start.sh

#!/bin/bash
# SPDX-FileCopyrightText: 2025 Nextcloud GmbH and Nextcloud contributors
# SPDX-License-Identifier: AGPL-3.0-or-later
# bash (not sh): process supervision at the bottom relies on `wait -n`.

set -e

# ----------------------------------------------------------------------------
# start.sh
#  - Generates self-signed certificates for FRP Server and FRP Clients
#  - Generates haproxy.cfg from haproxy.cfg.template (in /run/harp if available)
#  - Reads HP_SHARED_KEY or HP_SHARED_KEY_FILE
#  - Comments out HTTPS frontends if no /certs/cert.pem is found
#  - Starts FRP server (frps) on HP_FRP_ADDRESS
#  - Starts the Python SPOE agent on HP_SPOA_ADDRESS
#  - Launches Python SPOE HTTP Control API on 127.0.0.1:8200
#  - Finally runs HAProxy in the foreground
#
#  NOTE:
#    Certificates are generated in the /certs/frp folder - they are used only by FRP and AppAPI.
#    If HP_FRP_DISABLE_TLS is set to "false"(default), self-signed certificates will be generated:
#      - CA key and certificate (ca.key, ca.crt)
#      - Server key, CSR, and certificate (server.key, server.csr, server.crt)
#      - Client key, CSR, and certificate (client.key, client.csr, client.crt)
#    The certificates are valid for HP_FRP_CERT_VALIDITY_DAYS days (default 5000) and are not rotated automatically.
#    We do not generate /certs/cert.pem file, as for HaProxy it is admin task to mount generated cert if needed.
# ----------------------------------------------------------------------------

HP_WAIT_AGENT_HTTP=${HP_WAIT_AGENT_HTTP:-60}
HP_WAIT_SPOA=${HP_WAIT_SPOA:-60}
HP_WAIT_FRP=${HP_WAIT_FRP:-30}
HP_WAIT_INTERVAL=${HP_WAIT_INTERVAL:-0.5}

# Watchdog: after roughly HP_WATCHDOG_FAILS x (HP_WATCHDOG_INTERVAL + curl's 5s timeout)
# seconds without /heartbeat the agent is killed and the container exits so the Docker
# restart policy revives it.
HP_WATCHDOG_ENABLED=${HP_WATCHDOG_ENABLED:-true}
HP_WATCHDOG_INTERVAL=${HP_WATCHDOG_INTERVAL:-10}
HP_WATCHDOG_FAILS=${HP_WATCHDOG_FAILS:-12}
# Non-numeric or zero values would turn the watchdog into a busy loop (a failing `sleep` retries instantly).
[ "$HP_WATCHDOG_INTERVAL" -ge 1 ] 2>/dev/null || { echo "WARNING: invalid HP_WATCHDOG_INTERVAL '${HP_WATCHDOG_INTERVAL}', using 10."; HP_WATCHDOG_INTERVAL=10; }
[ "$HP_WATCHDOG_FAILS" -ge 1 ] 2>/dev/null || { echo "WARNING: invalid HP_WATCHDOG_FAILS '${HP_WATCHDOG_FAILS}', using 12."; HP_WATCHDOG_FAILS=12; }

# WebSocket/tunnel idle timeout: defaults to HP_TIMEOUT_SERVER so raising the server
# timeout covers tunnels as well. "0" means unlimited; HAProxy itself has no infinite
# value for "timeout tunnel" (a literal 0 falls back to the client timeout), so it is
# mapped to HAProxy's 24d maximum.
# Exported explicitly: unlike the Dockerfile ENV timeouts it must reach envsubst below.
HP_TIMEOUT_TUNNEL="${HP_TIMEOUT_TUNNEL:-${HP_TIMEOUT_SERVER:-1800s}}"
if [[ "$HP_TIMEOUT_TUNNEL" =~ ^0(us|ms|s|m|h|d)?$ ]]; then
    HP_TIMEOUT_TUNNEL="24d"
fi
export HP_TIMEOUT_TUNNEL

HP_VERBOSE_START=${HP_VERBOSE_START:-1}
log() {
    if [ "$HP_VERBOSE_START" -eq 1 ]; then
        echo "$@"
    fi
}

