#!/bin/sh
set -eu

umask 077
root_dir=/root/.xtao-secret-agent
shared_dir=/volume1/xtao-data/secret-agent
backup_dir=/volume2/xtao-backup/secret-agent/kdbx
cred_tmp="$root_dir/master.key.$$"

[ "$(id -u)" = "0" ] || { echo "FAIL must_run_as_root"; exit 1; }

mkdir -p "$root_dir" "$root_dir/locks" "$root_dir/db" "$shared_dir/bin" "$shared_dir/runtime" "$shared_dir/logs" "$backup_dir"
chmod 700 "$root_dir" "$root_dir/locks" "$root_dir/db" "$shared_dir" "$shared_dir/bin" "$shared_dir/runtime" "$shared_dir/logs" "$backup_dir"

cat > "$cred_tmp"
chmod 600 "$cred_tmp"
if [ ! -s "$cred_tmp" ]; then
  rm -f "$cred_tmp"
  echo "FAIL empty_unlock_input"
  exit 2
fi
mv "$cred_tmp" "$root_dir/master.key"
chown root:root "$root_dir/master.key"
chmod 600 "$root_dir/master.key"

cat > "$root_dir/config.env" <<'EOF'
XTAO_SECRET_AGENT_DB=/root/.xtao-secret-agent/db/xtao-automation.kdbx
XTAO_SECRET_AGENT_PY_IMAGE=python@sha256:cab2dbf575e971934a81e4622f5aba17aa7929719bd7e31033a3a83b97fd0464
XTAO_SECRET_AGENT_SHARED=/volume1/xtao-data/secret-agent
XTAO_SECRET_AGENT_BACKUP=/volume2/xtao-backup/secret-agent/kdbx
EOF
chown root:root "$root_dir/config.env"
chmod 600 "$root_dir/config.env"

echo "PASS root_unlock_installed path=/root/.xtao-secret-agent/master.key mode=0600"