start

#!/bin/bash
set -e

# shellcheck disable=SC1091
. /app/venv/bin/activate

find_nss_wrapper() {
    for candidate in \
        /usr/lib/*/libnss_wrapper.so \
        /usr/lib/libnss_wrapper.so \
        /lib/*/libnss_wrapper.so \
        /lib/libnss_wrapper.so; do
        for path in $candidate; do
            if [ -f "$path" ]; then
                echo "$path"
                return 0
            fi
        done
    done
    return 1
}

ipv6_available() {
    local weblate_nginx_ipv6_value=${WEBLATE_NGINX_IPV6:-auto}
    weblate_nginx_ipv6_value=${weblate_nginx_ipv6_value,,}

    if [[ $weblate_nginx_ipv6_value == "0" || $weblate_nginx_ipv6_value == "false" || $weblate_nginx_ipv6_value == "no" || $weblate_nginx_ipv6_value == "off" ]]; then
        return 1
    fi

    if [[ $weblate_nginx_ipv6_value == "1" || $weblate_nginx_ipv6_value == "true" || $weblate_nginx_ipv6_value == "yes" || $weblate_nginx_ipv6_value == "on" ]]; then
        return 0
    fi

    if [[ ! -f /proc/net/if_inet6 ]]; then
        return 1
    fi

    if [[ -r /proc/sys/net/ipv6/conf/all/disable_ipv6 ]] && [[ $(cat /proc/sys/net/ipv6/conf/all/disable_ipv6) == "1" ]]; then
        return 1
    fi

    return 0
}

run_weblate() {
    "$WEBLATE_CMD" "$@"
}

runserver_has_web_service() {
    local weblate_service=${WEBLATE_SERVICE:-}
    [[ -z $weblate_service || $weblate_service == "web" ]]
}

EARLY_NGINX_PID_FILE=/run/nginx-early.pid
EARLY_NGINX_CONF_FILE=/tmp/nginx/nginx-early.conf

fail_dep() {
    >&2 echo "$1 not running!"
    >&2 echo
    >&2 echo "$1 is expected to run as separate Docker container."
    >&2 echo
    >&2 echo "Please see our docs for more details:"
    >&2 echo "https://docs.weblate.org/en/latest/admin/install/docker.html"
    exit 1
}

load_secret_from_file() {
    local secret_name=$1
    local file_var="${secret_name}_FILE"
    local file_path="${!file_var:-}"
    local secret_value

    if [[ -z $file_path ]]; then
        return 0
    fi

    if [[ ! -r $file_path ]]; then
        echo "Error: Password file '$file_path' not found or not readable" >&2
        exit 1
    fi

    # Command substitution strips trailing LF; drop a leftover CR from CRLF files.
    secret_value=$(cat "$file_path")
    secret_value=${secret_value%$'\r'}
    declare -gx "$secret_name=$secret_value"
}

# Allow sensitive settings to be defined in files
# in order to support Docker secrets.
load_secret_env_files() {
    load_secret_from_file POSTGRES_PASSWORD
    load_secret_from_file REDIS_PASSWORD
    load_secret_from_file WEBLATE_ADMIN_PASSWORD
    load_secret_from_file WEBLATE_EMAIL_HOST_PASSWORD
    load_secret_from_file WEBLATE_AUTH_LDAP_BIND_PASSWORD
}

initialize_env_defaults() {
    : "${CLIENT_MAX_BODY_SIZE:=1000m}"
    export CLIENT_MAX_BODY_SIZE
}

ensure_data_volume_writable() {
    if [[ ! -w /app/data ]]; then
        echo "The /app/data volume is not writable, please adjust the permissions. Weblate is running as uid $(id -u)"
        echo
        echo "Please see https://github.com/WeblateOrg/docker/issues/2096 in case"
        echo "the permissions on the volume are actually correct."
        exit 1
    fi
}

