#!/bin/sh
# NEXXVU Portal host administration (nxv12-enrollment-contract.md section 6):
#   nexxvu-portal setup-code | create-user NAME | recovery reset-admin | recovery clear-allowlist
# Installed root-owned (/usr/local/sbin/nexxvu-portal, 0755) and journalled by the greenfield installer. It runs the
# selected release's CLI (app.cli) with that release's own runtime and a fixed environment, the same paths the Portal
# service uses. The CLI itself requires root or the data owner and switches to the data owner before it opens the
# database, so every data file stays owned by the service account.
set -eu
umask 0027
cd /opt/nexxvu-updater/current
exec /usr/bin/env -i PATH=/usr/sbin:/usr/bin:/sbin:/bin LANG=C.UTF-8 LC_ALL=C.UTF-8 TZ=UTC \
  PORTAL_DB_PATH=/opt/nexxvu-portal/data/portal.db \
  PORTAL_MANAGED_CREDENTIALS_PATH=/opt/nexxvu-portal/data/managed-credentials \
  PORTAL_RELEASE_IDENTITY_PATH=/opt/nexxvu-updater/state/current-release.json \
  PORTAL_UPDATE_PUBLIC_KEY_PATH=/etc/nexxvu-portal/update-signing-public-key \
  PORTAL_UPDATE_AUTHORIZATION_PUBLIC_KEY_PATH=/etc/nexxvu-portal/update-authorization-public-key \
  PORTAL_UPDATER_ROOT=/opt/nexxvu-updater \
  PORTAL_CURRENT_RELEASE_PATH=/opt/nexxvu-updater/current \
  /opt/nexxvu-updater/current/.venv/bin/python -B -m app.cli "$@"
