#!/sbin/openrc-run
# OpenRC service for the Eviden KMS server (Alpine Linux apk package).

name="Cosmian KMS"
description="Cosmian Key Management System server"

command="/usr/sbin/cosmian_kms"
command_background="yes"
# Drops privileges via start-stop-daemon --user before exec'ing the server.
# The "kms" system user/group is created by the package's preinstall script.
command_user="kms:kms"
pidfile="/run/${RC_SVCNAME}.pid"
directory="/var/lib/cosmian"
output_log="/var/log/cosmian/cosmian_kms.log"
error_log="/var/log/cosmian/cosmian_kms.log"

: "${COSMIAN_KMS_CONF:=/etc/cosmian/kms.toml}"
export COSMIAN_KMS_CONF
# Only meaningful when the FIPS provider tree is installed; harmless otherwise.
export OPENSSL_CONF="${OPENSSL_CONF:-/usr/local/cosmian/lib/ssl/openssl.cnf}"
export OPENSSL_MODULES="${OPENSSL_MODULES:-/usr/local/cosmian/lib/ossl-modules}"

depend() {
    need net
    after firewall
}

start_pre() {
    checkpath --directory --mode 0750 --owner kms:kms /var/lib/cosmian
    checkpath --directory --mode 0750 --owner kms:kms /var/log/cosmian
}
