#!/bin/sh
set -eu

# Load OPERATOR_JWT from mounted env file if present and not already set
if [ -z "${OPERATOR_JWT:-}" ] && [ -f /etc/nats/operator.env ]; then
    # shellcheck disable=SC1091
    . /etc/nats/operator.env
fi

# Validate required variables
: "${OPERATOR_JWT:?OPERATOR_JWT is required. Mount /etc/nats/operator.env or pass -e OPERATOR_JWT=<jwt>}"
: "${SYS_ACCOUNT_KEY:?SYS_ACCOUNT_KEY is required. Get with: nsc describe account --name SYS -R | grep 'Account ID'}"

# Render config using busybox sed (no extra packages needed).
# Single-quote the pattern so \$ is literal; interpolate values via double-quote concatenation.
# JWT/NKey values are base64url + dots — safe as sed replacement (no | or & chars).
sed \
    -e 's|\$OPERATOR_JWT|'"${OPERATOR_JWT}"'|g' \
    -e 's|\$SYS_ACCOUNT_KEY|'"${SYS_ACCOUNT_KEY}"'|g' \
    /etc/nats/nats-server.conf.template > /tmp/nats-server.conf

echo "[entrypoint] Config rendered. Starting nats-server..."
exec nats-server -c /tmp/nats-server.conf