# ----------------------------------------------------------------------------
# Determine config directory - use /run/harp if available (for read-only rootfs)
# If user mounted config files at root, use root paths for backward compatibility
# ----------------------------------------------------------------------------
CFG_DIR=""
if [ -f "/haproxy.cfg" ] || [ -f "/frps.toml" ] || [ -f "/frpc-docker.toml" ]; then
    log "INFO: Found user-provided config file(s) at root, using root paths."
elif [ -d "/run/harp" ] || mkdir -p /run/harp 2>/dev/null; then
    CFG_DIR="/run/harp"
fi

# ----------------------------------------------------------------------------
# Helper function to strip surrounding quotes from a string.
# This is useful because users sometimes accidentally include quotes in
# docker-compose environment variables (e.g., HP_SHARED_KEY="secret").
# In YAML, this includes the literal quotes in the value.
# ----------------------------------------------------------------------------
strip_quotes() {
    # Remove leading and trailing double or single quotes
    echo "$1" | sed -e 's/^"//' -e 's/"$//' -e "s/^'//" -e "s/'$//"
}

wait_for_tcp() {
    # $1 host, $2 port, $3 timeout(s), $4 interval(s), $5 optional PID of the process that should listen
    host="$1"; port="$2"; timeout="${3:-30}"; interval="${4:-0.5}"; pid="${5:-}"
    start_ts="$(date +%s)"
    while :; do
        if nc -z -w 1 "$host" "$port" >/dev/null 2>&1; then
            return 0
        fi
        # A process that has exited will not start listening: stop at once instead of waiting for the timeout.
        if [ -n "$pid" ] && ! kill -0 "$pid" 2>/dev/null; then
            status=0; wait "$pid" 2>/dev/null || status=$?
            echo "ERROR: The process that should listen on $host:$port exited during startup (status $status); see the error above."
            return 1
        fi
        now="$(date +%s)"; elapsed=$(( now - start_ts ))
        if [ "$elapsed" -ge "$timeout" ]; then
            echo "ERROR: Timeout waiting for TCP $host:$port to become ready (after ${timeout}s)."
            return 1
        fi
        sleep "$interval"
    done
}

wait_for_http() {
    # $1 url, $2 timeout(s), $3 interval(s), $4 optional PID of the process that serves the URL
    url="$1"; timeout="${2:-60}"; interval="${3:-0.5}"; pid="${4:-}"
    start_ts="$(date +%s)"
    while :; do
        # --noproxy: internal loopback probes must ignore any http_proxy environment.
        if curl -fsS --noproxy '*' --max-time 2 "$url" >/dev/null 2>&1; then
            return 0
        fi
        # A process that has exited will not become ready: stop at once instead of waiting for the timeout.
        if [ -n "$pid" ] && ! kill -0 "$pid" 2>/dev/null; then
            status=0; wait "$pid" 2>/dev/null || status=$?
            echo "ERROR: The process serving $url exited during startup (status $status); see the error above."
            return 1
        fi
        now="$(date +%s)"; elapsed=$(( now - start_ts ))
        if [ "$elapsed" -ge "$timeout" ]; then
            echo "ERROR: Timeout waiting for HTTP $url to become ready (after ${timeout}s)."
            return 1
        fi
        sleep "$interval"
    done
}

# shellcheck disable=SC2329  # invoked via trap
_shutdown() {
    trap - TERM INT USR1
    set +e  # may fire while `set -e` is still active during startup
    log "INFO: Stop signal received, shutting down HaRP processes..."
    [ -n "${WATCHDOG_PID:-}" ] && kill "$WATCHDOG_PID" 2>/dev/null
    # Unquoted expansions: still-unset PIDs simply disappear from the argument list.
    # shellcheck disable=SC2086
    kill -TERM ${HAPROXY_PID:-} ${AGENT_PID:-} ${FRPS_PID:-} ${FRPC_PID:-} 2>/dev/null
    # Explicit PIDs, not a bare `wait`: bash 5.3.9 loops forever in a bare `wait` on a
    # child it lost track of.
    # shellcheck disable=SC2086
    wait ${WATCHDOG_PID:-} ${HAPROXY_PID:-} ${AGENT_PID:-} ${FRPS_PID:-} ${FRPC_PID:-} 2>/dev/null
    exit 0
}
# Install the stop handler before doing anything slow (certificate generation, service
# startup waits), so a `docker stop` during startup exits cleanly instead of hitting
# Docker's 10s SIGKILL: the kernel drops default-disposition signals for PID 1.
# USR1 too: it was the image's stop signal while haproxy was PID 1, so honor it as well.
trap _shutdown TERM INT USR1

