#!/bin/sh
set -e

# Mitigation for Risk 2: Stale UNIX Socket on Unclean Shutdown
rm -f /var/run/spire/agent.sock

mkdir -p /opt/spire/data/agent
mkdir -p /var/run/spire

CONF_FILE="/opt/spire/agent.conf"

if [ ! -f "$CONF_FILE" ]; then
  echo "Writing default SPIRE agent.conf..."
  cp /etc/spire/templates/agent.conf "$CONF_FILE"
  chmod 644 "$CONF_FILE"
fi

# Check if this agent is enrolling for the first time
if [ ! -f /opt/spire/data/agent/svid.key ] && [ ! -f /opt/spire/data/agent/agent_svids.json ]; then
  echo "[SPIRE Agent] Initial enrollment detected. Waiting for bootstrap join token..."
  for i in $(seq 1 30); do
    if [ -f /opt/spire/data/bootstrap_token ]; then
      break
    fi
    sleep 1
  done

  if [ -f /opt/spire/data/bootstrap_token ]; then
    JOIN_TOKEN=$(cat /opt/spire/data/bootstrap_token | tr -d ' \r\n')
    echo "[SPIRE Agent] Joining SPIRE cluster with token..."
    rm -f /opt/spire/data/bootstrap_token
    exec /usr/local/bin/spire-agent "$@" -join_token "$JOIN_TOKEN"
  else
    echo "[SPIRE Agent] Warning: No bootstrap_token found after 30s. Attempting standard startup..."
  fi
fi

exec /usr/local/bin/spire-agent "$@"