#!/usr/bin/env bash
set -Eeuo pipefail

: "${OPENBAO_ADDR:?OPENBAO_ADDR is required (e.g. https://openbao.example.com:8200)}"
: "${OPENBAO_MOUNT:?OPENBAO_MOUNT is required (e.g. secret/data)}"

PROVIDER="${PG_TDE_PROVIDER_NAME:-openbao}"
DEFAULT_KEY="${PG_TDE_PRINCIPAL_KEY_NAME:-prole-default-key}"

TOKEN_FILE="${OPENBAO_TOKEN_FILE:-/run/secrets/openbao_token}"

if [[ ! -f "$TOKEN_FILE" ]]; then
  echo "ERROR: OpenBao token file not found at $TOKEN_FILE (mount it read-only)" >&2
  exit 1
fi

CA_FILE="${OPENBAO_CA_CERT_FILE:-}"
CA_SQL="NULL"
if [[ -n "$CA_FILE" ]]; then
  [[ -f "$CA_FILE" ]] || { echo "ERROR: CA file not found: $CA_FILE" >&2; exit 1; }
  CA_SQL="'$CA_FILE'"
fi

# Note: pg_tde must be preloaded. Use ENABLE_PG_TDE=1 so the wrapper injects it.
psql -v ON_ERROR_STOP=1 --username "${POSTGRES_USER:-postgres}" --dbname "${POSTGRES_DB:-postgres}" <<SQL
CREATE EXTENSION IF NOT EXISTS pg_tde;
CREATE EXTENSION IF NOT EXISTS pg_prolelog;

SELECT pg_tde_add_global_key_provider_vault_v2(
  '${PROVIDER}',
  '${OPENBAO_ADDR}',
  '${OPENBAO_MOUNT}',
  '${TOKEN_FILE}',
  ${CA_SQL}
);

SELECT pg_tde_create_key_using_global_key_provider('${DEFAULT_KEY}', '${PROVIDER}');
SELECT pg_tde_set_default_key_using_global_key_provider('${DEFAULT_KEY}', '${PROVIDER}');
SQL