# Forward SIGHUP to the HAProxy master for a live config/certificate reload, matching
# the behavior when HAProxy was PID 1. The `|| true` matters: before HAProxy is started
# the kill fails, and a failing trap command under the startup `set -e` would abort PID 1.
# shellcheck disable=SC2086
trap 'kill -HUP ${HAPROXY_PID:-} 2>/dev/null || true' HUP

# ----------------------------------------------------------------------------
# Resolve HP_SHARED_KEY once for the whole process (env or file)
# ----------------------------------------------------------------------------
if [ -n "$HP_SHARED_KEY" ] && [ -n "$HP_SHARED_KEY_FILE" ]; then
    echo "ERROR: Only one of HP_SHARED_KEY or HP_SHARED_KEY_FILE should be specified."
    exit 1
fi
if [ -z "$HP_SHARED_KEY" ] && [ -n "$HP_SHARED_KEY_FILE" ]; then
    if [ ! -f "$HP_SHARED_KEY_FILE" ]; then
        echo "ERROR: HP_SHARED_KEY_FILE is specified but the file does not exist."
        exit 1
    fi
    if [ ! -s "$HP_SHARED_KEY_FILE" ]; then
        echo "ERROR: HP_SHARED_KEY_FILE is specified but is empty."
        exit 1
    fi
    HP_SHARED_KEY="$(cat "$HP_SHARED_KEY_FILE")"
fi
if [ -z "$HP_SHARED_KEY" ]; then
    echo "ERROR: Either HP_SHARED_KEY or HP_SHARED_KEY_FILE must be set."
    exit 1
fi

# Validate HP_SHARED_KEY contains only ASCII characters (required by SPOE library)
NON_ASCII_COUNT=$(printf '%s' "$HP_SHARED_KEY" | LC_ALL=C tr -d '\040-\176' | wc -c)
if [ "$NON_ASCII_COUNT" -gt 0 ]; then
    echo "ERROR: HP_SHARED_KEY contains non-ASCII characters."
    echo "Please use only printable ASCII characters (a-z, A-Z, 0-9, and symbols like !@#\$%^&*...)."
    exit 1
fi

# Strip surrounding quotes if user accidentally included them in env vars
HP_SHARED_KEY="$(strip_quotes "$HP_SHARED_KEY")"
export HP_SHARED_KEY

# After stripping any surrounding quotes, the remaining value must not contain
# characters that would corrupt the generated FRP TOML config line
# `metadatas.token = "..."`:
#   "  - terminates the TOML basic string
#   \  - starts a TOML escape sequence inside that string
FORBIDDEN_COUNT=$(printf '%s' "$HP_SHARED_KEY" | LC_ALL=C tr -cd '"\\' | wc -c)
if [ "$FORBIDDEN_COUNT" -gt 0 ]; then
    echo "ERROR: HP_SHARED_KEY contains a forbidden character."
    echo "The following characters are not allowed: double quote (\"), backslash (\\)."
    echo "Please choose a password without these characters."
    exit 1
fi

# Strip surrounding quotes from other commonly affected environment variables
NC_INSTANCE_URL="$(strip_quotes "$NC_INSTANCE_URL")"
HP_FRP_ADDRESS="$(strip_quotes "$HP_FRP_ADDRESS")"
HP_EXAPPS_ADDRESS="$(strip_quotes "${HP_EXAPPS_ADDRESS:-}")"
HP_EXAPPS_HTTPS_ADDRESS="$(strip_quotes "${HP_EXAPPS_HTTPS_ADDRESS:-}")"
export NC_INSTANCE_URL HP_FRP_ADDRESS HP_EXAPPS_ADDRESS HP_EXAPPS_HTTPS_ADDRESS

# Check if the required environment variables are set
if [ -z "$HP_FRP_ADDRESS" ]; then
    echo "ERROR: HP_FRP_ADDRESS is not set."
    exit 1
fi
if [ -z "$NC_INSTANCE_URL" ]; then
    echo "ERROR: NC_INSTANCE_URL is not set."
    exit 1
fi

# Initialize FRP_HOST and FRP_PORT once to avoid parsing HP_FRP_ADDRESS multiple times.
FRP_HOST="$(echo "$HP_FRP_ADDRESS" | cut -d':' -f1)"
FRP_PORT="$(echo "$HP_FRP_ADDRESS" | cut -d':' -f2)"

