#!/bin/bash
set -e

# Ensure data and backup directories exist
DATA_PATH="${DATA_DIR:-/data}"
BACKUP_PATH="${BACKUP_DIR:-/backups}"

mkdir -p "$DATA_PATH" "$BACKUP_PATH"

# Set secure permissions on SSH private key if it exists
if [ -f "$DATA_PATH/id_ed25519" ]; then
    chmod 600 "$DATA_PATH/id_ed25519" 2>/dev/null || true
fi

# Optional PUID / PGID support (standard for Unraid / Linuxserver containers)
PUID=${PUID:-0}
PGID=${PGID:-0}

if [ "$PUID" -ne 0 ] && [ "$PGID" -ne 0 ]; then
    # Create or update group
    if ! getent group pangolin >/dev/null 2>&1; then
        groupadd -g "$PGID" pangolin 2>/dev/null || true
    fi

    # Create or update user
    if ! getent passwd pangolin >/dev/null 2>&1; then
        useradd -u "$PUID" -g "$PGID" -d /app -s /bin/bash pangolin 2>/dev/null || true
    fi

    # Ensure ownership of persistent data and backup volumes
    chown -R "$PUID:$PGID" "$DATA_PATH" "$BACKUP_PATH" 2>/dev/null || true

    if [ -f "$DATA_PATH/id_ed25519" ]; then
        chmod 600 "$DATA_PATH/id_ed25519" 2>/dev/null || true
    fi

    exec gosu "$PUID:$PGID" "$@"
else
    exec "$@"
fi