPG_PRIVATE_KEY_FILE="${GPG_PRIVATE_KEY_FILE:-/run/secrets/gpg_private_key}"
GPG_KEY_ID_FILE="${GNUPGHOME}/key-id"

mkdir -p "$GNUPGHOME"
chmod 700 "$GNUPGHOME"

if [ -f "$GPG_PRIVATE_KEY_FILE" ] && [ ! -s "$GPG_KEY_ID_FILE" ]; then
  echo "[entrypoint] Importiere Firmen-GPG-Key"
  gpg --batch --import "$GPG_PRIVATE_KEY_FILE"
  gpg --batch --list-secret-keys --with-colons \
    | awk -F: '/^sec/ {print $5; exit}' > "$GPG_KEY_ID_FILE"
fi

if [ -s "$GPG_KEY_ID_FILE" ]; then
  GPG_KEY_ID="$(cat "$GPG_KEY_ID_FILE")"
  export GPG_KEY_ID

  mkdir -p /data/repo
  gpg --batch --export --armor "$GPG_KEY_ID" > /data/repo/RPM-GPG-KEY-firma

  {
    echo "%_gpg_name  ${GPG_KEY_ID}"
    echo "%_gpg_path  ${GNUPGHOME}"
  } > /root/.rpmmacros
else
  echo "[entrypoint] WARNUNG: kein GPG-Key gefunden, Pakete werden NICHT signiert."
fi

{
  echo "CONFIG_REPO_URL=${CONFIG_REPO_URL:-}"
  echo "CONFIG_REPO_BRANCH=${CONFIG_REPO_BRANCH:-main}"
  echo "GIT_SSH_KEY_PATH=${GIT_SSH_KEY_PATH}"
  echo "GNUPGHOME=${GNUPGHOME}"
  echo "GPG_KEY_ID=${GPG_KEY_ID:-}"
  echo "${SYNC_CRON} root /usr/local/bin/sync.sh >> /var/log/sync.log 2>&1"
} > /etc/cron.d/repo-sync
chmod 0644 /etc/cron.d/repo-sync

touch /var/log/sync.log
crond

/usr/local/bin/sync.sh || echo "[entrypoint] Initialer Sync fehlgeschlagen, Nginx startet trotzdem."

exec nginx -g 'daemon off;'