#!/usr/bin/env bash
#
# Build the scratch broker configuration used by `make mqtt-verify`.
#
# It mirrors the proposed change to the shared Mosquitto on `.13` exactly:
# the existing plain listener is left as it is, and the webrestrict listener is
# added beside it. The verification runs this config on a separate, throwaway
# container, so nothing shared is touched.
#
#   build/mosquitto.conf  the scratch main configuration (generated)
#   conf.d/               the real listener, ACL and password files

set -euo pipefail

here="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
out="$here/build"

mkdir -p "$out"

cat >"$out/mosquitto.conf" <<'EOF'
# GENERATED by deploy/mosquitto/build-config.sh — do not edit.
#
# The scratch broker for `make mqtt-verify`. It is the proposed shape of the
# shared Mosquitto on `.13`:
#
#   * the plain 1883 listener is unchanged, still anonymous, so n8n and the rest
#     of the lab keep working;
#   * the 8883 listener (conf.d/webrestrict.conf) is TLS-only and needs an
#     account;
#   * `per_listener_settings true` is what keeps those two planes apart. It
#     belongs in the main configuration, before the first listener, and is the
#     only change to the existing lines of mosquitto.conf.
persistence false
log_dest stdout
connection_messages true

per_listener_settings true

listener 1883 0.0.0.0
allow_anonymous true

include_dir /mosquitto/config/conf.d
EOF

echo "build-config: wrote $out/mosquitto.conf"