# Initialize SPOA_HOST and SPOA_PORT from HP_SPOA_ADDRESS (default 127.0.0.1:9600).
HP_SPOA_ADDRESS="${HP_SPOA_ADDRESS:-127.0.0.1:9600}"
SPOA_HOST="$(echo "$HP_SPOA_ADDRESS" | cut -d':' -f1)"
SPOA_PORT="$(echo "$HP_SPOA_ADDRESS" | cut -d':' -f2)"

# ----------------------------------------------------------------------------
# Map HP_LOG_LEVEL (our user-friendly strings) to valid HAProxy log levels.
# Case, blanks and surrounding quotes are ignored; any other value falls back to "warning".
# ----------------------------------------------------------------------------
HP_LOG_LEVEL_GIVEN="${HP_LOG_LEVEL-}"
HP_LOG_LEVEL="$(strip_quotes "$(printf '%s' "$HP_LOG_LEVEL_GIVEN" | tr -d '[:space:]')" | tr '[:upper:]' '[:lower:]')"
case "${HP_LOG_LEVEL}" in
  debug)
    HP_LOG_LEVEL_HAPROXY="debug"
    ;;
  info)
    HP_LOG_LEVEL_HAPROXY="info"
    ;;
  warning|warn)
    HP_LOG_LEVEL="warning"
    HP_LOG_LEVEL_HAPROXY="warning"
    ;;
  error)
    HP_LOG_LEVEL_HAPROXY="err"
    ;;
  *)
    echo "WARNING: Unrecognized HP_LOG_LEVEL='${HP_LOG_LEVEL_GIVEN}', defaulting to 'warning'"
    HP_LOG_LEVEL="warning"
    HP_LOG_LEVEL_HAPROXY="warning"
    ;;
esac

# The agent reads HP_LOG_LEVEL too.
export HP_LOG_LEVEL HP_LOG_LEVEL_HAPROXY

# ----------------------------------------------------------------------------
# Generate self-signed certs for FRP unless HP_FRP_DISABLE_TLS=true
# ----------------------------------------------------------------------------
if [ "${HP_FRP_DISABLE_TLS}" != "true" ]; then
    if [ ! -d "/certs/frp" ]; then
        mkdir -p /certs/frp
        log "INFO: /certs/frp directory created."
        log "INFO: Generating self-signed certificates in /certs/frp..."

        # Validity (in days) for the self-signed FRP certificates (CA, server and client). Configurable so
        # admins who run their own certificate renewal can shorten it. The long default keeps the CA and the
        # client certificate - both copied to external Docker engines (see README) - valid for the lifetime
        # of a typical deployment, since HaRP does not rotate them automatically.
        HP_FRP_CERT_VALIDITY_DAYS="${HP_FRP_CERT_VALIDITY_DAYS:-5000}"
        case "$HP_FRP_CERT_VALIDITY_DAYS" in
            ''|*[!0-9]*)
                echo "ERROR: HP_FRP_CERT_VALIDITY_DAYS must be a positive integer number of days, got '$HP_FRP_CERT_VALIDITY_DAYS'."
                exit 1
                ;;
        esac
        if [ "$HP_FRP_CERT_VALIDITY_DAYS" -lt 1 ]; then
            echo "ERROR: HP_FRP_CERT_VALIDITY_DAYS must be a positive integer number of days, got '$HP_FRP_CERT_VALIDITY_DAYS'."
            exit 1
        fi
        log "INFO: FRP certificates will be valid for ${HP_FRP_CERT_VALIDITY_DAYS} days."

        # Write OpenSSL configuration for server to /certs/frp/server-openssl.cnf.
        cat > /certs/frp/server-openssl.cnf <<EOF
[ req ]
default_bits = 2048
default_md = sha256
prompt = no
distinguished_name = dn
req_extensions = req_ext

[ dn ]
CN = harp.nc

[ req_ext ]
subjectAltName = DNS:harp.nc
EOF

        # Generate CA key and certificate.
        openssl genrsa -out /certs/frp/ca.key 2048
        openssl req -x509 -new -nodes -key /certs/frp/ca.key -subj "/CN=harp.nc" -days "$HP_FRP_CERT_VALIDITY_DAYS" -out /certs/frp/ca.crt

