#!/bin/sh
set -e

PROXY_CONF=/tmp/proxy_forward.caddy

# Build basicauth lines from shared users.conf (skip if PROXY_NO_AUTH=1)
AUTH_LINES=""
if [ "${PROXY_NO_AUTH:-0}" != "1" ] && [ -f /etc/proxy/users.conf ]; then
    while IFS=' ' read -r user pass || [ -n "$user" ]; do
        [ -z "$user" ] && continue
        case "$user" in \#*) continue ;; esac
        AUTH_LINES="${AUTH_LINES}        basicauth ${user} ${pass}\n"
    done < /etc/proxy/users.conf
fi
AUTH_BLOCK=$(printf '%b' "$AUTH_LINES")

# GeoIP Japan-only filter (active only if DB file is present)
GEOIP_BLOCK=""
if [ -f "/etc/caddy/GeoLite2-Country.mmdb" ]; then
    GEOIP_BLOCK='    geoip /etc/caddy/GeoLite2-Country.mmdb
    @not_japan {
        not remote_ip 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 127.0.0.1/32
        not expression `{http.vars.geoip_country_code} == "JP"`
    }
    respond @not_japan 403'
fi

cat > "$PROXY_CONF" <<EOF
http:// {
    route {
${GEOIP_BLOCK}
        forward_proxy {
${AUTH_BLOCK}        }
        redir https://{host}{uri} 308
    }
}
https://proxy.yyamashita.com {
    tls {
        key_type rsa4096
    }
    route {
${GEOIP_BLOCK}
        forward_proxy {
${AUTH_BLOCK}        }
    }
}
EOF

exec "$@"