run

#!/bin/bash
set -euo pipefail

SYSLOG_SOCKET=${SYSLOG_SOCKET:-/dev/null}

HAPROXY_SERVICE="/marathon-lb/service/haproxy"
mkdir -p $HAPROXY_SERVICE/env

if [ -n "${PORTS-}" ]; then
  echo $PORTS > $HAPROXY_SERVICE/env/PORTS
else
  echo 'Define $PORTS with a comma-separated list of ports to which HAProxy binds' >&2
  exit 1
fi

# Find the --ssl-certs arg if one was provided,
# get the certs and remove them and the arg from the list
# of positional parameters so we don't duplicate them
# further down when we pass $@ to marathon_lb.py
declare -i ssl_certs_pos=0
for ((i=1; i<=$#; i++)); do
  if [ ${!i} = '--ssl-certs' ]; then
    ssl_certs_pos=$(($i+1))
    break
  fi
done
if [ $ssl_certs_pos -gt 0 ]; then
  SSL_CERTS=${!ssl_certs_pos}
  set -- "${@:1:$(($ssl_certs_pos-2))}" "${@:$(($ssl_certs_pos+1))}"
  [ -n "${HAPROXY_SSL_CERT-}" ] && SSL_CERTS+=",/etc/ssl/cert.pem"
else
  SSL_CERTS="/etc/ssl/cert.pem"
fi

if [ -n "${HAPROXY_SSL_CERT-}" ]; then
  # if provided via environment variable, use it.
  echo -e "$HAPROXY_SSL_CERT" > /etc/ssl/cert.pem

  # if additional certs were provided as $HAPROXY_SSL_CERT0 .. 100
  for i in {0..100}; do
    certenv="HAPROXY_SSL_CERT$i"
    if [ -n "${!certenv-}" ]; then
      certfile="/etc/ssl/cert$i.pem"
      echo -e "${!certenv}" > $certfile
      SSL_CERTS+=",$certfile"
    fi
  done
elif [ $ssl_certs_pos -eq 0 ]; then  # if --ssl-certs wasn't passed as arg to this script
  # if no environment variable or command line argument is provided,
  # create self-signed ssl certificate
  openssl genrsa -out /tmp/server-key.pem 2048
  openssl req -new -key /tmp/server-key.pem -out /tmp/server-csr.pem -subj /CN=*/
  openssl x509 -req -in /tmp/server-csr.pem -out /tmp/server-cert.pem -signkey /tmp/server-key.pem -days 3650
  cat /tmp/server-cert.pem /tmp/server-key.pem > /etc/ssl/cert.pem
  rm /tmp/server-*.pem
fi

if [ -n "${MESOS_SANDBOX-}" ] && [ -d "$MESOS_SANDBOX/templates" ]; then
  mkdir -p templates
  cp -v "$MESOS_SANDBOX/templates/"* templates/
fi

if [ -n "${HAPROXY_SYSCTL_PARAMS-}" ]; then
  echo "setting sysctl params to: ${HAPROXY_SYSCTL_PARAMS}"
  if [ -n "${HAPROXY_SYSCTL_NONSTRICT-}" ]; then
    # ignore errors
    sysctl -w $HAPROXY_SYSCTL_PARAMS || true
  else
    sysctl -w $HAPROXY_SYSCTL_PARAMS
  fi
fi

/usr/bin/runsv "$HAPROXY_SERVICE" &
RUNSV=$!
ARGS=""

trap "kill $RUNSV; wait $RUNSV; exit 0" TERM INT

MODE=$1; shift
case "$MODE" in
  poll)
    POLL_INTERVAL="${POLL_INTERVAL:-60}"
    ;;
  sse)
    ARGS="--sse"
    ;;
  event)
    URL=$1; shift
    if [ -z "$URL" ] || echo "$URL" | grep -q '^-'; then
      echo "$0 event callback-url [marathon_lb.py args]" >&2
      exit 1
    fi
    echo "Using $URL as event callback-url"
    ARGS="-u $URL"
    ;;
  *)
    echo "Unknown mode $MODE. Synopsis: $0 poll|sse|event [marathon_lb.py args]" >&2
    exit 1
    ;;
esac

while true; do
  /marathon-lb/marathon_lb.py \
    --syslog-socket $SYSLOG_SOCKET \
    --haproxy-config /marathon-lb/haproxy.cfg \
    --ssl-certs "$SSL_CERTS" \
    --command "sv reload $HAPROXY_SERVICE" \
    $ARGS "$@" &
  wait $! || exit $? # Needed for the traps to work
  if [ "$MODE" != "poll" ]; then
    exit 0
  fi
  sleep "$POLL_INTERVAL" &
  wait $!
done