#!/bin/bash
# Packages before 0.1.4 shipped /etc/wireshield/wireshield.env with an empty or
# unsubstituted HNE_VPS_BOOTSTRAP_KEY. That file is a conffile, so upgrades keep
# it, and the unit reads it after the vendor defaults - meaning the empty value
# would win and the server could never enroll. Neutralize the dead line here.
set -euo pipefail

env_file=/etc/wireshield/wireshield.env
empty_key='^[[:space:]]*HNE_VPS_BOOTSTRAP_KEY[[:space:]]*=[[:space:]]*(YOUR_WIRESHIELD_BOOTSTRAP_KEY)?[[:space:]]*$'

[[ -f $env_file ]] || exit 0

if grep -qE "$empty_key" "$env_file"; then
    sed -i -E "s|$empty_key|# HNE_VPS_BOOTSTRAP_KEY= (disabled: empty, using /usr/lib/wireshield/vendor.env)|" "$env_file"
fi

chmod 600 "$env_file"
