#!/bin/sh
set -eu

trusted_proxy_cidrs=${TRUSTED_PROXY_CIDRS:-${CADDY_SOURCE_CIDR:-}}

if [ -z "$trusted_proxy_cidrs" ]; then
    echo "TRUSTED_PROXY_CIDRS is required" >&2
    exit 1
fi

: > /tmp/trusted-proxy-allow.conf
for trusted_proxy_cidr in $(printf '%s' "$trusted_proxy_cidrs" | tr ',' ' '); do
    case "$trusted_proxy_cidr" in
        *[!0-9A-Fa-f:./]*)
            echo "Invalid trusted proxy CIDR: $trusted_proxy_cidr" >&2
            exit 2
            ;;
    esac
    printf 'allow %s;\n' "$trusted_proxy_cidr" >> /tmp/trusted-proxy-allow.conf
done

if [ ! -s /tmp/trusted-proxy-allow.conf ]; then
    echo "TRUSTED_PROXY_CIDRS must contain at least one CIDR" >&2
    exit 2
fi

cp /etc/image/default.conf.template /tmp/nginx.conf

exec nginx -c /tmp/nginx.conf -g 'daemon off;'