#!/usr/bin/env bash
#
# start_bridge.sh — (re)start voice_bridge with MQTT credentials from the
# environment, not from source.
#
# environment.d does NOT reach a fresh SSH shell (AGENTS.md section 4.4), so
# this script sources the mode-600 secrets file itself. Only MQTT_USER and
# MQTT_PASS are passed to the container; no secret values are written to git.
#
# Usage:
#   ./start_bridge.sh            # rebuild if needed and (re)create voice_bridge
#   ./start_bridge.sh --status   # show container state and recent logs
#   ./start_bridge.sh --logs     # follow the bridge log
#
# Rollback: the previous image is kept as voice_bridge:pre-credential-hygiene.

set -euo pipefail

HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
SECRETS="${SECRETS_FILE:-$HOME/.config/environment.d/10-secrets.conf}"

load_secrets() {
    if [ -f "$SECRETS" ]; then
        # shellcheck disable=SC1090
        set -a; . "$SECRETS"; set +a
    else
        echo "start_bridge.sh: $SECRETS not found" >&2
        exit 1
    fi
    if [ -z "${MQTT_USER:-}" ] || [ -z "${MQTT_PASS:-}" ]; then
        echo "start_bridge.sh: MQTT_USER / MQTT_PASS missing from $SECRETS" >&2
        exit 1
    fi
}

case "${1:-}" in
    --status)
        docker ps --filter name=voice_bridge --format '{{.Names}}\t{{.Image}}\t{{.Status}}'
        docker logs --tail 20 voice_bridge 2>&1 || true
        exit 0
        ;;
    --logs)
        exec docker logs -f voice_bridge
        ;;
    "")
        load_secrets
        exec docker compose -f "$HERE/docker-compose.yml" up -d --build voice-bridge
        ;;
    *)
        echo "start_bridge.sh: unknown option $1" >&2
        exit 2
        ;;
esac