#!/bin/sh
set -e
# service account + dirs
if command -v systemd-sysusers >/dev/null 2>&1; then
  systemd-sysusers /usr/lib/sysusers.d/monky-deployd.conf || true
else
  getent passwd monky-deployd >/dev/null || useradd --system --home-dir /var/lib/monky-deployd --shell /usr/sbin/nologin monky-deployd
fi
if command -v systemd-tmpfiles >/dev/null 2>&1; then
  systemd-tmpfiles --create /usr/lib/tmpfiles.d/monky-deployd.conf || true
fi
install -d -m 0700 -o monky-deployd -g monky-deployd /var/lib/monky-deployd
install -d -m 0750 -o root -g monky-deployd /etc/monky-deployd
# the agent drives docker compose: docker group membership (no root)
if getent group docker >/dev/null; then usermod -a -G docker monky-deployd || true; fi
# the agent reads the host's ziti identity (owned by the tunneller, mode 0640). ziti-edge-tunnel
# REWRITES that file whenever the controller sends a config update, and the rewrite drops any
# POSIX ACL granting the agent read — group membership is the grant that survives it.
# (env-dev-08, 2026-09-09: the agent went from applied to "no intercept" 6 minutes after a refresh.)
if getent group ziti >/dev/null; then usermod -a -G ziti monky-deployd || true; fi
# ...and group membership does NOT survive it either once the rewrite lands with mode 0600 (the ACL
# mask goes to ---). Re-apply the grant now and on every directory change (0.1.10, deployd#3 beat).
[ -x /usr/share/monky-deployd/identity-acl.sh ] && /usr/share/monky-deployd/identity-acl.sh /opt/openziti/etc/identities || true
# the venv is relocatable only to the path it was built at; refuse a broken interpreter early
/opt/monky-deployd/venv/bin/python -c 'import monky_deployd' || { echo "monky-deployd: venv unusable (python3 mismatch?)" >&2; exit 1; }
if [ -d /run/systemd/system ]; then
  systemctl daemon-reload || true
  # do NOT enable the timer here: install.sh / the ansible role do it after the config exists.
  # An UPGRADE is different — the timer is already enabled and must keep running, so restart the
  # long-lived proxy unit onto the new code. `try-restart` is a no-op when it is not running.
  systemctl try-restart monky-deployd-proxy.service 2>/dev/null || true
  # an UPGRADE of a box that already has its config: arm the identity-ACL watcher
  if [ -s /etc/monky-deployd/config.yaml ]; then systemctl enable --now monky-deployd-identity-acl.path 2>/dev/null || true; fi
fi
exit 0