#!/bin/sh

# PROVIDE: pomerium
# REQUIRE: LOGIN
# KEYWORD: shutdown

# Add the following lines to /etc/rc.conf to enable pomerium
# pomerium_enable="YES"
#
# pomerium_enable (bool): 	Set to YES to enable pomerium
#				Default: NO
# pomerium_conf (str):		pomerium configuration file
#				Default: /usr/local/etc/pomerium/config.yaml
# pomerium_user (str):		pomerium daemon user
#				Default: www
# pomerium_cert_file (str):	Path to pomerium certificate file.
#				Optional: pomerium uses a self-signed certificate
#				if not set and autocert is not configured.
#				Default: ""
# pomerium_cert_key_file (str):	Path to pomerium certificate private key file.
#				Default: ""

. /etc/rc.subr

name=pomerium
rcvar=pomerium_enable
load_rc_config ${name}

: ${pomerium_enable:="NO"}
: ${pomerium_user:="www"}
: ${pomerium_flags:=""}
: ${pomerium_conf:="/usr/local/etc/pomerium/config.yaml"}
: ${pomerium_options:="--config=${pomerium_conf}"}
: ${pomerium_cert_file:=""}
: ${pomerium_cert_key_file:=""}

pidfile="/var/run/pomerium/${name}.pid"
procname="/usr/local/libexec/pomerium"
command=/usr/sbin/daemon
command_args="-c -p ${pidfile} -T ${name} ${procname} ${pomerium_options}"
start_precmd="pomerium_precmd"

pomerium_precmd()
{
	install -d -o ${pomerium_user} /var/run/pomerium/
	install -d -o ${pomerium_user} -m 750 /var/db/${name}
	install -o ${pomerium_user} /dev/null ${pidfile}
	export HOME=/var/db/${name}
	[ -n "${pomerium_cert_file}" ] && export CERTIFICATE_FILE="${pomerium_cert_file}"
	[ -n "${pomerium_cert_key_file}" ] && export CERTIFICATE_KEY_FILE="${pomerium_cert_key_file}"
}

run_rc_command "$1"
