#!/bin/sh
# Fix bind-mount ownership, then drop privileges.
#
# Bind-mounted volumes arrive owned by whatever the host says — on Unraid
# that is typically nobody:users (99:100), and on a plain `docker run -v`
# it is usually root:root. The service runs as uid 10001 and could not
# otherwise write the vault, so when we start as root we chown the data
# directory first and only then hand off.
#
# When the container is already running as non-root (some platforms assign
# their own uid), we skip the chown and exec directly — there is nothing
# useful we could do about permissions from there anyway.
set -e

OPENMFA_UID=${OPENMFA_UID:-10001}
OPENMFA_GID=${OPENMFA_GID:-10001}
DATA_DIR=${OPENMFA_WORK_DIR:-/var/lib/openmfa}

if [ "$(id -u)" = "0" ]; then
    mkdir -p "$DATA_DIR"
    chown -R "${OPENMFA_UID}:${OPENMFA_GID}" "$DATA_DIR" 2>/dev/null || true
    # The vault key is the one file that must never be group- or
    # world-readable; a permissive umask on the host can otherwise leave it
    # readable to anyone who can browse the appdata share.
    if [ -f "$DATA_DIR/vault.key" ]; then
        chmod 600 "$DATA_DIR/vault.key" 2>/dev/null || true
    fi
    exec su-exec "${OPENMFA_UID}:${OPENMFA_GID}" /usr/local/bin/openmfa "$@"
fi

exec /usr/local/bin/openmfa "$@"