#!/bin/sh
set -euo pipefail

VAULT_FILE="/app/vault/host_vars.img"
MAPPER_NAME="host_vars_crypt"
MOUNT_POINT="/app/host_vars"

mkdir -p "$MOUNT_POINT"

# Always close if active
if cryptsetup status "$MAPPER_NAME" >/dev/null 2>&1; then
    echo "Closing stale mapping $MAPPER_NAME..."
    cryptsetup close "$MAPPER_NAME"
fi

# Open
echo "Opening encrypted volume..."
cryptsetup open "$VAULT_FILE" "$MAPPER_NAME"

# Format if needed
if ! blkid /dev/mapper/"$MAPPER_NAME" >/dev/null 2>&1; then
    echo "No filesystem found, creating ext4..."
    mkfs.ext4 /dev/mapper/"$MAPPER_NAME"
fi

# Mount
echo "Mounting at $MOUNT_POINT..."
mount /dev/mapper/"$MAPPER_NAME" "$MOUNT_POINT"

echo "Vault is mounted at $MOUNT_POINT"