#!/bin/sh
# Start the S3 simulator and pre-create the backup bucket.
#
# ⚠️ The server is s3proxy, not MinIO — see Dockerfile.minio's header for why
# (MinIO's images stopped being anonymously pullable from both Docker Hub and
# quay.io; celilo#1389). The hostname `minio.lab` and this file's name are
# deliberately unchanged.
#
# celilo's S3 provider never creates buckets (its initialize() only probes via
# ListObjectsV2), so the bucket must exist before `storage add s3` verifies or
# `backup --storage` uploads.
set -e

# Route the customer's public prefix via the ISP edge (fw-ext), like every
# other host on internet-external. Docker's default bridge gateway has no path
# across networks, so without this a reply to the customer's WAN address is
# dropped and `backup --storage` hangs. fw-ext is per-test, so this is
# expected to fail while shared infra runs alone — hence the tolerance.
# (`busybox ip` because the s3proxy image ships no iproute2.)
busybox ip route del default 2>/dev/null || true
busybox ip route add default via 100.64.0.1 2>/dev/null || true

# Pre-create the bucket. Under the jclouds filesystem backend a bucket IS a
# directory under JCLOUDS_FILESYSTEM_BASEDIR, so this needs no running server,
# no credentials and no client binary — which is the entire reason the
# `minio/mc` image is gone. Measured 2026-09-24: with only this mkdir,
# ListObjectsV2 on the bucket answers 200 and an object PUT/GET round-trips.
#
# It also means the bucket is ready BEFORE the server accepts a connection,
# so the old "wait up to 30s for the admin alias, then mc mb" loop is gone.
# There is no readiness race left to lose.
mkdir -p "${JCLOUDS_FILESYSTEM_BASEDIR}/${MINIO_BUCKET}"
echo "minio-startup: bucket '${MINIO_BUCKET}' ready at ${JCLOUDS_FILESYSTEM_BASEDIR}/${MINIO_BUCKET}"

# Serve the S3 API on :80 so the management box reaches it over the SAME
# proven HTTP egress path as the other public sims (apt-repo, npm-registry):
# fw-ext's Squid-bypass exception is scoped to dport 80/443 -> 100.64.0.0/24, so
# plain HTTP to minio.lab:80 forwards straight through (no TLS bump, no cert,
# no nonstandard-port filtering). S3PROXY_ENDPOINT pins the listen address.
#
# exec so the server becomes PID 1's child directly and signals propagate; the
# old script backgrounded the server and `wait`ed on it, which was only needed
# because the bucket step ran after startup.
exec /opt/s3proxy/run-docker-container.sh