#!/bin/sh
set -eu

# Docker creates a fresh named volume as root:root 0755. The artifact store
# deliberately rejects that mode: before starting the API, provision exactly
# the private root its pinned-directory checks require.
if [ "$#" -gt 0 ] && [ "$1" = "admin-api" ]; then
    storage_root="${CRANK_STORAGE_ROOT:-/var/lib/crank/storage}"
    case "$storage_root" in
        /*) ;;
        *)
            echo "CRANK_STORAGE_ROOT must be an absolute path" >&2
            exit 64
            ;;
    esac
    if [ -L "$storage_root" ] || { [ -e "$storage_root" ] && [ ! -d "$storage_root" ]; }; then
        echo "CRANK_STORAGE_ROOT must be a directory, not a symlink or file" >&2
        exit 64
    fi
    umask 077
    mkdir -p -- "$storage_root"
    chmod 0700 -- "$storage_root"
fi

exec "$@"