#!/bin/sh
# Start Warp the way Complement needs it.
#
# There is no configuration file: every setting Warp has can come from a
# WARP_* environment variable, so the whole deployment is the few lines
# below. Complement may run this entrypoint more than once against the same
# container, so everything here is idempotent.
set -eu

DATA_DIR="${WARP_DATA_DIR:-/data}"
mkdir -p "$DATA_DIR"

# Complement names the homeservers hs1, hs2, ... and passes the name in.
export WARP_SERVER_NAME="${SERVER_NAME:-hs1}"

export WARP_PRIVATE_KEY="$DATA_DIR/signing.key"
export WARP_DB_DRIVER=sqlite
export WARP_DB_CONNECTION_STRING="file:$DATA_DIR/warp.db?_pragma=journal_mode(WAL)&_pragma=busy_timeout(10000)&_pragma=foreign_keys(1)"
export WARP_DB_AUTO_MIGRATE=true
export WARP_MEDIA_BASE_PATH="$DATA_DIR/media"

export WARP_LISTEN_ADDRESS=":8008"

# The suite registers and logs in constantly, all from the one address the
# test runner has. Rate limiting would turn that into a wall of
# M_LIMIT_EXCEEDED and tell us nothing about the server. Synapse's own
# Complement image does the same.
export WARP_RATE_LIMIT_ENABLED=false

# Open registration: the tests create their own users.
export WARP_REGISTRATION_ENABLED=true

# Federation stays off unless the profile asks for it: run.sh passes
# WARP_FEDERATION_ENABLED=true into the container for the federation
# profile.
export WARP_FEDERATION_ENABLED="${WARP_FEDERATION_ENABLED:-false}"

# Federation over TLS on 8448. Complement mounts a CA at /complement/ca and
# expects every homeserver of a run to present a certificate it signed;
# the same CA is what Warp trusts when it connects to the others, and to
# the servers Complement itself pretends to be.
CA_DIR=/complement/ca
if [ -f "$CA_DIR/ca.crt" ] && [ -f "$CA_DIR/ca.key" ]; then
	if [ ! -f "$DATA_DIR/tls.crt" ]; then
		openssl genrsa -out "$DATA_DIR/tls.key" 2048 2>/dev/null
		openssl req -new -sha256 -key "$DATA_DIR/tls.key" \
			-subj "/CN=$WARP_SERVER_NAME" -out "$DATA_DIR/tls.csr"
		printf 'subjectAltName=DNS:%s\n' "$WARP_SERVER_NAME" > "$DATA_DIR/san.ext"
		# The serial file goes in the data directory: the CA mount may be
		# read-only.
		openssl x509 -req -in "$DATA_DIR/tls.csr" \
			-CA "$CA_DIR/ca.crt" -CAkey "$CA_DIR/ca.key" \
			-CAserial "$DATA_DIR/ca.srl" -CAcreateserial \
			-out "$DATA_DIR/tls.crt" -days 1 -sha256 -extfile "$DATA_DIR/san.ext" 2>/dev/null
	fi
	export WARP_LISTEN_FEDERATION_ADDRESS=":8448"
	export WARP_TLS_CERT_FILE="$DATA_DIR/tls.crt"
	export WARP_TLS_KEY_FILE="$DATA_DIR/tls.key"
	export WARP_FEDERATION_TLS_CA_FILE="$CA_DIR/ca.crt"
fi

# Complement captures the container's output, so text at debug level is the
# most useful thing to have when a test fails.
export WARP_LOG_LEVEL="${WARP_LOG_LEVEL:-debug}"
export WARP_LOG_FORMAT="${WARP_LOG_FORMAT:-text}"

if [ ! -f "$WARP_PRIVATE_KEY" ]; then
	warp generate-keys --output "$WARP_PRIVATE_KEY"
fi

# Migrations also run on boot, but doing them here keeps a schema failure
# out of the request path and makes it obvious in the container log.
warp migrate

exec warp serve