prepare_ssh_keys() {
    # Fix permissions on SSH private key.
    # Fails silently if the file doesn't exist yet.
    chmod 600 /app/data/ssh/id_rsa 2> /dev/null || true
    chmod 600 /app/data/ssh/id_ed25519 2> /dev/null || true
}

ensure_django_secret() {
    if [[ ! -s /app/data/secret ]]; then
        echo "Generating Django secret..."
        # https://github.com/django/django/blob/1.10.2/django/utils/crypto.py#L54-L56
        /app/venv/bin/python -c "from django.utils.crypto import get_random_string; print(get_random_string(50))" > /app/data/secret
    fi
}

ensure_saml_certificate() {
    # This has to be done early as it is used from the settings_docker.py
    if [[ -n $WEBLATE_SAML_IDP_URL && (! -f /app/data/ssl/saml.key || ! -f /app/data/ssl/saml.crt) ]]; then
        echo "Generating self-signed certificate for SAML..."
        mkdir -p /app/data/ssl
        openssl req \
            -new \
            -newkey rsa:4096 \
            -x509 \
            -days 3652 \
            -nodes \
            -subj "/OU=Weblate/CN=$WEBLATE_SITE_DOMAIN/emailAddress=$WEBLATE_ADMIN_EMAIL" \
            -out /app/data/ssl/saml.crt \
            -keyout /app/data/ssl/saml.key
    fi
}

prepare_runtime_files() {
    prepare_ssh_keys
    ensure_data_volume_writable
    ensure_django_secret
    ensure_saml_certificate
}

ensure_runtime_user() {
    local nss_wrapper_user_name
    local nss_wrapper_lib

    # Support OpenShift and other arbitrary-UID deployments without modifying
    # the system passwd database. Keep the legacy /etc/passwd append only as a
    # compatibility fallback for derived images that still make it writable.
    if whoami > /dev/null 2>&1; then
        return 0
    fi

    case "${USER_NAME:-weblate}" in
    *[!A-Za-z0-9._-]* | "")
        echo "Ignoring invalid USER_NAME value; using fallback username 'weblate'."
        nss_wrapper_user_name=weblate
        ;;
    *)
        nss_wrapper_user_name=${USER_NAME:-weblate}
        ;;
    esac

    if nss_wrapper_lib=$(find_nss_wrapper); then
        NSS_WRAPPER_PASSWD=/tmp/passwd.nss_wrapper
        NSS_WRAPPER_GROUP=/tmp/group.nss_wrapper

        cp /etc/passwd "$NSS_WRAPPER_PASSWD"
        cp /etc/group "$NSS_WRAPPER_GROUP"

        echo "$nss_wrapper_user_name:x:$(id -u):$(id -g):$nss_wrapper_user_name user:${HOME}:/sbin/nologin" >> "$NSS_WRAPPER_PASSWD"
        if ! grep -q "^[^:]*:[^:]*:$(id -g):" "$NSS_WRAPPER_GROUP"; then
            echo "$nss_wrapper_user_name:x:$(id -g):" >> "$NSS_WRAPPER_GROUP"
        fi

        export LD_PRELOAD="$nss_wrapper_lib${LD_PRELOAD:+ $LD_PRELOAD}"
        export NSS_WRAPPER_PASSWD
        export NSS_WRAPPER_GROUP
        return 0
    fi

    if [[ -w /etc/passwd ]]; then
        echo "$nss_wrapper_user_name:x:$(id -u):$(id -g):$nss_wrapper_user_name user:${HOME}:/sbin/nologin" >> /etc/passwd
        return 0
    fi

    echo "Current uid $(id -u) has no passwd entry and no writable fallback is available."
    echo "Install libnss-wrapper or provide a passwd entry for the runtime uid."
    exit 1
}

require_site_domain() {
    if [[ -z $WEBLATE_SITE_DOMAIN ]]; then
        echo "Missing WEBLATE_SITE_DOMAIN, please configure it"
        exit 1
    fi
}

export_runtime_env() {
    # Export Weblate variables.
    export WEBLATE_CMD="/app/venv/bin/weblate"
    export WEBLATE_PY_PATH="/app/data/python/customize"

