#!/bin/bash

set -euo pipefail

getent passwd pocketid >/dev/null || \
sudo useradd \
  --system \
  --home /var/lib/pocket-id \
  --shell /usr/sbin/nologin \
  pocketid

sudo install --directory \
	--owner=pocketid \
	--group=pocketid \
	--mode=0750 \
	/etc/pocket-id

sudo install --directory \
	--owner=pocketid \
	--group=pocketid \
	--mode=0750 \
	/var/lib/pocket-id

KEY=/etc/pocket-id/encryption_key
ENV=/etc/pocket-id/env

sudo install --owner=pocketid \
	--group=pocketid \
	--mode=0600 \
	/dev/null \
	"${KEY}"
openssl rand -base64 32 | sudo tee "${KEY}"

sudo install --owner=pocketid \
	--group=pocketid \
	--mode=0600 \
	/dev/null \
	"${ENV}"
sudo tee "${ENV}" << 'EOF'
APP_URL=https://id.trustme.click
UNIX_SOCKET=/run/pocket-id/pocket-id.sock
ENCRYPTION_KEY_FILE=/etc/pocket-id/encryption_key
TRUST_PROXY=true
EOF
