#!/bin/sh
set -eu

compose_file=/host-arcane/compose.yml
backup_file=/host-arcane/compose.yml.pre-haproxy-20260903

test -r "$compose_file"
test -w "$compose_file"

if [ ! -e "$backup_file" ]; then
    cp -p "$compose_file" "$backup_file"
fi

mapping_pattern="^[[:space:]]*-[[:space:]]*['\"]?((0\\.0\\.0\\.0|::):)?443:443(/tcp)?['\"]?[[:space:]]*$"
mapping_count=$(grep -Ec "$mapping_pattern" "$compose_file" || true)

if [ "$mapping_count" -eq 1 ]; then
    sed -E -i "\#$mapping_pattern#d" "$compose_file"
elif [ "$mapping_count" -ne 0 ]; then
    echo "refusing to patch: expected zero or one TCP 443 mapping, found $mapping_count" >&2
    exit 1
fi

if grep -Eq "$mapping_pattern" "$compose_file"; then
    echo "TCP 443 mapping remains after patch" >&2
    exit 1
fi

echo "Arcane Caddy Compose source is backed up and no longer publishes TCP 443"