    # Provide sane default value.
    : "${POSTGRES_SSL_MODE:=prefer}"
    export POSTGRES_SSL_MODE

    # Export variables for psql use.
    export PGPASSWORD="$POSTGRES_PASSWORD"
    export PGSSLMODE="$POSTGRES_SSL_MODE"
}

configure_timezone() {
    local zonefile

    # Update the time zone.
    if [[ ! -w /tmp/localtime ]]; then
        return 0
    fi

    zonefile="/usr/share/zoneinfo/$WEBLATE_TIME_ZONE"
    if [[ -n $WEBLATE_TIME_ZONE && -f $zonefile ]]; then
        cat "$zonefile" > /tmp/localtime
    else
        cat /usr/share/zoneinfo/Etc/UTC > /tmp/localtime
    fi
}

ensure_customize_app() {
    # Create fake Python app for customization.
    if [[ ! -d $WEBLATE_PY_PATH ]]; then
        echo "Creating $WEBLATE_PY_PATH"
        mkdir -p "$WEBLATE_PY_PATH/static"
        touch "$WEBLATE_PY_PATH/__init__.py"
        touch "$WEBLATE_PY_PATH/models.py"
    fi
}

check_weblate_config() {
    if ! run_weblate check; then
        >&2 echo "Failed to load configuration, please see errors above."
        exit 1
    fi
}

wait_for_shell_dependency() {
    local wait_label=$1
    local failure_label=$2
    local dependency_location=$3
    local dependency_check=$4
    local max_retries=30
    local timeout=0

    until run_weblate shell -c "$dependency_check" > /dev/null; do
        >&2 echo "$wait_label at $dependency_location is unavailable - retrying $((max_retries - timeout))"
        ((timeout += 1))
        if ((timeout > max_retries)); then
            run_weblate shell -c "$dependency_check"
            fail_dep "$failure_label"
        fi
        sleep 1
    done
}

wait_for_redis() {
    wait_for_shell_dependency \
        redis \
        redis \
        "${REDIS_HOST:-cache}" \
        'from django.core.cache import cache; cache.get("ping")'
}

set_postgres_connection_defaults() {
    : "${POSTGRES_HOST:=database}"
    : "${POSTGRES_PORT:=}"
    export POSTGRES_HOST
    export POSTGRES_PORT
}

wait_for_database() {
    wait_for_shell_dependency \
        "Database server" \
        PostgreSQL \
        "${POSTGRES_HOST:-db}" \
        'from weblate.auth.models import User; User.objects.raw("SELECT 1")'
}

database_version_check_enabled() {
    case $WEBLATE_DATABASES in
    0 | [fF][aA][lL][sS][eE] | [nN][oO])
        return 1
        ;;
    *)
        return 0
        ;;
    esac
}

check_postgres_version() {
    local pgversion

    if ! database_version_check_enabled; then
        >&2 echo "Database is up"
        return 0
    fi

    # Fetch server version.
    pgversion=$(psql -h "$POSTGRES_HOST" -p "$POSTGRES_PORT" -d "${POSTGRES_DB:-$POSTGRES_DATABASE}" -U "$POSTGRES_USER" -t -A -c 'SHOW server_version_num;') || {
        >&2 echo "Failed to connect to PostgreSQL to determine server version"
        exit 1
    }

    unset PGPASSWORD

    >&2 echo "Postgres $pgversion is up"

    # Check if supported PostgreSQL version is used.
    if ((pgversion < 120000)); then
        >&2 echo "PostgreSQL 12 or newer is required to run Weblate"
        >&2 echo "See https://docs.weblate.org/en/latest/admin/install/docker.html#upgrading-postgresql-container"
        exit 1
    fi
}

prepare_supervisor_services() {
    DO_MIGRATE=1
    SUPERVISOR_CONF=/run/supervisor.conf.d/

