#!/bin/sh
set -e

# Re-align the Postgres role password with POSTGRES_PASSWORD on every boot.
# Connects via the local unix socket (pg_hba "trust"), so it works even when
# TCP password auth is currently broken. Runs in the background so it does not
# block server startup, but retries until it succeeds.
sync_credentials() {
  until pg_isready -q -h /var/run/postgresql; do
    sleep 0.5
  done

  USER="${POSTGRES_USER:-postgres}"
  PASS="${POSTGRES_PASSWORD:-postgres}"

  for i in $(seq 1 30); do
    if psql -v ON_ERROR_STOP=1 -h /var/run/postgresql -U postgres -d postgres <<-EOSQL 2>/dev/null
      DO \$\$
      BEGIN
        IF NOT EXISTS (SELECT FROM pg_catalog.pg_roles WHERE rolname = '$USER') THEN
          CREATE ROLE "$USER" WITH LOGIN SUPERUSER PASSWORD '$PASS';
        END IF;
        ALTER ROLE "$USER" WITH LOGIN SUPERUSER PASSWORD '$PASS';
      END
      \$\$;
EOSQL
    then
      echo "[entrypoint] Synchronized '$USER' role password." >&2
      return 0
    fi
    echo "[entrypoint] Credential sync attempt $i failed, retrying..." >&2
    sleep 1
  done

  echo "[entrypoint] WARNING: could not synchronize credentials." >&2
}

sync_credentials &

exec docker-entrypoint.sh "$@"