#!/bin/bash
set -euo pipefail
# Galene listens HTTPS by default; behind Caddy we serve plain HTTP on :8443
# with -insecure (TLS terminated at Caddy).
# Static assets stay in the image (/opt/galene/static); the ./data volume must
# not shadow them — pass -static explicitly.
DATA="${GALENE_DATA:-/data}"
STATIC="${GALENE_STATIC:-/opt/galene/static}"
# Host/UDP map: VeciGate WAN → koopa 10000-10099/udp (see configs/ports.md).
UDP_RANGE="${GALENE_UDP_RANGE:-10000-10099}"
mkdir -p "$DATA/groups" "$DATA/recordings" "$DATA/data"
cd "$DATA"
exec /usr/local/bin/galene \
  -http "0.0.0.0:8443" \
  -insecure \
  -static "$STATIC" \
  -udp-range "$UDP_RANGE" \
  -data "$DATA/data" \
  -groups "$DATA/groups" \
  -recordings "$DATA/recordings" \
  "$@"