#!/bin/sh
# Apply the opt-in Draco mesh-SSH server state from /etc/draco/mesh-ssh.conf (default OFF).
#
# Called by draco-mesh-ssh.service, which sources mesh-ssh.conf (ENABLE/PRINCIPALS/USERS) and
# mesh.env (DRACO_CTRL) as EnvironmentFiles. Idempotent either way: enabling twice is a no-op,
# and when OFF we only touch sshd if the trust was previously installed (no needless reload).
set -e

ENABLE="${ENABLE:-no}"
PRINCIPALS="${PRINCIPALS:-draco}"
USERS="${USERS:-root}"
export DRACO_CTRL="${DRACO_CTRL:-https://ctrl.draco.ursamobile.com}"

case "$ENABLE" in
    yes|true|1|on|YES|Yes)
        exec draco-connect mesh ssh-server enable --principals "$PRINCIPALS" --users "$USERS"
        ;;
    *)
        # OFF: only run disable if the trust was actually installed, so a never-enabled box does
        # not reload sshd on every boot for nothing.
        if [ -e /etc/ssh/sshd_config.d/60-draco-mesh.conf ]; then
            exec draco-connect mesh ssh-server disable
        fi
        exit 0
        ;;
esac