        # Generate server key and CSR.
        openssl genrsa -out /certs/frp/server.key 2048
        openssl req -new -sha256 -key /certs/frp/server.key -subj "/CN=harp.nc" \
            -reqexts req_ext -config /certs/frp/server-openssl.cnf -out /certs/frp/server.csr

        # Sign the server certificate with the CA.
        openssl x509 -req -days "$HP_FRP_CERT_VALIDITY_DAYS" -sha256 -in /certs/frp/server.csr \
            -CA /certs/frp/ca.crt -CAkey /certs/frp/ca.key -CAcreateserial \
            -extfile /certs/frp/server-openssl.cnf -extensions req_ext -out /certs/frp/server.crt

        # Generate client key.
        openssl genrsa -out /certs/frp/client.key 2048

        # Write OpenSSL configuration for client to /certs/frp/client-openssl.cnf.
        cat > /certs/frp/client-openssl.cnf <<EOF
[ req ]
default_bits = 2048
default_md = sha256
prompt = no
distinguished_name = dn
req_extensions = req_ext

[ dn ]
CN = harp.client.nc

[ req_ext ]
subjectAltName = DNS:harp.client.nc
EOF

        # Generate client CSR & sign with CA.
        openssl req -new -sha256 -key /certs/frp/client.key -subj "/CN=harp.client.nc" \
            -config /certs/frp/client-openssl.cnf -out /certs/frp/client.csr

        openssl x509 -req -days "$HP_FRP_CERT_VALIDITY_DAYS" -sha256 -in /certs/frp/client.csr \
            -CA /certs/frp/ca.crt -CAkey /certs/frp/ca.key -CAcreateserial \
            -extfile /certs/frp/client-openssl.cnf -extensions req_ext -out /certs/frp/client.crt

        log "INFO: Certificate generation completed."
    fi
else
    log "INFO: HP_FRP_DISABLE_TLS is set to true. Skipping certificate generation."
fi

# ----------------------------------------------------------------------------
# Generate final haproxy.cfg if not already present
# ----------------------------------------------------------------------------
if [ -f "${CFG_DIR}/haproxy.cfg" ]; then
  log "INFO: ${CFG_DIR}/haproxy.cfg already present. Skipping config generation..."
else
  # Checked before the config is written, so a failed start leaves none for a restart to reuse.
  if [ -f "/certs/cert.pem" ] && [ ! -r "/certs/cert.pem" ]; then
    echo "ERROR: /certs/cert.pem is not readable by uid $(id -u); make it readable, or remove it to disable the HTTPS frontend."
    exit 1
  fi

  log "INFO: Creating ${CFG_DIR}/haproxy.cfg from haproxy.cfg.template..."

  # Use envsubst to render the main configuration.
  envsubst < /haproxy.cfg.template > "${CFG_DIR}/haproxy.cfg"

  # If we do not have a SSL cert for HAProxy, comment out the HTTPS frontends
  if [ -f "/certs/cert.pem" ]; then
    log "INFO: Found /certs/cert.pem, HTTPS frontends remain enabled."
    sed -i "/_HTTPS_FRONTEND_/ s|_HTTPS_FRONTEND_ ||g" "${CFG_DIR}/haproxy.cfg"
  else
    log "INFO: No /certs/cert.pem found, disabling HTTPS frontends..."
    sed -i "/_HTTPS_FRONTEND_/ s|^|#|g" "${CFG_DIR}/haproxy.cfg"
  fi
fi

if [ "$HP_VERBOSE_START" -eq 1 ]; then
    log "INFO: Final ${CFG_DIR}/haproxy.cfg:"
    cat "${CFG_DIR}/haproxy.cfg"
fi

# ----------------------------------------------------------------------------
# Prepare FRP configuration
# ----------------------------------------------------------------------------
if [ ! -f "${CFG_DIR}/frps.toml" ]; then
  if [ "${HP_FRP_DISABLE_TLS}" != "true" ]; then
cat <<EOF >"${CFG_DIR}/frps.toml"
bindAddr = "${FRP_HOST}"
bindPort = ${FRP_PORT}
proxyBindAddr = "127.0.0.1"

transport.tls.force = true
transport.tls.certFile = "/certs/frp/server.crt"
transport.tls.keyFile = "/certs/frp/server.key"
transport.tls.trustedCaFile = "/certs/frp/ca.crt"

log.to = "${CFG_DIR}/frps.log"
log.level = "info"
log.maxDays = 3

maxPortsPerClient = 1
allowPorts = [
  { start = 23000, end = 23999 },
  { start = 24000, end = 24099 }
]

