#!/usr/bin/env bash
set -euo pipefail

ROOT="$(
  git rev-parse --show-toplevel 2>/dev/null || {
    cd "$(dirname "${BASH_SOURCE[0]}")/.."
    pwd
  }
)"

work_dir="${BURROW_OPENBAO_TOFU_DIR:-$ROOT/infra/openbao}"
plugin_cache_dir="${BURROW_TOFU_PLUGIN_CACHE_DIR:-$ROOT/.cache/opentofu/plugins}"

usage() {
  cat <<'EOF'
Usage: Scripts/openbao-tofu.sh [tofu args...]

Runs OpenTofu for Burrow OpenBao cloud seal and OpenBao API configuration. The
Vault/OpenBao provider reads VAULT_TOKEN from the environment when managing
OpenBao mounts, policies, or auth backends.

Examples:
  Scripts/openbao-tofu.sh init -backend-config=backend.hcl
  Scripts/openbao-tofu.sh plan -var-file=terraform.tfvars

Local syntax check:
  Scripts/openbao-tofu.sh init -backend=false
  Scripts/openbao-tofu.sh validate
EOF
}

if [[ "${1:-}" == "-h" || "${1:-}" == "--help" ]]; then
  usage
  exit 0
fi

mkdir -p "$plugin_cache_dir"
export TF_PLUGIN_CACHE_DIR="$plugin_cache_dir"
export TF_IN_AUTOMATION="${TF_IN_AUTOMATION:-true}"

exec nix shell --inputs-from "$ROOT" nixpkgs#opentofu -c tofu -chdir="$work_dir" "$@"