scripts/docker-entrypoint.sh

#!/bin/sh
set -e

# Capture runtime UID/GID from environment variables, defaulting to 1000
PUID=${USER_UID:-1000}
PGID=${USER_GID:-1000}

# Adjust the node user's UID/GID if they differ from the runtime request
# and fix volume ownership only when a remap is needed
changed=0

if [ "$(id -u node)" -ne "$PUID" ]; then
    echo "Updating node UID to $PUID"
    usermod -o -u "$PUID" node
    changed=1
fi

if [ "$(id -g node)" -ne "$PGID" ]; then
    echo "Updating node GID to $PGID"
    groupmod -o -g "$PGID" node
    usermod -g "$PGID" node
    changed=1
fi

if [ "$changed" = "1" ]; then
    chown -R node:node /paperclip
fi

# Restore data from HF Dataset on first deploy only.
# The .restored marker indicates a previous successful restore or first-run setup,
# so we skip overwriting local state on container restarts.
RESTORE_MARKER="${PAPERCLIP_HOME:-/paperclip}/.restored"
if [ -f "/usr/local/bin/restore_snapshot.py" ] && [ ! -f "$RESTORE_MARKER" ]; then
    python3 /usr/local/bin/restore_snapshot.py
    touch "$RESTORE_MARKER"
fi

# Fix ownership after restore
chown -R node:node /paperclip

# Start cloudflared access tcp proxy for PostgreSQL (if configured)
if [ -n "$TUNNEL_SERVICE_TOKEN_ID" ] && [ -n "$CF_TUNNEL_HOSTNAME" ]; then
  echo "Starting cloudflared access tcp proxy -> $CF_TUNNEL_HOSTNAME"
  cloudflared access tcp \
    --hostname "$CF_TUNNEL_HOSTNAME" \
    --url localhost:5432 &
  for i in $(seq 1 30); do
    (echo > /dev/tcp/localhost/5432) 2>/dev/null && break
    sleep 1
  done
  echo "cloudflared proxy ready"
fi

exec gosu node /usr/local/bin/paperclip-start.sh "$@"