#!/bin/sh
set -eu

canonical_host="${NCV_DCIMS_PUBLIC_HOST:-}"
allowed_hosts="${NCV_DCIMS_ALLOWED_HOSTS:-$canonical_host}"
cloudflared_trusted_ip="${NCV_DCIMS_CLOUDFLARED_TRUSTED_IP:-}"

validate_host() {
  host="$1"
  case "$host" in
    ""|"-"|*[!A-Za-z0-9.-]*|.*|*.|*..*)
      echo "NCV_DCIMS_ALLOWED_HOSTS contains an invalid hostname or IPv4 address" >&2
      exit 1
      ;;
  esac
}
validate_ipv4() {
  value="$1"
  case "$value" in
    ""|*[!0-9.]*|.*|*.|*..*)
      echo "NCV_DCIMS_CLOUDFLARED_TRUSTED_IP must be one exact IPv4 address" >&2
      exit 1
      ;;
  esac
  saved_ifs="$IFS"
  IFS='.'
  set -- $value
  IFS="$saved_ifs"
  [ "$#" -eq 4 ] || {
    echo "NCV_DCIMS_CLOUDFLARED_TRUSTED_IP must be one exact IPv4 address" >&2
    exit 1
  }
  for octet in "$@"; do
    [ "$octet" -le 255 ] || {
      echo "NCV_DCIMS_CLOUDFLARED_TRUSTED_IP contains an invalid octet" >&2
      exit 1
    }
  done
}

validate_ipv4 "$cloudflared_trusted_ip"
validate_host "$canonical_host"

server_names=""
canonical_seen=false
old_ifs="$IFS"
IFS=','
for raw_host in $allowed_hosts; do
  host="$(printf '%s' "$raw_host" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')"
  validate_host "$host"
  case " $server_names " in
    *" $host "*) ;;
    *) server_names="${server_names}${server_names:+ }${host}" ;;
  esac
  if [ "$host" = "$canonical_host" ]; then
    canonical_seen=true
  fi
done
IFS="$old_ifs"

if [ "$canonical_seen" != "true" ]; then
  echo "NCV_DCIMS_ALLOWED_HOSTS must include NCV_DCIMS_PUBLIC_HOST" >&2
  exit 1
fi

export NCV_DCIMS_SERVER_NAMES="$server_names"
export NCV_DCIMS_CLOUDFLARED_TRUSTED_IP="$cloudflared_trusted_ip"
envsubst '${NCV_DCIMS_SERVER_NAMES} ${NCV_DCIMS_CLOUDFLARED_TRUSTED_IP}' < /etc/ncv-dcims/nginx.conf.template > /tmp/nginx.conf
exec nginx -c /tmp/nginx.conf -g 'daemon off;'