#!/bin/sh
set -eu

# XFF_HMAC_KEY keys the HMAC that turns a visitor's IP into the X-Client-Id this
# proxy passes downstream. Nobody picks its value, nothing outside this container
# ever needs to know it, and no two deployments need the same one — so an unset
# key is generated here rather than demanded from a .env file. Absent, the
# feature would switch itself off and every visitor downstream would share one
# rate-limit bucket, which is the one state nobody wants and the easiest to end
# up in by forgetting a line.
#
# What a fresh key per container start costs: the downstream rate-limit buckets
# reset — invisible against a one-minute window — and pseudonyms seen before and
# after cannot be linked, which is the property the key exists for rather than a
# loss. It costs nothing else: the key is never stored, compared or shared.
#
# base64, because that is what HAProxy's hmac() converter decodes. Hex would be
# accepted here and silently decoded as base64 into something else — valid as a
# key, but it would quietly break the guarantee that a malformed key stops the
# container at configuration parsing instead of degrading.
#
# Set it explicitly and this does nothing: an operator who wants a stable
# pseudonym across restarts, or the same one on two proxies, still just passes
# the variable in.
if [ -z "${XFF_HMAC_KEY:-}" ]; then
    XFF_HMAC_KEY="$(openssl rand -base64 32)"
    export XFF_HMAC_KEY
    echo "XFF_HMAC_KEY was not set — generated one for this container." >&2
fi

exec /opt/bitnami/haproxy/sbin/haproxy "$@"