entrypoint.sh

#!/bin/sh
set -e

MODE="${1:-oidc}"
shift || true

# Build base args - data lives in the mounted volume
ARGS="--db /app/data/data.db --dash-host 0.0.0.0"

# In-container Cloudflare Quick Tunnel (requires cloudflared in the image; needs outbound HTTPS).
# Default is off (same as local runs without --cloudflared). Set MASSO_CLOUDFLARED=1 to enable.
cf="${MASSO_CLOUDFLARED:-0}"
if [ "$cf" != "0" ] && [ "$cf" != "false" ] && [ "$cf" != "False" ]; then
  ARGS="$ARGS --cloudflared"
fi

# Duo mode - two independent IdP instances from one dashboard. Default off,
# like --cloudflared above. --port-b is pinned to a fixed default (rather than
# left to masso's own --port+2 rule) so the container's internal listen port
# always matches the docker-compose MASSO_PORT_B mapping.
duo="${MASSO_DUO:-0}"
if [ "$duo" != "0" ] && [ "$duo" != "false" ] && [ "$duo" != "False" ]; then
  ARGS="$ARGS --duo --port-b ${MASSO_PORT_B:-8083}"
else
  # Single-IdP "quick setup" flags: masso itself rejects --client-id/
  # --client-secret/--redirect-uri/--acs/--audience together with --duo (each
  # only has one obvious target once there are two IdPs - configure per IdP from
  # the dashboard's Settings tab instead), so only pass them through here when
  # NOT in duo mode. docker-compose.yml sets these env vars with the same
  # defaults masso's own flags use; a plain `docker run` simply won't have them set.
  if [ -n "$OIDC_CLIENT_ID" ]; then ARGS="$ARGS --client-id $OIDC_CLIENT_ID"; fi
  if [ -n "$OIDC_CLIENT_SECRET" ]; then ARGS="$ARGS --client-secret $OIDC_CLIENT_SECRET"; fi
  if [ -n "$OIDC_REDIRECT_URI" ]; then ARGS="$ARGS --redirect-uri $OIDC_REDIRECT_URI"; fi
  if [ -n "$SAML_ACS_URL" ]; then ARGS="$ARGS --acs $SAML_ACS_URL"; fi
  if [ -n "$SAML_AUDIENCE" ]; then ARGS="$ARGS --audience $SAML_AUDIENCE"; fi
fi

# Append any extra args passed to the container
exec ./masso "$MODE" $ARGS "$@"