#!/bin/bash
set -eou pipefail

# If production.{cert,key}.pem exists, prefer them. This allows
# user customization of the certificates that FastAPI uses.
# Otherwise, fallback to localhost.{cert,key}.pem, generated by `ca`.

CERT=/data/production.cert.pem
KEY=/data/production.key.pem

DEST_CERT=/etc/ssl/certs/web.cert.pem
DEST_KEY=/etc/ssl/private/web.key.pem

if [ -f "$CERT" ]; then
    cp -vf "$CERT" "$DEST_CERT"
    cp -vf "$KEY" "$DEST_KEY"
else
    cat /data/localhost.cert.pem /data/root_ca.crt > "$DEST_CERT"
    cp -vf /data/localhost.key.pem "$DEST_KEY"
fi

cp -vf /docker/config/nginx.conf /etc/nginx/nginx.conf

exec "$@"