#!/bin/bash
set -e

# Generate or load secure Icecast password
if [ -n "$ICECAST_PASSWORD" ] && [ "$ICECAST_PASSWORD" != "hackme" ]; then
    echo "Using user-provided Icecast password."
    echo "$ICECAST_PASSWORD" > /data/.icecast_password
elif [ ! -f /data/.icecast_password ]; then
    echo "Generating secure Icecast password..."
    # Generate a 24-character random alphanumeric password
    cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 24 | head -n 1 > /data/.icecast_password
fi

export ICECAST_PASSWORD=$(cat /data/.icecast_password)

# Inject password into icecast.xml
sed -i "s/<source-password>.*<\/source-password>/<source-password>${ICECAST_PASSWORD}<\/source-password>/g" /etc/icecast2/icecast.xml
sed -i "s/<relay-password>.*<\/relay-password>/<relay-password>${ICECAST_PASSWORD}<\/relay-password>/g" /etc/icecast2/icecast.xml
sed -i "s/<admin-password>.*<\/admin-password>/<admin-password>${ICECAST_PASSWORD}<\/admin-password>/g" /etc/icecast2/icecast.xml

# Generate or load symmetric encryption key for DB credentials
if [ -n "$ENCRYPTION_KEY" ]; then
    echo "Using user-provided Encryption Key."
    echo "$ENCRYPTION_KEY" > /data/.encryption_key
elif [ ! -f /data/.encryption_key ]; then
    echo "Generating secure Encryption Key..."
    # Generate a Fernet-compatible URL-safe base64 encoded 32-byte key
    python3 -c "import base64; import os; print(base64.urlsafe_b64encode(os.urandom(32)).decode('utf-8'))" > /data/.encryption_key
fi

export ENCRYPTION_KEY=$(cat /data/.encryption_key)

# Fix permissions on /data volume so the liquidsoap user can read/write the SQLite database
chown -R liquidsoap:liquidsoap /data

# Execute the main process (supervisord)
exec /usr/bin/supervisord -c /etc/supervisor/conf.d/supervisord.conf