#!/usr/bin/env bash

set -Eeuo pipefail
umask 077

DRY_RUN=0
[[ $# -le 1 ]] || { echo 'usage: provision-emqx-cookie.sh [--dry-run]' >&2; exit 2; }
[[ -z "${1:-}" || "${1:-}" == "--dry-run" ]] || { echo "unknown argument: ${1:-}" >&2; exit 2; }
[[ "${1:-}" == "--dry-run" ]] && DRY_RUN=1

secret_dir=/etc/zhct/secrets
cookie="$secret_dir/emqx.cluster-cookie"
if [[ -s "$cookie" ]]; then
    printf 'UNCHANGED: %s\n' "$cookie"
    exit 0
fi
printf '%s: %s\n' "$([[ $DRY_RUN == 1 ]] && echo DRY-RUN || echo CREATE)" "$cookie"
[[ "$DRY_RUN" == 1 ]] && exit 0

[[ $(id -u) -eq 0 ]] || { echo 'root is required' >&2; exit 1; }
command -v openssl >/dev/null 2>&1 || { echo 'openssl is required' >&2; exit 1; }
[[ ! -e "$cookie" ]] || { echo "refuse to replace empty existing cookie: $cookie" >&2; exit 1; }
install -d -m 0700 -o root -g root "$secret_dir"
temp=$(mktemp "$secret_dir/.emqx-cookie.XXXXXX")
openssl rand -hex 32 >"$temp"
install -m 0600 -o root -g root "$temp" "$cookie"
rm -f "$temp"
echo 'PASS: EMQX cluster cookie file is present with root-only permissions'