#!/bin/sh
# Builds a SFTPGo "loaddata" JSON (the format the dumpdata/loaddata REST
# API uses) with exactly one user, then starts sftpgo with
# --loaddata-from that file. Runs on every container start — mode 0
# (the default) adds new objects and updates existing ones, so re-running
# this is safe and picks up a changed SFTP_PASSWORD on restart.
#
# The user's home_dir is /srv/sftpgo/data/inbox, which — via the
# ./data:/srv/sftpgo/data bind mount in compose.yml — is the same
# directory as the worker's DATA_DIR/inbox. Whatever lands here over SFTP
# is exactly what the worker watches.
#
# Uses `jq` to build the JSON so SFTP_USER/SFTP_PASSWORD are always
# correctly escaped (arbitrary passwords, including quotes/backslashes,
# are safe). jq ships in the official drakkan/sftpgo image; if a future
# image drops it, this script needs an alternative (e.g. python/perl,
# both otherwise present at the time of writing).
set -eu

OUTPUT="/var/lib/sftpgo/loaddata.json"

: "${SFTP_USER:?SFTP_USER must be set}"
: "${SFTP_PASSWORD:?SFTP_PASSWORD must be set}"

jq -n \
  --arg user "$SFTP_USER" \
  --arg pass "$SFTP_PASSWORD" \
  '{
    users: [
      {
        status: 1,
        username: $user,
        password: $pass,
        home_dir: "/srv/sftpgo/data/inbox",
        permissions: {
          "/": ["list", "download", "upload", "overwrite", "create_dirs"]
        },
        filesystem: { provider: 0 }
      }
    ],
    version: 15
  }' > "$OUTPUT"

exec sftpgo serve --loaddata-from "$OUTPUT"