#!/bin/sh
# Renders homeserver.yaml from the template using the runtime env (so
# MATRIX_JWT_SECRET / DB password / registration_shared_secret come from the
# service's .env file, never get baked into the image), then hands off to the
# upstream Synapse image's own entrypoint.
set -eu

mkdir -p /data
envsubst \
  '${MATRIX_SERVER_NAME} ${MATRIX_PUBLIC_BASEURL} ${MATRIX_DB_USER} ${MATRIX_DB_PASSWORD} ${MATRIX_DB_NAME} ${MATRIX_DB_HOST} ${MATRIX_DB_PORT} ${MATRIX_JWT_SECRET} ${MATRIX_REGISTRATION_SHARED_SECRET}' \
  < /synapse/homeserver.yaml.tmpl > /data/homeserver.yaml

# start.py's `run` mode (the implicit default we hit below) gosu's straight
# into uid 991 with no chown — it only chowns /data in its `generate` /
# `migrate_config` modes, which we skip by providing our own pre-rendered
# config. Without this, 991 can't write its signing key on first boot.
chown -R 991:991 /data

export SYNAPSE_CONFIG_PATH=/data/homeserver.yaml
exec /start.py "$@"