initial codes

files/entrypoint.sh

@@ -0,0 +1,75 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+log(){ echo "[nats-registration][entrypoint] $*"; }
+err(){ echo "[nats-registration][entrypoint][ERROR] $*" >&2; }
+
+# Sanity: tools
+for bin in curl jq python3; do
+  command -v "$bin" >/dev/null 2>&1 || { err "Missing $bin"; exit 2; }
+done
+
+# Paths (match Dockerfile ENV)
+: "${APP_DIR:=/opt/containers/nats-registration-listener}"
+: "${DATA_DIR:=${APP_DIR}/data}"
+mkdir -p "${DATA_DIR}"
+
+# Required (fed from .env via compose)
+: "${NATS_SERVERS:?NATS_SERVERS required (space-separated NATS URLs, e.g. 'tls://nats01:4222')}"
+: "${NATS_SUBJECT:?NATS_SUBJECT required (e.g. 'v1.registration')}"
+
+# Optional with defaults
+: "${NATS_NAME:=registration-listener}"
+: "${PRINT_RAW:=}"
+: "${NATS_QUEUE:=}"
+
+# TLS input options (dynamic)
+# Priority:
+#  1) TLS_CA      -> use as a path (pre-mounted file)
+#  2) TLS_CA_PEM  -> write PEM content to ${DATA_DIR}/tls-ca.pem
+#  3) TLS_CA_PEM_B64 -> base64 decode to ${DATA_DIR}/tls-ca.pem
+#  4) TLS_CA_URL  -> curl to ${DATA_DIR}/tls-ca.pem
+: "${TLS_CA:=}"
+: "${TLS_CA_PEM:=}"
+: "${TLS_CA_PEM_B64:=}"
+: "${TLS_CA_URL:=}"
+: "${TLS_INSECURE:=}"
+
+# Auth (optional)
+: "${NATS_USER:=}"
+: "${NATS_PASS:=}"
+: "${NATS_TOKEN:=}"
+: "${NATS_CREDS:=}"           # path to a .creds file if you have one
+: "${NATS_CREDS_B64:=}"       # optional: base64-encoded creds; will be written to DATA_DIR
+
+# ---- Dynamic materialization of CA (and optional .creds) ----
+CA_TARGET="${DATA_DIR}/tls-ca.pem"
+CREDS_TARGET="${DATA_DIR}/user.creds"
+
+materialized_ca=""
+
+if [[ -z "${TLS_CA}" ]]; then
+  if [[ -n "${TLS_CA_PEM}" ]]; then
+    log "Materializing TLS CA from TLS_CA_PEM -> ${CA_TARGET}"
+    printf '%s\n' "${TLS_CA_PEM}" > "${CA_TARGET}"
+    chmod 0644 "${CA_TARGET}"
+    TLS_CA="${CA_TARGET}"
+    materialized_ca="1"
+  elif [[ -n "${TLS_CA_PEM_B64}" ]]; then
+    log "Materializing TLS CA from TLS_CA_PEM_B64 -> ${CA_TARGET}"
+    echo "${TLS_CA_PEM_B64}" | base64 -d > "${CA_TARGET}"
+    chmod 0644 "${CA_TARGET}"
+    TLS_CA="${CA_TARGET}"
+    materialized_ca="1"
+  elif [[ -n "${TLS_CA_URL}" ]]; then
+    log "Fetching TLS CA from TLS_CA_URL -> ${CA_TARGET}"
+    curl -fsSL "${TLS_CA_URL}" -o "${CA_TARGET}"
+    chmod 0644 "${CA_TARGET}"
+    TLS_CA="${CA_TARGET}"
+    materialized_ca="1"
+  fi
+fi
+
+# Validate CA if present
+if [[ -n "${TLS_CA}" ]]; then
+  if [[ ! -s "${TLS_CA}" ]_]()]()