#!/bin/sh
set -e

# SKIP_K3S=1 — bypass k3s/soul-demo startup and go straight to neuron-web.
# Used by the dev CI smoke test where the container runtime doesn't support
# the kernel capabilities k3s requires (overlayfs / privileged mode).
if [ "${SKIP_K3S:-0}" = "1" ]; then
  echo "[entrypoint] SKIP_K3S=1: starting neuron-web directly (no k3s/soul-demo)."
  exec /usr/local/bin/neuron-web
fi

echo "[entrypoint] Starting k3s server (embedded soul-demo orchestrator)..."

# k3s server — single-node mode, disable unused components
# --disable traefik,servicelb: we don't need an ingress or LB
# --disable metrics-server: saves ~50MB RAM
# --write-kubeconfig-mode=644: allow non-root reads
# --data-dir: use the pre-chowned dir
# --flannel-iface=eth0: explicitly set the network interface.
#   Cloud Run gen2 provides eth0 but k3s default IP detection walks the routing
#   table looking for a default route, which fails in Cloud Run's network sandbox.
#   Pinning to eth0 bypasses that detection and lets k3s bind correctly.
k3s server \
  --disable traefik \
  --disable servicelb \
  --disable metrics-server \
  --write-kubeconfig-mode=644 \
  --data-dir /var/lib/rancher/k3s \
  --node-name soul-node \
  --flannel-iface=eth0 &

K3S_PID=$!

# Start neuron-web immediately — do NOT block on k3s becoming ready.
# Cloud Run's startup probe requires port 8080 to be listening within the
# startup timeout. k3s may take 30-60s to initialise; blocking here causes
# probe failures and container termination before neuron-web ever starts.
# soul-demo becomes available asynchronously once k3s is ready. neuron-web
# handles soul-demo being temporarily unavailable gracefully.
echo "[entrypoint] Starting neuron-web on port ${PORT:-8080} (k3s initialising in background)..."
exec /usr/local/bin/neuron-web