    # Select which services to run.
    mkdir -p "$SUPERVISOR_CONF"
    # Remove possible stale files from previous start.
    rm -f "$SUPERVISOR_CONF"/*

    if [[ -n $WEBLATE_SERVICE ]]; then
        if [[ $WEBLATE_SERVICE != "celery-beat" ]]; then
            DO_MIGRATE=0
        fi
        ln -s "/etc/supervisor/conf.d/$WEBLATE_SERVICE.conf" "$SUPERVISOR_CONF"
        return 0
    fi

    # Symlink all non-celery services.
    find /etc/supervisor/conf.d -type f ! -name 'celery-*.conf' -exec ln -s -t "$SUPERVISOR_CONF" {} +

    if ((${CELERY_SINGLE_PROCESS:-0} == 1)); then
        # Symlink single process service only.
        ln -s /etc/supervisor/conf.d/celery-single.conf "$SUPERVISOR_CONF"
        ln -s /etc/supervisor/conf.d/celery-beat.conf "$SUPERVISOR_CONF"
    else
        # Symlink all celery services but the single process.
        find /etc/supervisor/conf.d -type f -name 'celery-*.conf' ! -name 'celery-single.conf' -exec ln -s -t "$SUPERVISOR_CONF" {} +
    fi
}

run_startup_maintenance() {
    if ((DO_MIGRATE == 1)); then
        echo "Starting database migration..."
        if ! run_weblate migrate; then
            echo
            echo "Database migration has failed. Please check the error message above."
            echo "Note: Upgrading across major versions is not supported. In case you are upgrading"
            echo "      from a 4.x version, please upgrade to 5.0.2 first."
            echo
            echo "      Using following for the docker-compose.yaml:"
            echo
            echo "          image: weblate/weblate:5.0.2.2"
            exit 1
        fi

        # Create or update admin account.
        if [[ -n $WEBLATE_ADMIN_PASSWORD ]]; then
            echo "Updating admin user password (unset WEBLATE_ADMIN_PASSWORD to disable)..."
            run_weblate createadmin --password="$WEBLATE_ADMIN_PASSWORD" --update --email="$WEBLATE_ADMIN_EMAIL" --name="$WEBLATE_ADMIN_NAME"
        else
            run_weblate createadmin --email="$WEBLATE_ADMIN_EMAIL" --name="$WEBLATE_ADMIN_NAME" || true
        fi

        echo "Refreshing stats..."
        run_weblate ensure_stats
    fi

    collect_web_static_assets
    # Compress js and css.
    run_weblate compress --force --traceback
}

collect_web_static_assets() {
    if [[ ${EARLY_COLLECTSTATIC_DONE:-0} == 1 ]]; then
        return 0
    fi

    # Run with --clear to ensure all files are up to date.
    run_weblate collectstatic --noinput --clear
    EARLY_COLLECTSTATIC_DONE=1
}

prepare_runtime_sockets_and_pids() {
    # WSGI socket dir.
    mkdir -p /run/granian/
    GRANIAN_SOCKET=/run/granian/granian.sock
    rm -f "$GRANIAN_SOCKET"

    # Celery pid, remove possible stale PID file.
    mkdir -p /run/celery
    rm -f /run/celery/beat.pid
}

configure_real_ip() {
    # Parse upstream X-Forwarded-For.
    case "$WEBLATE_IP_PROXY_HEADER" in
    HTTP_X_FORWARDED_FOR)
        WEBLATE_REALIP="
real_ip_header X-Forwarded-For;
set_real_ip_from 0.0.0.0/0;
set_real_ip_from ::/0;
"
        ;;
    *)
        WEBLATE_REALIP=
        ;;
    esac
}

detect_builtin_ssl() {
    # Detect SSL setup.
    if [[ -f /app/data/ssl/privkey.pem ]]; then
        WEBLATE_BUILTIN_SSL=1
        if [[ -z $WEBLATE_IP_PROXY_HEADER ]]; then
            # Use X-Forwarded-For from the built-in nginx
            export WEBLATE_IP_PROXY_HEADER=HTTP_X_FORWARDED_FOR
        fi
    else
        WEBLATE_BUILTIN_SSL=
    fi
}

generate_nginx_config() {
    configure_real_ip
    detect_builtin_ssl

    # Make sure WEBLATE_ANUBIS_URL is set.
    : "${WEBLATE_ANUBIS_URL:=}"
    : "${WEBLATE_ENABLE_HTTPS:=}"
    if ipv6_available; then
        WEBLATE_ENABLE_IPV6=1
    else
        WEBLATE_ENABLE_IPV6=
    fi

