#!/bin/bash
set -euo pipefail

# Rathole runs in SERVER mode on Cloudron: the box has the public IP and
# rathole clients behind NAT dial in on the control port (container port
# 2333, bridged 1:1 by default). Tunneled services bind container ports
# 5200-5299, which Cloudron exposes in sequence from the SERVICE_PORT
# value chosen at install time.
#
# Rathole has no HTTP interface of its own, so a tiny static status page
# is served on the Cloudron HTTP port. That gives the platform a health
# check endpoint and gives the admin an auth-proxied landing page
# (httpAuth.type = proxy gates it at the platform edge).

export RATHOLE_CONFIG="/app/data/server.toml"

if [[ ! -f "${RATHOLE_CONFIG}" ]]; then
  default_token="$(openssl rand -hex 24)"
  cat > "${RATHOLE_CONFIG}" <<EOF
# rathole server configuration — hot-reloaded on save, no restart needed.
# Full reference: https://github.com/rathole-org/rathole#configuration

[server]
bind_addr = "0.0.0.0:2333"
default_token = "${default_token}"
heartbeat_interval = 30

[server.transport]
type = "tcp"

[server.transport.tcp]
nodelay = true

# At least one service block must exist — rathole rejects a server config
# with no services. This placeholder listens on the first tunnel port and
# forwards whatever the matching client sends. Rename it or add more
# blocks; each bind_addr must use a distinct port from the reserved range
# (5200-5299 with default install settings). Hot-reloads on save.
[server.services.example]
token = "${default_token}"
bind_addr = "0.0.0.0:5200"

#[server.services.my_web_app]
#token = "another_secret"
#bind_addr = "0.0.0.0:5201"
EOF
  echo "Seeded default config at ${RATHOLE_CONFIG} (random default_token generated)"
fi

# Status page (health check + auth-proxied landing page) in the background;
# rathole stays in the foreground as PID-friendly main process.
python3 -m http.server "${CLOUDRON_HTTP_PORT:-8000}" --directory /app/code/status &

exec /usr/local/bin/rathole --server "${RATHOLE_CONFIG}"