#!/usr/bin/env bash
# Rendered by terraform-aws-seaweedfs. Pulls certs + secret config from SSM
# Parameter Store (SecureString) at boot using the instance role. Region is
# auto-resolved by the AWS CLI from IMDS, so no region is baked in. Requires
# the AWS CLI and a working instance profile (see security.tf).
set -euo pipefail

run_as_user="${run_as_user}"

fetch() {
  local param="$1" dest="$2" mode="$3"
  mkdir -p "$(dirname "$dest")"
  aws ssm get-parameter --with-decryption --name "$param" \
    --query 'Parameter.Value' --output text > "$dest"
  chmod "$mode" "$dest"
  chown "$run_as_user:$run_as_user" "$dest" 2>/dev/null || true
}

%{ for e in entries ~}
fetch "${e.param}" "${e.path}" "${e.mode}"
%{ endfor ~}