    # Generate nginx configuration.
    mkdir -p /tmp/nginx
    /app/venv/bin/python \
        /etc/nginx/generate-site.py \
        /etc/nginx \
        "$WEBLATE_URL_PREFIX" \
        "$WEBLATE_REALIP" \
        "$CLIENT_MAX_BODY_SIZE" \
        "$WEBLATE_BUILTIN_SSL" \
        "$WEBLATE_ANUBIS_URL" \
        "$WEBLATE_SITE_DOMAIN" \
        "$WEBLATE_ENABLE_HTTPS" \
        "$GRANIAN_SOCKET" \
        "$WEBLATE_ENABLE_IPV6" \
        > /tmp/nginx/weblate-site.conf
}

prepare_early_nginx_main_config() {
    sed "s#^pid /run/nginx.pid;\$#pid $EARLY_NGINX_PID_FILE;#" /etc/nginx/nginx.conf > "$EARLY_NGINX_CONF_FILE"

    if ! grep -q "^pid $EARLY_NGINX_PID_FILE;\$" "$EARLY_NGINX_CONF_FILE"; then
        echo "Failed to prepare early nginx configuration"
        exit 1
    fi
}

start_early_nginx() {
    local early_nginx_pid
    local start_retries=5
    local timeout=0

    if ! runserver_has_web_service; then
        return 0
    fi

    collect_web_static_assets
    prepare_runtime_sockets_and_pids
    generate_nginx_config
    prepare_early_nginx_main_config
    rm -f "$EARLY_NGINX_PID_FILE"

    echo "Starting nginx early to serve the startup page..."
    /usr/sbin/nginx -c "$EARLY_NGINX_CONF_FILE"

    while ((timeout < start_retries)); do
        if [[ -s $EARLY_NGINX_PID_FILE ]]; then
            early_nginx_pid=$(cat "$EARLY_NGINX_PID_FILE")
            if kill -0 "$early_nginx_pid" 2> /dev/null; then
                EARLY_NGINX_STARTED=1
                return 0
            fi
        fi
        ((timeout += 1))
        sleep 1
    done

    echo "Early nginx did not start cleanly"
    exit 1
}

stop_early_nginx() {
    local early_nginx_pid
    local graceful_retries=5
    local term_retries=5
    local final_retries=5
    local timeout=0

    if [[ ${EARLY_NGINX_STARTED:-0} != 1 ]]; then
        return 0
    fi

    if [[ ! -s $EARLY_NGINX_PID_FILE ]]; then
        EARLY_NGINX_STARTED=0
        return 0
    fi

    early_nginx_pid=$(cat "$EARLY_NGINX_PID_FILE")
    if ! kill -0 "$early_nginx_pid" 2> /dev/null; then
        rm -f "$EARLY_NGINX_PID_FILE"
        EARLY_NGINX_STARTED=0
        return 0
    fi

    kill -QUIT "$early_nginx_pid" 2> /dev/null || true

    while kill -0 "$early_nginx_pid" 2> /dev/null; do
        ((timeout += 1))
        if ((timeout > graceful_retries)); then
            echo "Timed out draining early nginx, sending TERM..."
            kill -TERM "$early_nginx_pid" 2> /dev/null || true
            timeout=0
            break
        fi
        sleep 1
    done

    if kill -0 "$early_nginx_pid" 2> /dev/null; then
        while kill -0 "$early_nginx_pid" 2> /dev/null; do
            ((timeout += 1))
            if ((timeout > term_retries)); then
                echo "Early nginx did not stop after TERM, forcing shutdown..."
                break
            fi
            sleep 1
        done
    fi

