#!/bin/bash -eu

# TurnKey web interface fence - blocks access to web app until system is
# initialized (admin password configure, etc); the firewall and mini server
# functions live in lib/init-fence.sh

DEBUG=${DEBUG:-}
[[ -z "$DEBUG" ]] || set -x

INITHOOKS_PATH=${INITHOOKS_PATH:-/usr/lib/inithooks}
INITFENCE_DEFAULT=${INITFENCE_DEFAULT:-/etc/default/turnkey-init-fence}
PIDFILE=${PIDFILE:-/run/init-fence.pid}
LOGFILE=${LOGFILE:-/var/log/init-fence.log}

# shellcheck source=default/turnkey-init-fence
source "$INITFENCE_DEFAULT"
# shellcheck source=lib/init-fence.sh
source "$INITHOOKS_PATH/lib/init-fence.sh"

HTDOCS=$(fence_htdocs "$HTDOCS" "$INITHOOKS_PATH/turnkey-init-fence/htdocs")

case "$1" in
    start)
        echo "Starting turnkey-init-fence"
        iptables_redirect start
        start_mini_server
        echo "Started turnkey-init-fence"
        ;;
    stop)
        echo "Stopping turnkey-init-fence"
        iptables_redirect stop
        stop_mini_server
        echo "Stopped turnkey-init-fence"
        ;;
    stop-post)
        # SERVICE_RESULT is set by systemd
        if [[ "$SERVICE_RESULT" != "success" ]]; then
            echo "Post-stop cleanup for failed turnkey-init-fence"
            iptables_redirect stop
            echo "Firewall rules removed"
        fi
        ;;
    reload)
        echo "Reloading turnkey-init-fence"
        stop_mini_server
        start_mini_server
        echo "Reloaded turnkey-init-fence"
        ;;
    *)
        echo "Unknown command: $1" >&2
        exit 1
        ;;
esac
