#!/bin/sh
set -e

mkdir -p /opt/spire/data/server

if [ ! -f /opt/spire/server.conf ]; then
  echo "Writing default SPIRE server.conf..."
  cp /etc/spire/templates/server.conf /opt/spire/server.conf
  chmod 644 /opt/spire/server.conf
fi

# Launch SPIRE Server in background to allow auto-bootstrap token generation
/usr/local/bin/spire-server "$@" &
SERVER_PID=$!

# Helper: Maintain auto-bootstrap join token until local agent has successfully enrolled
(
  SOCKET="/opt/spire/data/server/api.sock"
  while [ ! -S "$SOCKET" ]; do
    sleep 1
  done

  while [ ! -f /opt/spire/data/agent/svid.key ] && [ ! -f /opt/spire/data/agent/agent_svids.json ]; do
    if [ ! -f /opt/spire/data/bootstrap_token ]; then
      echo "[SPIRE Server] Generating auto-bootstrap join token for local agent..."
      TOKEN_OUTPUT=$(/usr/local/bin/spire-server token generate -spiffeID spiffe://system.local/agent -socketPath "$SOCKET" -ttl 3600 2>/dev/null || true)
      TOKEN=$(echo "$TOKEN_OUTPUT" | grep -i "token:" | awk '{print $2}')
      if [ -n "$TOKEN" ]; then
        echo "$TOKEN" > /opt/spire/data/bootstrap_token
        chmod 600 /opt/spire/data/bootstrap_token
        echo "[SPIRE Server] Auto-bootstrap token ready."
      fi
    fi
    sleep 5
  done

  echo "[SPIRE Server] Agent enrollment verified. Cleaning up bootstrap tokens."
  rm -f /opt/spire/data/bootstrap_token
) &

wait "$SERVER_PID"