#!/bin/sh
# This file is part of KyCH.
# Copyright (C) 2026 Taler Systems SA
#
# KyCH is free software; you can redistribute it and/or modify it under the
# terms of the GNU Affero General Public License as published by the Free
# Software Foundation; either version 3, or (at your option) any later version.
#
# KyCH is distributed in the hope that it will be useful, but WITHOUT ANY
# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
# A PARTICULAR PURPOSE.  See the GNU Affero General Public License for more
# details.
#
# You should have received a copy of the GNU Affero General Public License
# along with KyCH; see the file COPYING.  If not, see
# <http://www.gnu.org/licenses/>
#
#
# Start the SWIYU Generic Verifier.  This is what swiyu-verifier.service runs;
# it exists because three things have to be decided before the JVM starts and
# a systemd unit cannot decide them:
#
#  * which Java to use -- the jar is built for Java 25, so the system default
#    "java" is not necessarily the right one;
#  * whether the private truststore built by the package's postinst exists,
#    which it does not on a system without keytool;
#  * the configuration files to add, which are under /etc and not in the jar.
#
# Arguments are passed on to the application, so Spring Boot's
# --property=value form works:
#
#     swiyu-verifier --server.port=8081
#
set -eu

JAR=/usr/share/swiyu-verifier/swiyu-verifier.jar
CONFIG=/etc/swiyu-verifier/application.yml
TRUSTSTORE=/var/lib/swiyu-verifier/cacerts

if [ ! -r "$JAR" ]; then
  echo "$JAR is missing; reinstall the swiyu-verifier package" 1>&2
  exit 1
fi

# JAVA_HOME from the environment file wins, so that an administrator can point
# this at another runtime; otherwise prefer the Java the jar was built for and
# fall back to whatever is the system default.
if [ -n "${JAVA_HOME:-}" ] && [ -x "${JAVA_HOME}/bin/java" ]; then
  JAVA="${JAVA_HOME}/bin/java"
else
  JAVA=
  for home in /usr/lib/jvm/java-25-openjdk-*; do
    if [ -x "${home}/bin/java" ]; then
      JAVA="${home}/bin/java"
      break
    fi
  done
  if [ -z "$JAVA" ]; then
    JAVA=$(command -v java || true)
    if [ -z "$JAVA" ]; then
      echo "No Java runtime found; install openjdk-25-jre-headless" 1>&2
      exit 1
    fi
  fi
fi

# Options for the JVM itself.  Word splitting below is intentional and safe:
# every value here is a fixed, space-free path or literal.  Note that Spring
# Boot reads spring.* from system properties as well as from the command line,
# which is what lets the configuration be passed as -D and keeps "$@" free for
# the caller's own arguments.
#
# The verifier timestamps its authorization requests in Swiss local time, as
# the upstream container image does.
JVM_OPTS="-Duser.timezone=Europe/Zurich -Dfile.encoding=UTF-8"

if [ -r "$CONFIG" ]; then
  JVM_OPTS="${JVM_OPTS} -Dspring.config.additional-location=file:${CONFIG}"
fi

# The Swiss Government Root CA VI is not in the public trust store that the
# JVM uses by default.  The postinst imports it into a truststore of this
# service's own; it is used only if that worked, so that a missing keytool
# leaves the service running with the default store rather than not running.
if [ -r "$TRUSTSTORE" ]; then
  JVM_OPTS="${JVM_OPTS} -Djavax.net.ssl.trustStore=${TRUSTSTORE}"
  JVM_OPTS="${JVM_OPTS} -Djavax.net.ssl.trustStorePassword=changeit"
fi

# shellcheck disable=SC2086 # see the note on word splitting above
exec "$JAVA" ${JVM_OPTS} -jar "$JAR" "$@"
