#!/usr/bin/execlineb -P

# openvox-server ships two directory declarations that s6 has no equivalent
# for, and the daemon runs as "puppet", so it cannot create either itself:
#
#   /usr/lib/tmpfiles.d/puppetserver.conf
#       d /run/puppetlabs            0755 root   root
#       d /run/puppetlabs/puppetserver 0755 puppet puppet
#   scripts/install.sh (postinst)
#       chown puppet:puppet /var/log/puppetlabs/puppetserver ; chmod 700
#
# /run is a tmpfs, so the tmpfiles entries are gone after every boot -- and
# /var/log/puppetlabs is deleted by aos-img's cleanup.sh, so it is gone in
# every image built from this package. Without the log directory the JVM dies
# during init with "(EACCES) Permission denied - /var/log/puppetlabs" while
# priming the JRuby pool, over and over until .permafail gives up (observed
# 2026-09-22 in the first aos/resolute/puppet8 container).
#
# run-script-daemon only creates /run/$(basename $DAEMON) = /run/puppetserver,
# which is not a path openvox-server uses at all.
if { mkdir -p /run/puppetlabs/puppetserver }
if { chmod 0755 /run/puppetlabs }
if { chown puppet:puppet /run/puppetlabs/puppetserver }
if { chmod 0755 /run/puppetlabs/puppetserver }
# Likewise /etc/puppetlabs/puppet/ssl: install.sh creates it (0770
# puppet:puppet), and the image build removes it again. Without it the JRuby
# init fails at "File[/etc/puppetlabs/puppet/ssl]: change from 'absent' to
# 'directory'".
#
# An EMPTY ssl directory is not the same as a baked-in CA: openvox-server
# generates its own CA on the first start. Anyone restoring a CA backup must
# do it before that first start.
#
# CORRECTION (2026-09-22): this comment used to claim that aos-img's cleanup.sh
# deletes "it", meaning the CA -- it did not. The CA does not live under
# puppet/ssl at all but in /etc/puppetlabs/puppetserver/ca, and that directory
# survived into the published image b3, ca_key.pem included. Since then
# cleanup.sh removes both and refuses to finish a build that still has either,
# and the aos-img puppet8 layer keeps this unit masked while it installs, so
# the server never starts during the build in the first place. Do not trust a
# comment about what some other repository deletes -- that is exactly how this
# one went unnoticed.
if { install -d -o puppet -g puppet -m 0770 /etc/puppetlabs/puppet/ssl }
if { mkdir -p /var/log/puppetlabs/puppetserver }
if { chmod 0755 /var/log/puppetlabs }
if { chown puppet:puppet /var/log/puppetlabs/puppetserver }
if { chmod 0700 /var/log/puppetlabs/puppetserver }
run-script-daemon puppetserver
