#!/command/with-contenv sh
# Personal dashboard serve (:9120) for cathou — same machinery as the
# main dashboard service, but runs the command directly so its OWN
# with-contenv shebang can't wipe our env (a second with-contenv reset
# would drop the port + auth variables). Supervised by s6: restarts on crash.
export HERMES_DASHBOARD_PORT=9120
export HERMES_DASHBOARD_BASIC_AUTH_USERNAME=cathou
export HERMES_DASHBOARD_BASIC_AUTH_PASSWORD="${CATHOU_SERVE_PASSWORD:-}"
export HERMES_DASHBOARD_BASIC_AUTH_SECRET="${CATHOU_SERVE_SECRET:-}"
export HOME=/opt/data
cd /opt/data
# shellcheck disable=SC1091
. /opt/hermes/.venv/bin/activate
# Fail-closed: missing password => provider won't register => serve fails
# => s6 crash-loop surfaces it, never a silent unauthenticated bind.
[ "$(id -u)" = 0 ] || exec hermes dashboard --host 0.0.0.0 --port 9120 --no-open
exec s6-setuidgid hermes hermes dashboard --host 0.0.0.0 --port 9120 --no-open