#!/bin/sh
# Creates nginx/.htpasswd for HTTP basic auth.
# Usage: ./set-password.sh <user> [password]    (prompts for the password if omitted)
set -eu

user="${1:?usage: $0 <user> [password]}"
case "$user" in *:*) echo "user name must not contain ':'" >&2; exit 1 ;; esac

if [ $# -ge 2 ]; then
    hash=$(openssl passwd -apr1 "$2")
else
    hash=$(openssl passwd -apr1)
fi

file="$(dirname "$0")/nginx/.htpasswd"
[ -d "$file" ] && rmdir "$file"   # docker creates a directory if the file was missing on first start
umask 077
printf '%s:%s\n' "$user" "$hash" > "$file"
chmod 644 "$file"                 # nginx workers must be able to read it
echo "Wrote $file for user '$user'. Run 'docker compose restart' if the container is already running."