set -euo pipefail
APP=/opt/infisical
cd "$APP"
echo '== patch bind/site url for IT15 =='
python3 - <<'PY'
from pathlib import Path
compose=Path('/opt/infisical/docker-compose.prod.yml')
s=compose.read_text()
s=s.replace('"192.168.1.40:8088:8080"','"8088:8080"')
s=s.replace('192.168.1.40:8088:8080','"8088:8080"')
s=s.replace('"192.168.188.40:8088:8080"','"8088:8080"')
s=s.replace('192.168.188.40:8088:8080','"8088:8080"')
compose.write_text(s)
env=Path('/opt/infisical/.env')
lines=env.read_text().splitlines()
out=[]
seen=False
for line in lines:
    if line.startswith('SITE_URL='):
        out.append('SITE_URL=http://192.168.1.121:8088')
        seen=True
    else:
        out.append(line)
if not seen:
    out.append('SITE_URL=http://192.168.1.121:8088')
env.write_text('\n'.join(out)+'\n')
PY
chmod 600 .env
echo '== sanitized config =='
grep -E '^(SITE_URL|POSTGRES_USER|POSTGRES_DB|DB_CONNECTION_URI|REDIS_URL)=' .env | sed -E 's#(://[^:]+:)[^@]+#\1***#;s#(REDIS_URL=redis://[^:]*:).*#\1***#' || true
grep -A4 'ports:' docker-compose.prod.yml || true
echo '== restart stack =='
docker compose -f docker-compose.prod.yml up -d
echo '== wait health =='
for i in $(seq 1 60); do
  if curl -fsS --max-time 5 http://127.0.0.1:8088/api/status; then echo; echo "health_ok_try=$i"; break; fi
  sleep 5
  if [ "$i" = 60 ]; then
    echo 'health_failed'
    docker compose -f docker-compose.prod.yml ps || true
    docker logs --tail 160 infisical-app 2>/dev/null || docker logs --tail 160 infisical-backend 2>/dev/null || true
    exit 1
  fi
done
echo '== table count =='
set -a; . ./.env; set +a
docker exec -e PGPASSWORD="$POSTGRES_PASSWORD" infisical-db psql -h 127.0.0.1 -U "$POSTGRES_USER" -d "$POSTGRES_DB" -tAc "select count(*) from information_schema.tables where table_schema='public';" | sed 's/^/public_table_count=/'
echo '== ps =='
docker compose -f docker-compose.prod.yml ps