#!/bin/bash
set -euo pipefail
stage="$(cd "$(dirname "$0")" && pwd)"
test ! -e /mnt/data/qsafe/qa/vault.sqlite3 || { echo 'QA vault already exists'; exit 1; }
install -d -o qsafe -g qsafe -m 700 /mnt/data/qsafe/qa
install -o root -g qsafe -m 640 "$stage/qa-token.sha256" /etc/qsafe/qa-token.sha256
systemd-run --unit=qsafe-qa --property=User=qsafe --property=Group=qsafe --property=UMask=0077 \
    /usr/bin/python3 /opt/qsafe/server.py --port 18793 --data /mnt/data/qsafe/qa --token-hash-file /etc/qsafe/qa-token.sha256
python3 - <<'PY'
from pathlib import Path
p = Path('/etc/caddy/sites/qsafe-lan.caddy')
t = p.read_text()
if '# BEGIN QSafe QA' in t:
    raise SystemExit('QA route already present')
needle = '    handle_path /qsafe/* {\n'
block = '''\t# BEGIN QSafe QA
\thandle_path /qsafe-qa/* {
\t\treverse_proxy 127.0.0.1:18793
\t}
\t# END QSafe QA
'''
assert t.count(needle) == 1, 'LAN-only QSafe site must be installed first'
p.write_text(t.replace(needle, block + needle, 1))
PY
caddy validate --config /etc/caddy/Caddyfile --adapter caddyfile >/dev/null
systemctl reload caddy