#!/bin/bash
# ExecStart for devdesk.service: builds the ttyd command line from
# /etc/devdesk/env and /etc/devdesk/secret.env (loaded by systemd).
set -euo pipefail

if [ -z "${DEVDESK_CREDENTIAL:-}" ]; then
    echo "devdesk-serve: DEVDESK_CREDENTIAL is not set (expected in /etc/devdesk/secret.env)" >&2
    exit 1
fi

args=(
    --port "${DEVDESK_PORT:-7681}"
    --writable                          # ttyd >= 1.7.4 is read-only by default
    --url-arg                           # ?arg=<session> becomes `devdesk attach <session>`
    --check-origin                      # refuse cross-site WebSocket connections
    --max-clients "${DEVDESK_MAX_CLIENTS:-32}"
    --credential "$DEVDESK_CREDENTIAL"  # injected by NPM as an Authorization header
    --index "${DEVDESK_INDEX:-/usr/share/devdesk/index.html}"
    --debug "${DEVDESK_TTYD_LOG_LEVEL:-3}" # errors+warnings only: notice level would log the credential
)
if [ -n "${DEVDESK_BIND:-}" ]; then
    args+=(--interface "$DEVDESK_BIND")
fi

exec "${DEVDESK_TTYD:-/usr/lib/devdesk/bin/ttyd}" "${args[@]}" "${DEVDESK_BIN:-/usr/bin/devdesk}" attach