#!/bin/sh
set +x
set -eu

if [ -z "${SPINDLE_SIGNING_KEY_PEM:-}" ]; then
  echo 'mill: SPINDLE_SIGNING_KEY_PEM is required' >&2
  exit 1
fi

# Railway mounts /data as root-owned; leave existing contents untouched.
chown spindle:spindle /data

umask 077
printf '%s\n' "$SPINDLE_SIGNING_KEY_PEM" > /run/spindle/key.pem
chmod 600 /run/spindle/key.pem
chown spindle:spindle /run/spindle/key.pem
unset SPINDLE_SIGNING_KEY_PEM
export SPINDLE_SERVER_KEY_PATH=/run/spindle/key.pem

exec setpriv --reuid=spindle --regid=spindle --init-groups -- spindle "$@"