[[httpPlugins]]
addr = "127.0.0.1:8200"
path = "/frp_handler"
ops = ["Login"]
EOF
  else
cat <<EOF >"${CFG_DIR}/frps.toml"
bindAddr = "${FRP_HOST}"
bindPort = ${FRP_PORT}
proxyBindAddr = "127.0.0.1"

transport.tls.force = false

log.to = "${CFG_DIR}/frps.log"
log.level = "info"
log.maxDays = 3

maxPortsPerClient = 1
allowPorts = [
  { start = 23000, end = 23999 },
  { start = 24000, end = 24099 }
]

[[httpPlugins]]
addr = "127.0.0.1:8200"
path = "/frp_handler"
ops = ["Login"]
EOF
  fi
  log "INFO: FRP server configuration generated at ${CFG_DIR}/frps.toml."
  if [ "$HP_VERBOSE_START" -eq 1 ]; then
    log "INFO: Generated ${CFG_DIR}/frps.toml:"
    cat "${CFG_DIR}/frps.toml"
  fi
else
  log "INFO: ${CFG_DIR}/frps.toml already exists. Skipping FRP server configuration generation..."
fi

# ----------------------------------------------------------------------------
# Prepare FRP client configuration for Docker if /var/run/docker.sock is present
# ----------------------------------------------------------------------------
if [ -e "/var/run/docker.sock" ]; then
  LOCAL_FRP_HOST="$FRP_HOST"
  [ "$LOCAL_FRP_HOST" = "0.0.0.0" ] && LOCAL_FRP_HOST="127.0.0.1"
  if [ ! -f "${CFG_DIR}/frpc-docker.toml" ]; then
    log "INFO: Detected /var/run/docker.sock, generating ${CFG_DIR}/frpc-docker.toml configuration file..."
    if [ "${HP_FRP_DISABLE_TLS}" != "true" ]; then
cat <<EOF >"${CFG_DIR}/frpc-docker.toml"
serverAddr = "${LOCAL_FRP_HOST}"
serverPort = ${FRP_PORT}

transport.tls.enable = true
transport.tls.certFile = "/certs/frp/client.crt"
transport.tls.keyFile = "/certs/frp/client.key"
transport.tls.trustedCaFile = "/certs/frp/ca.crt"
transport.tls.serverName = "harp.nc"

metadatas.token = "${HP_SHARED_KEY}"

[[proxies]]
remotePort = 24000
type = "tcp"
name = "bundled-deploy-daemon"
[proxies.plugin]
type = "unix_domain_socket"
unixPath = "/var/run/docker.sock"
EOF
    else
cat <<EOF >"${CFG_DIR}/frpc-docker.toml"
serverAddr = "${LOCAL_FRP_HOST}"
serverPort = ${FRP_PORT}

transport.tls.enable = false

metadatas.token = "${HP_SHARED_KEY}"

[[proxies]]
remotePort = 24000
type = "tcp"
name = "bundled-deploy-daemon"
[proxies.plugin]
type = "unix_domain_socket"
unixPath = "/var/run/docker.sock"
EOF
    fi
    if [ "$HP_VERBOSE_START" -eq 1 ]; then
      log "INFO: Generated ${CFG_DIR}/frpc-docker.toml:"
      # The token is the shared key, so it is not printed.
      sed 's/^metadatas\.token = .*/metadatas.token = "[REDACTED]"/' "${CFG_DIR}/frpc-docker.toml"
    fi
  else
    log "INFO: ${CFG_DIR}/frpc-docker.toml already exists. Skipping generation..."
  fi
fi

log "INFO: Starting Python HaProxy Agent on 127.0.0.1:8200 and ${HP_SPOA_ADDRESS}..."
python3 /usr/local/bin/haproxy_agent.py &
AGENT_PID=$!

