#!/bin/sh
set -eu

SOCKET="${SOZU_SOCKET:-/var/run/sozu/sozu.sock}"
TLS_DIR="${TLS_DIR:-/etc/sozu/tls}"
SOZU_ROUTES="${SOZU_ROUTES:-}"

reload_all_certs() {
    echo "[sozuctl-sidecar] cert change detected, reloading"
    for host in $(echo "$SOZU_ROUTES" | tr ',' ' '); do
        cert="$TLS_DIR/$host/tls.crt"
        key="$TLS_DIR/$host/tls.key"
        [ -f "$cert" ] && [ -f "$key" ] || continue
        sozuctl --socket "$SOCKET" certificate replace \
            --certificate "$cert" \
            --key "$key" \
            --hostname "$host" 2>&1 || \
            echo "[sozuctl-sidecar] WARN: replace failed for $host"
    done
}

wait_for_socket() {
    local retries=30
    while [ ! -S "$SOCKET" ] && [ $retries -gt 0 ]; do
        sleep 1
        retries=$((retries - 1))
    done
    [ -S "$SOCKET" ] || { echo "[sozuctl-sidecar] ERROR: socket $SOCKET not found after 30s" >&2; exit 1; }
}

wait_for_socket
reload_all_certs

inotifywait -m -r -e close_write,moved_to --format '%w%f' "$TLS_DIR" | while read -r changed_file; do
    case "$changed_file" in
        *.crt|*.key)
            reload_all_certs
            ;;
    esac
done