#!/bin/sh
# Fail a coturn start before an example placeholder becomes a public credential.
set -eu

config=${TURN_CONFIG:-/etc/turnserver.conf}

test -r "$config" || { echo "coturn preflight: cannot read $config" >&2; exit 1; }
if grep -q 'REQUIRED_' "$config"; then
  echo "coturn preflight: unresolved REQUIRED_ placeholder in $config" >&2
  exit 1
fi

secret=$(sed -n 's/^static-auth-secret=//p' "$config")
case "$secret" in
  *[!0-9A-Fa-f]*|'')
    echo "coturn preflight: static-auth-secret must be hexadecimal" >&2
    exit 1
    ;;
esac
test "${#secret}" -ge 64 || {
  echo "coturn preflight: static-auth-secret must contain at least 64 hex characters" >&2
  exit 1
}

for path in /etc/coturn/certs/turn.fullchain.pem /etc/coturn/certs/turn.privkey.pem; do
  test -r "$path" || { echo "coturn preflight: cannot read $path" >&2; exit 1; }
done

exit 0