#!/bin/sh
# Generated by the mesh. Do not edit: module supabase writes this file and replaces it at every push.
#
# Two things logflare 1.4.0 does not do for itself, done here before it starts; either failing
# stops the start, with the reason as the last line of this container's log.
#
# 1. The API key never travels in a URL. logflare prints the whole URL of every request that fails,
# query string included, in the error report Plug.Cowboy writes ("Request: POST
# /api/logs?source_name=...&api_key=..."). That is an error, so no log level hides it while errors
# are logged at all (novox/hq issue 268). logflare reads the key from the x-api-key header as well,
# and the mesh's caller, vector, sends it there; this refuses to start logflare while the vector
# config it is given still passes the key in a URL: an analytics that does not start says why
# here, and one that leaks says nothing.
#
# 2. Its database says what its environment says. logflare copies LOGFLARE_API_KEY into its default
# user and POSTGRES_BACKEND_URL into every source's backend once, when it creates them, and never
# again; reconcile.exs makes both copies match the environment through logflare's own code, after
# its migrations and before it starts. That is what lets the mesh rotate the key by starting
# logflare again, and what moves the sources' backend when the database's address or password
# changes.
set -e
conf=/run/logflare/vector.yml
if [ ! -r "$conf" ]; then
  echo "analytics: $conf is not there to check, so whether the API key travels in a URL is unknown; not starting (novox/hq issue 268)" >&2
  exit 1
fi
if grep -v '^[[:space:]]*#' "$conf" | grep -q 'api_key='; then
  echo "analytics: $conf passes the API key in a URL, and logflare prints a failed request's URL; not starting (novox/hq issue 268)" >&2
  exit 1
fi
reconcile=/run/logflare/reconcile.exs
if [ ! -r "$reconcile" ]; then
  echo "analytics: $reconcile is not there, so whether logflare's stored key and backends match its environment is unknown; not starting" >&2
  exit 1
fi
cd /opt/app/rel/logflare/bin
# The tables reconcile.exs reads exist only once the migrations have run; run.sh runs them again,
# which finds nothing left to do.
./logflare eval Logflare.Release.migrate
./logflare eval 'Code.eval_file("/run/logflare/reconcile.exs")'
exec sh run.sh