#!/bin/sh
# Account-level provisioning. Docker sudo must already be enabled separately.
set -eu
umask 077
root=$1
registry_user=$2
registry=$3
bind=$4
port=$5
docker=/usr/local/bin/docker
test -x "$docker"
sudo -n "$docker" compose version
sudo -n "$docker" info --format '{{.OSType}}/{{.Architecture}}'
test ! -L "$root"
mkdir -p "$root" "$root/docker-auth"
chmod 700 "$root" "$root/docker-auth"
if [ ! -f "$root/production.env" ]; then
    # First provisioning must not take a port already occupied by another service.
    command -v netstat >/dev/null
    if netstat -lnt | awk -v port=":$port" '$4 ~ (port "$") { found=1 } END { exit !found }'; then
        echo 'Frontend port is already occupied; production configuration unchanged' >&2
        exit 1
    fi
    printf 'BIND_IP=%s\nFRONTEND_PORT=%s\nDOCKER_BIN=%s\nDOCKER_SUDO=1\nDOCKER_CONFIG=%s/docker-auth\n' \
        "$bind" "$port" "$docker" "$root" > "$root/production.env"
    chmod 600 "$root/production.env"
else
    # Preserve existing config; refuse to silently rebind a configured deployment.
    . "$root/production.env"
    test "$BIND_IP" = "$bind" && test "$FRONTEND_PORT" = "$port" \
        && test "$DOCKER_CONFIG" = "$root/docker-auth" || {
        echo 'Existing production.env differs; review it before provisioning' >&2
        exit 1
    }
fi
# Credential enters only via stdin. No password, environment or auth config is logged.
sudo -n "$docker" --config "$root/docker-auth" login "$registry" --username "$registry_user" --password-stdin
echo 'Production directory and dedicated registry login prepared; no containers were changed.'