#!/bin/sh

# Keep the historical service account so package downgrades remain possible,
# but current OPNsense runtime executes RustProxy as root (see rc.d script).
if ! /usr/sbin/pw groupshow rustproxy >/dev/null 2>&1; then
    /usr/sbin/pw groupadd rustproxy
fi

if ! /usr/sbin/pw usershow rustproxy >/dev/null 2>&1; then
    /usr/sbin/pw useradd rustproxy -g rustproxy -c "RustProxy daemon" -d /var/db/rustproxy -s /usr/sbin/nologin
fi

/usr/bin/install -d -o root -g wheel -m 0700 /var/db/rustproxy
/usr/sbin/chown -R root:wheel /var/db/rustproxy
/bin/chmod 0700 /var/db/rustproxy
/usr/bin/install -d -o root -g wheel -m 0750 /var/log/rustproxy
/usr/bin/install -d -o root -g wheel -m 0750 /var/run/rustproxy
/usr/bin/install -d -o root -g wheel -m 0755 /usr/local/etc/rustproxy

# configd discovers actions only on startup/reload.  A direct `pkg add` must
# therefore refresh configd before the MVC service controller can call them.
/usr/sbin/service configd restart >/dev/null 2>&1 || true
/usr/local/sbin/pluginctl -cq cache_flush >/dev/null 2>&1 || true
/usr/local/sbin/configctl template reload OPNsense/RustProxy >/dev/null 2>&1 || true

exit 0