#!/bin/bash

tail -F /var/log/squid/access.log 2>/dev/null &
tail -F /var/log/squid/error.log 2>/dev/null &
tail -F /var/log/squid/store.log 2>/dev/null &
tail -F /var/log/squid/cache.log 2>/dev/null &

ALLOW_PRIVATE_CONF=/etc/squid/dify_allow_private.conf

write_optional_private_allowlist() {
    local env_name="$1"
    local acl_name="$2"
    local acl_type="$3"
    local raw_values="${!env_name:-}"
    local -a tokens=()

    raw_values="${raw_values//,/ }"
    raw_values="${raw_values//$'\n'/ }"
    raw_values="${raw_values//$'\r'/ }"

    if [ -z "${raw_values//[[:space:]]/}" ]; then
        return
    fi

    read -r -a tokens <<< "$raw_values"

    printf 'acl %s %s' "$acl_name" "$acl_type" >> "$ALLOW_PRIVATE_CONF"
    for value in "${tokens[@]}"; do
        [ -z "${value//[[:space:]]/}" ] && continue
        printf ' %s' "$value" >> "$ALLOW_PRIVATE_CONF"
    done
    printf '\nhttp_access allow client_localnet %s\n' "$acl_name" >> "$ALLOW_PRIVATE_CONF"
}

{
    echo "# Generated by docker-agent-entrypoint.sh."
    echo "# Allows selected private targets before the default private-network deny rule."
} > "$ALLOW_PRIVATE_CONF"
write_optional_private_allowlist "SSRF_PROXY_ALLOW_PRIVATE_IPS" "dify_allowed_private_networks" "dst"
write_optional_private_allowlist "SSRF_PROXY_ALLOW_PRIVATE_DOMAINS" "dify_allowed_private_domains" "dstdomain"

expand_env() {
    awk '{
        while(match($0, /\${[A-Za-z_][A-Za-z_0-9]*}/)) {
            var = substr($0, RSTART+2, RLENGTH-3)
            val = ENVIRON[var]
            $0 = substr($0, 1, RSTART-1) val substr($0, RSTART+RLENGTH)
        }
        print
    }' "$1"
}

echo "[ENTRYPOINT] replacing environment variables in the templates"
expand_env /etc/squid/squid.conf.template > /etc/squid/squid.conf
expand_env /etc/squid/dify_common.conf.template > /etc/squid/dify_common.conf

/usr/sbin/squid -Nz
echo "[ENTRYPOINT] starting squid"
/usr/sbin/squid -f /etc/squid/squid.conf -NYC 1