#!/bin/sh
set -e

# The relay reads one private JSON file holding allowed origins and per-room
# tokens. Build it from the Docker secrets at startup so tokens never live in
# the recipe or the env file. Writes to /tmp, readable only by the node user.
umask 077
node - > /tmp/rooms.json <<'JS'
const fs = require('node:fs');
const secret = name => fs.readFileSync('/run/secrets/' + name, 'utf8').trim();
const origins = [process.env.DOMAIN, process.env.STT_DOMAIN]
  .filter(Boolean).map(host => 'https://' + host)
  .concat((process.env.RELAY_EXTRA_ORIGINS || '').split(',').map(s => s.trim()).filter(Boolean));
const config = {
  origins: [...new Set(origins)],
  rooms: {
    source: {read: secret('src_read'), write: secret('src_write')},
    output: {read: secret('out_read'), write: secret('out_write')},
  },
  // Every client arrives via Traefik, so they all share one source IP; the
  // upstream default of 128 sockets per IP would cap the whole audience.
  limits: {perIp: Number(process.env.RELAY_PER_IP || 512)},
};
process.stdout.write(JSON.stringify(config));
JS

export CAPTION_RELAY_CONFIG=/tmp/rooms.json
exec node server.cjs