#!/bin/sh
set -e

case "$1" in
    configure)
        # Create service account
        if ! getent group meshbay >/dev/null 2>&1; then
            addgroup --system meshbay
        fi
        if ! getent passwd meshbay >/dev/null 2>&1; then
            adduser --system --ingroup meshbay --home /var/lib/meshbay \
                    --no-create-home --disabled-password \
                    --gecos "MeshBay service account" meshbay
        fi

        # Create data and log directories
        install -d -o meshbay -g meshbay -m 750 /var/lib/meshbay/hub
        install -d -o meshbay -g meshbay -m 750 /var/log/meshbay

        # Create config directory (files are placed by the admin, not by us —
        # a shipped hub.toml would be overwritten on upgrade, and a shipped
        # secret would be run in production). The example lands in
        # /etc/meshbay/hub.toml.example instead.
        # 750, not 755: this directory holds the hub's private key and its
        # database password. The file modes protect the contents, but a
        # world-listable config directory tells anyone with a shell what a
        # hub keeps and where. The service reads it by group.
        install -d -o root -g meshbay -m 750 /etc/meshbay

        # Reload systemd if available
        if [ -d /run/systemd/system ]; then
            systemctl daemon-reload || true
        fi
        ;;
esac

#DEBHELPER#