    if kill -0 "$early_nginx_pid" 2> /dev/null; then
        kill -KILL "$early_nginx_pid" 2> /dev/null || true
        timeout=0
        while kill -0 "$early_nginx_pid" 2> /dev/null; do
            ((timeout += 1))
            if ((timeout > final_retries)); then
                echo "Early nginx did not stop after forced shutdown; leaving pid file in place." >&2
                return 1
            fi
            sleep 1
        done
    fi

    rm -f "$EARLY_NGINX_PID_FILE"
    EARLY_NGINX_STARTED=0
}

calculate_worker_defaults() {
    local processors

    # Calculate number of processes, at least 2, at most 4, depending on CPU cores.
    if [[ -z $WEBLATE_WORKERS ]]; then
        processors=$(nproc)
        if ((processors < 2)); then
            WEBLATE_WORKERS=2
        elif ((processors > 4)); then
            WEBLATE_WORKERS=4
        else
            WEBLATE_WORKERS=$processors
        fi
        echo "Auto-scaled to $WEBLATE_WORKERS processes, adjust by setting WEBLATE_WORKERS"
    fi

    # Default values for celery options.
    : "${CELERY_MAIN_OPTIONS:="--concurrency $WEBLATE_WORKERS"}"
    : "${CELERY_NOTIFY_OPTIONS:="--concurrency $WEBLATE_WORKERS"}"
    : "${CELERY_TRANSLATE_OPTIONS:="--concurrency $WEBLATE_WORKERS"}"
    : "${CELERY_MEMORY_OPTIONS:="--concurrency $((WEBLATE_WORKERS == 1 ? 1 : WEBLATE_WORKERS / 2))"}"
    : "${CELERY_BACKUP_OPTIONS:="--concurrency 1"}"
    : "${CELERY_BEAT_OPTIONS:=}"
    : "${CELERY_SINGLE_OPTIONS:=}"
    : "${WEB_WORKERS:="$((WEBLATE_WORKERS <= 3 ? 2 : WEBLATE_WORKERS / 2))"}"
    : "${WEB_BLOCKING_THREADS:="$((WEBLATE_WORKERS * 2))"}"
    : "${GRANIAN_ARGS:=}"

    export CELERY_MAIN_OPTIONS
    export CELERY_NOTIFY_OPTIONS
    export CELERY_TRANSLATE_OPTIONS
    export CELERY_MEMORY_OPTIONS
    export CELERY_BACKUP_OPTIONS
    export CELERY_BEAT_OPTIONS
    export CELERY_SINGLE_OPTIONS
    export WEB_WORKERS
    export WEB_BLOCKING_THREADS
    export GRANIAN_SOCKET
    export GRANIAN_ARGS
}

start_supervisord() {
    # Execute supervisor.
    exec /app/venv/bin/supervisord \
        --loglevel="${SUPERVISOR_LOGLEVEL:-info}" \
        --logfile="${SUPERVISOR_LOGFILE:-/dev/null}" \
        --configuration=/etc/supervisor/supervisord.conf
}

runserver_main() {
    prepare_supervisor_services
    run_startup_maintenance
    prepare_runtime_sockets_and_pids
    generate_nginx_config
    calculate_worker_defaults
    stop_early_nginx
    start_supervisord
}

main() {
    load_secret_env_files
    initialize_env_defaults

    echo "Starting Weblate $WEBLATE_VERSION..."

    prepare_runtime_files
    ensure_runtime_user
    require_site_domain
    export_runtime_env
    configure_timezone
    ensure_customize_app
    check_weblate_config
    if [[ ${1:-} == "runserver" ]]; then
        start_early_nginx
    fi
    wait_for_redis
    set_postgres_connection_defaults
    wait_for_database
    check_postgres_version

    if [[ ${1:-} == "runserver" ]]; then
        runserver_main
    fi

    # Start the management command.
    run_weblate "$@"
}

main "$@"