#!/bin/sh
# coturn entrypoint: stage the TLS certificate for the unprivileged user.
#
# Let's Encrypt keeps privkey.pem as root:root 0600, but coturn drops to
# nobody, so it cannot read the key from the mounted store and silently
# starts without TLS listeners (no turns: on 5349). Rather than loosening
# permissions on the shared Let's Encrypt tree -- which would expose the key
# to every other container and user on the host -- copy it to a private
# directory owned by the runtime user.
#
# This mirrors what the Prosody entrypoint does. Because the copy happens at
# start, a certificate renewal needs a container restart to be picked up;
# that is handled by the certbot deploy hook.
set -e

SRC="/etc/letsencrypt/live/guschin.info"
DST="/var/lib/coturn/certs"
RUN_AS_UID="${COTURN_UID:-65534}"
RUN_AS_GID="${COTURN_GID:-65533}"

if [ -r "$SRC/fullchain.pem" ] && [ -r "$SRC/privkey.pem" ]; then
    mkdir -p "$DST"
    # -L to dereference the live/ symlinks into archive/.
    cp -L "$SRC/fullchain.pem" "$DST/fullchain.pem"
    cp -L "$SRC/privkey.pem" "$DST/privkey.pem"
    chown "$RUN_AS_UID:$RUN_AS_GID" "$DST/fullchain.pem" "$DST/privkey.pem"
    chmod 644 "$DST/fullchain.pem"
    chmod 600 "$DST/privkey.pem"
    chown "$RUN_AS_UID:$RUN_AS_GID" "$DST"
    echo "coturn: staged TLS certificate for uid $RUN_AS_UID"
else
    # Not fatal: coturn still serves STUN and plain TURN on 3478. Make the
    # degraded state loud rather than letting it hide in the noise.
    echo "coturn: WARNING - cannot read $SRC; turns:// on 5349 will be DISABLED" >&2
fi

exec "$@"