#!/bin/sh
set -eu

if [ "$1" = configure ]; then
    install -d -m 0700 -o root -g root /etc/vpn-egress
    install -d -m 0700 -o root -g root /var/lib/vpn-egress /var/lib/vpn-egress/backups
    if [ ! -e /etc/vpn-egress/policy.json ]; then
        install -m 0600 -o root -g root /usr/share/vpn-egressctl/policy.json /etc/vpn-egress/policy.json
    fi
    python3 -m vpn_egressctl.installcheck \
        /etc/vpn-egress/policy.json \
        /var/lib/vpn-egress \
        /etc/sing-box/config.json
    systemctl daemon-reload >/dev/null 2>&1 || true
fi

# Watcher activation is deliberately left to the documented migration step.
exit 0