#!/bin/sh
set -e

# Default environment variables
DB_HOST="${DB_HOST:-postgres}"
DB_PORT="${DB_PORT:-5432}"
DB_USER="${DB_USER:-radius}"
DB_PASS="${DB_PASS:-radpass}"
DB_NAME="${DB_NAME:-radius}"
RADIUS_SECRET="${RADIUS_SECRET:-radpass}"

echo "================================================="
echo " Starting RADIUS Controller & FreeRADIUS Stack"
echo " DB Host: $DB_HOST:$DB_PORT | Database: $DB_NAME"
echo " RADIUS Secret: $RADIUS_SECRET (Allows all IP addresses)"
echo "================================================="

# Dynamically update FreeRADIUS SQL configuration with DB settings
SQL_CONF="/etc/freeradius/3.0/mods-enabled/sql"
if [ -f "$SQL_CONF" ]; then
    sed -i "s/server = .*/server = \"$DB_HOST\"/" "$SQL_CONF"
    sed -i "s/port = .*/port = $DB_PORT/" "$SQL_CONF"
    sed -i "s/login = .*/login = \"$DB_USER\"/" "$SQL_CONF"
    sed -i "s/password = .*/password = \"$DB_PASS\"/" "$SQL_CONF"
    sed -i "s/radius_db = .*/radius_db = \"$DB_NAME\"/" "$SQL_CONF"
fi

# Dynamically update RADIUS shared secret for all client networks from env
CLIENTS_CONF="/etc/freeradius/3.0/clients.conf"
if [ -f "$CLIENTS_CONF" ]; then
    sed -i "s/secret = .*/secret = $RADIUS_SECRET/" "$CLIENTS_CONF"
fi

# Generate FreeRADIUS EAP certificates if missing
if [ ! -f /etc/freeradius/3.0/certs/server.pem ]; then
    echo "Generating FreeRADIUS EAP certificates..."
    if [ -f /etc/freeradius/3.0/certs/bootstrap ]; then
        /etc/freeradius/3.0/certs/bootstrap || true
    fi
fi

# Ensure correct permissions for FreeRADIUS config directory
chown -R freerad:freerad /etc/freeradius/3.0/ || true

# Start FreeRADIUS daemon in background
echo "Starting FreeRADIUS service..."
freeradius -x &

# Wait briefly for FreeRADIUS to initialize
sleep 2

# Start ASP.NET Core Application
echo "Starting ASP.NET Core Web Controller..."
exec dotnet radiuscontroller.dll