set -euo pipefail
APP=/opt/infisical
cd "$APP"
WSLIP=$(ip -4 addr show eth0 | awk '/inet /{sub(/\/.*$/,"",$2); print $2; exit}')
echo "wsl_ip=$WSLIP"
python3 - "$WSLIP" <<'PY'
from pathlib import Path
import re, sys
ip=sys.argv[1]
p=Path('/opt/infisical/docker-compose.prod.yml')
s=p.read_text()
# replace any 8088:8080 mapping forms with explicit WSL eth0 bind
s=re.sub(r'-\s*"?(?:[0-9.]+:)?8088:8080"?', f'- "{ip}:8088:8080"', s)
p.write_text(s)
PY
grep -A4 'ports:' docker-compose.prod.yml || true
docker compose -f docker-compose.prod.yml up -d --force-recreate infisical
echo '== wait health via eth0 =='
for i in $(seq 1 40); do
  if curl -fsS --max-time 5 "http://$WSLIP:8088/api/status"; then echo; echo "eth0_health_ok_try=$i"; break; fi
  sleep 3
  if [ "$i" = 40 ]; then docker compose -f docker-compose.prod.yml ps; docker logs --tail 80 infisical-app; exit 1; fi
done
echo '== listeners =='
ss -ltnp | grep 8088 || true