#!/bin/sh
# monky-deployd: (re)grant the agent read access to the host's ziti identity file(s).
# Idempotent; safe to run at any time. Invoked by install.sh, the package postinstall and the
# monky-deployd-identity-acl.path unit (whenever the identity directory changes).
#
# Why a re-runnable script and not a one-time ACL: ziti-edge-tunnel re-creates the identity on
# every controller config update with mode 0600. On a file with an ACL that sets the mask to ---,
# so the named-user entry AND the ziti-group read both become ineffective. Only re-applying the
# entries after each rewrite keeps the agent alive.
set -eu
DIR="${1:-/opt/openziti/etc/identities}"
[ -d "$DIR" ] || exit 0
command -v setfacl >/dev/null 2>&1 || exit 0
setfacl -m u:monky-deployd:rx,m::rx "$DIR" 2>/dev/null || true
setfacl -d -m u:monky-deployd:r,m::r "$DIR" 2>/dev/null || true
for f in "$DIR"/*.json; do
  [ -f "$f" ] || continue
  setfacl -m u:monky-deployd:r,m::r "$f" 2>/dev/null || true
done
exit 0