#!/bin/sh
set -eu

cd "$(dirname "$0")/.."

service=deploy/systemd/system/jwebot-extension-host@.service
socket=deploy/systemd/system/jwebot-extension-host@.socket

test -f "$service"
test -f "$socket"

for setting in \
  'User=jwebot-ext' \
  'Group=jwebot-ext' \
  'Environment=PYTHONDONTWRITEBYTECODE=1' \
  'ConditionPathExists=/etc/jwebot-extension-host/allowed_signers' \
  'ExecStart=/opt/jwebot-extension-host/venv/bin/python -I -m jwebot_extension_host --release-dir /var/lib/jwebot-extensions/%i/current --allowed-signers /etc/jwebot-extension-host/allowed_signers' \
  'StandardInput=socket' \
  'StandardOutput=socket' \
  'NoNewPrivileges=true' \
  'CapabilityBoundingSet=' \
  'PrivateNetwork=true' \
  'ProtectSystem=strict' \
  'ProtectHome=true' \
  'MemoryDenyWriteExecute=true' \
  'RestrictAddressFamilies=AF_UNIX' \
  'RuntimeMaxSec=12s' \
  'MemoryMax=128M' \
  'TasksMax=16' \
  'LimitCORE=0'
do
  grep -Fxq "$setting" "$service"
done

for setting in \
  'SocketUser=jwebot' \
  'SocketGroup=jwebot' \
  'SocketMode=0600' \
  'RemoveOnStop=true'
do
  grep -Fxq "$setting" "$socket"
done

if [ "${JWEBOT_VERIFY_SYSTEMD:-0}" = 1 ] &&
   command -v systemd-analyze >/dev/null 2>&1
then
  systemd-analyze verify "$service" "$socket"
fi