start.sh

#!/bin/bash

# 1. Start Nginx
nginx

# 2. Start the CEO Billing Dashboard
if [ -f "/app/billing_dashboard.py" ]; then
    python3 /app/billing_dashboard.py &
fi

# 3. Create permanent home for the engine
mkdir -p /data/v4

# 4. Only copy binaries on first boot — preserves the persistent database
if [ ! -f "/data/v4/convex-local-backend" ]; then
    echo "First boot: copying Convex binaries to persistent storage..."
    cp -a /convex/* /data/v4/
else
    echo "Existing install found — skipping binary copy to preserve database."
    cp /convex/generate_admin_key.sh /data/v4/generate_admin_key.sh 2>/dev/null || true
    cp /convex/generate_key /data/v4/generate_key 2>/dev/null || true
    cp /convex/read_credentials.sh /data/v4/read_credentials.sh 2>/dev/null || true
fi

# 5. Always re-apply execute permissions
chmod +x /data/v4/convex-local-backend
chmod +x /data/v4/generate_admin_key.sh 2>/dev/null || true
chmod +x /data/v4/generate_key 2>/dev/null || true
chmod +x /data/v4/read_credentials.sh 2>/dev/null || true

# 6. Move into the permanent drive
cd /data/v4

# 7. Point local storage path
export CONVEX_LOCAL_STORAGE_DIR="/data/v4/convex_local_storage"
mkdir -p "$CONVEX_LOCAL_STORAGE_DIR"

# 8. Set credentials — INSTANCE_NAME must match --instance-name passed to backend
#    CREDENTIALS_DIR points to persistent storage so credentials survive reboots
export INSTANCE_NAME="leadshello-agent-ai"
export INSTANCE_SECRET="${CONVEX_INSTANCE_SECRET:-deadbeefcafebabe0123456789abcdeffedcba9876543210deadbeefcafebabe}"
export CREDENTIALS_DIR="/data/v4/credentials"
export DATA_DIR="/data/v4"
mkdir -p "$CREDENTIALS_DIR"
echo "$INSTANCE_NAME"   > "$CREDENTIALS_DIR/instance_name"
echo "$INSTANCE_SECRET" > "$CREDENTIALS_DIR/instance_secret"

echo "Using INSTANCE_NAME:   $INSTANCE_NAME"
echo "Using INSTANCE_SECRET: $INSTANCE_SECRET"
echo "Using CREDENTIALS_DIR: $CREDENTIALS_DIR"

# 9. Start the live database
echo "Starting Convex Backend on Permanent Storage..."
./convex-local-backend \
    --instance-name "$INSTANCE_NAME" \
    --instance-secret "$INSTANCE_SECRET" \
    --local-storage "$CONVEX_LOCAL_STORAGE_DIR" &

# 10. Poll until the backend is actually ready
echo "Waiting for backend to be ready..."
for i in $(seq 1 30); do
    if curl -sf http://127.0.0.1:3210/version > /dev/null 2>&1; then
        echo "Backend is ready after ${i}s."
        break
    fi
    sleep 1
done

# 11. Run generate_admin_key.sh with ALL output visible (no suppression)
#     so we can see exactly what it produces or what error it throws
echo "=========================================================="
echo "RAW OUTPUT OF generate_admin_key.sh:"
./generate_admin_key.sh
echo "(end of raw output)"
echo "=========================================================="

# 12. Capture just the key and verify it directly
ADMIN_KEY=$(./generate_admin_key.sh 2>&1 | grep -oP '[a-z0-9-]+\|[a-f0-9]+')
echo "Extracted key: $ADMIN_KEY"

if [ -z "$ADMIN_KEY" ]; then
    echo "ERROR: Could not extract admin key"
else
    VERIFY=$(curl -s -X POST http://127.0.0.1:3210/api/get_config_hashes \
        -H "Content-Type: application/json" \
        -d "{\"adminKey\": \"$ADMIN_KEY\"}")
    if echo "$VERIFY" | grep -q "BadAdminKey"; then
        echo "STATUS: KEY REJECTED by backend"
    else
        echo "STATUS: KEY ACCEPTED — this is your working deploy key!"
    fi
    echo "Verification response: $VERIFY"
fi
# 13. Keep the container alive forever
tail -f /dev/null