# Wait deterministically for the agent to be ready (HTTP) and for SPOA (TCP).
# Probe /heartbeat, not /info: /info can block on a K8s API reachability check.
log "INFO: Waiting for HaRP Agent HTTP (GET http://127.0.0.1:8200/heartbeat) to be ready..."
wait_for_http "http://127.0.0.1:8200/heartbeat" "$HP_WAIT_AGENT_HTTP" "$HP_WAIT_INTERVAL" "$AGENT_PID"

log "INFO: Waiting for SPOA port ${HP_SPOA_ADDRESS}..."
wait_for_tcp "$SPOA_HOST" "$SPOA_PORT" "$HP_WAIT_SPOA" "$HP_WAIT_INTERVAL" "$AGENT_PID"

log "INFO: Starting FRP server on ${HP_FRP_ADDRESS}..."
frps -c "${CFG_DIR}/frps.toml" &
FRPS_PID=$!

# Wait for FRP port to be listening before starting frpc
LOCAL_FRP_HOST="$FRP_HOST"
[ "$LOCAL_FRP_HOST" = "0.0.0.0" ] && LOCAL_FRP_HOST="127.0.0.1"
log "INFO: Waiting for FRP server port ${LOCAL_FRP_HOST}:${FRP_PORT}..."
wait_for_tcp "$LOCAL_FRP_HOST" "$FRP_PORT" "$HP_WAIT_FRP" "$HP_WAIT_INTERVAL" "$FRPS_PID"

FRPC_PID=""
if [ -e "/var/run/docker.sock" ]; then
  log "INFO: Starting FRP client for Docker Engine..."
  frpc -c "${CFG_DIR}/frpc-docker.toml" &
  FRPC_PID=$!
fi

log "INFO: Starting HAProxy..."
haproxy -f "${CFG_DIR}/haproxy.cfg" -W -db &
HAPROXY_PID=$!

# ----------------------------------------------------------------------------
# Supervision: the death of any critical process stops the container so the
# Docker restart policy (--restart unless-stopped) can revive it.
# ----------------------------------------------------------------------------
set +e

WATCHDOG_PID=""
if [ "$HP_WATCHDOG_ENABLED" = "true" ]; then
    (
        fails=0
        while :; do
            sleep "$HP_WATCHDOG_INTERVAL"
            if curl -fsS --noproxy '*' --max-time 5 http://127.0.0.1:8200/heartbeat >/dev/null 2>&1; then
                fails=0
            else
                fails=$((fails + 1))
                echo "WARNING: HaRP agent heartbeat failed (${fails}/${HP_WATCHDOG_FAILS})."
                if [ "$fails" -ge "$HP_WATCHDOG_FAILS" ]; then
                    echo "ERROR: HaRP agent is unresponsive, killing it so the container gets restarted."
                    kill -TERM "$AGENT_PID" 2>/dev/null
                    sleep 5
                    kill -9 "$AGENT_PID" 2>/dev/null
                    exit 1
                fi
            fi
        done
    ) &
    WATCHDOG_PID=$!
fi

# A trapped signal (e.g. the HUP reload above) interrupts `wait -n` with status > 128,
# so keep waiting until one of the supervised processes is actually gone. Look before every
# `wait -n` too: when a child dies of a signal such as SIGKILL or SIGSEGV, bash prints
# "Killed" (or similar) the next time it parses a line or a `$(...)` and drops the child
# from its job table, so `wait -n` would never return for it.
dead=""
while :; do
    for entry in "haproxy:$HAPROXY_PID" "agent:$AGENT_PID" "frps:$FRPS_PID" ${FRPC_PID:+"frpc:$FRPC_PID"} ${WATCHDOG_PID:+"watchdog:$WATCHDOG_PID"}; do
        kill -0 "${entry#*:}" 2>/dev/null || { dead="${entry%%:*}"; dead_pid="${entry#*:}"; break; }
    done
    [ -n "$dead" ] && break
    wait -n
done
[ -n "${WATCHDOG_PID:-}" ] && kill "$WATCHDOG_PID" 2>/dev/null
kill -TERM "$HAPROXY_PID" "$AGENT_PID" "$FRPS_PID" ${FRPC_PID:+"$FRPC_PID"} 2>/dev/null
# Take the exit status only after the others were told to stop: if bash lost track of the
# child (a trapped signal arrived while it was being reaped), this returns 127 once they
# are gone instead of blocking forever.
wait "$dead_pid" 2>/dev/null; rc=$?
echo "ERROR: HaRP process '${dead}' exited unexpectedly (status ${rc}), stopping the container."
wait ${WATCHDOG_PID:+"$WATCHDOG_PID"} "$HAPROXY_PID" "$AGENT_PID" "$FRPS_PID" ${FRPC_PID:+"$FRPC_PID"} 2>/dev/null
exit 1