run.sh

#!/bin/bash
# shellcheck disable=SC1091
# shellcheck shell=bash

# Source bashio early for banner functions
[ -f /usr/lib/bashio/bashio.sh ] && source /usr/lib/bashio/bashio.sh

# Enable strict mode
set -e

# Define local paths
COREFILE_PATH="/etc/shielddns/Corefile"
DEFAULT_UPSTREAM="1.1.1.1"

echo "Starting ShieldDNS Initialization..."

# ------------------------------------------------------------------------------
# 0. Helper Functions
# ------------------------------------------------------------------------------
fix_permissions() {
    local TARGET_DIR=$1
    if [ -d "$TARGET_DIR" ]; then
        echo "Ensuring correct permissions for $TARGET_DIR..."
        # Try to fix permissions, but don't fail if the filesystem is read-only
        chown -R shielddns:shielddns "$TARGET_DIR" 2>/dev/null || echo "Note: Could not change ownership of $TARGET_DIR (likely a read-only mount). Continuing..."
    fi
}

echo "Starting ShieldDNS Initialization..."

# ------------------------------------------------------------------------------
# 1. Environment Detection & Configuration
# ------------------------------------------------------------------------------
if [ -f "/data/options.json" ] && [ -n "$(command -v bashio::config)" ]; then
    bashio::log.info "ℹ️  Home Assistant Addon environment detected."

    UPSTREAM_DNS=$(bashio::config 'upstream_dns')
    UPSTREAM_DOT=$(bashio::config 'upstream_dot')
    PREFER_ENCRYPTED=$(bashio::config 'prefer_encrypted')
    CERT_FILE=$(bashio::config 'certfile')
    KEY_FILE=$(bashio::config 'keyfile')
    LOG_LEVEL=$(bashio::config 'log_level')
    DOT_PORT=$(bashio::config 'dot_port')
    DOH_PORT=$(bashio::config 'doh_port')
    FALLBACK_DNS_ENABLED=$(bashio::config 'fallback_dns')
    FALLBACK_DNS_SERVER=$(bashio::config 'fallback_dns_server')
    BLOCK_PAGE_IP=$(bashio::config 'block_page_ip')

    # Export for Go backend
    export BLOCK_PAGE_IP
    export DATA_DIR="/data"

    # Prepend /ssl/ to cert paths if they are just filenames
    if [[ "$CERT_FILE" != /* ]]; then CERT_FILE="/ssl/$CERT_FILE"; fi
    if [[ "$KEY_FILE" != /* ]]; then KEY_FILE="/ssl/$KEY_FILE"; fi
else
    echo "ℹ️  Standard Docker environment detected."
    UPSTREAM_DNS=${UPSTREAM_DNS:-"86.54.11.100 1.1.1.1 9.9.9.9 8.8.8.8 1.0.0.1"}
    UPSTREAM_DOT=${UPSTREAM_DOT:-"unfiltered.joindns4.eu dns.quad9.net one.one.one.one dns.google"}
    PREFER_ENCRYPTED=${PREFER_ENCRYPTED:-"true"}
    CERT_FILE=${CERT_FILE:-"/ssl/fullchain.pem"}
    KEY_FILE=${KEY_FILE:-"/ssl/privkey.pem"}
    LOG_LEVEL=${LOG_LEVEL:-"info"}
    DOT_PORT=${DOT_PORT:-853}
    DOH_PORT=${DOH_PORT:-443}
    FALLBACK_DNS_ENABLED=${FALLBACK_DNS_ENABLED:-"false"}
    FALLBACK_DNS_SERVER=${FALLBACK_DNS_SERVER:-"1.1.1.1"}
    BLOCK_PAGE_IP=${BLOCK_PAGE_IP:-"127.0.0.1"}
    export BLOCK_PAGE_IP
    export DATA_DIR="${DATA_DIR:-/etc/shielddns}"
fi


# ------------------------------------------------------------------------------
# 2. Permission & Privilege Management
# ------------------------------------------------------------------------------
# If we are root, fix permissions and drop to shielddns user
if [ "$(id -u)" = "0" ]; then
    mkdir -p /etc/shielddns /data
    [ ! -d "/ssl" ] && mkdir -p /ssl
    fix_permissions "/etc/shielddns"
    fix_permissions "/ssl"
    fix_permissions "/data"

    # Smart SSL handling: If certs exist but are not readable by the shielddns user
    # (common with Let's Encrypt / live mounts), copy them to internal storage.
    if [ -f "$CERT_FILE" ] && [ -f "$KEY_FILE" ]; then
        if ! su-exec shielddns test -r "$CERT_FILE" 2>/dev/null; then
            echo "ℹ️  Certs found but not readable by 'shielddns' user. Copying to internal storage..."
            mkdir -p /etc/shielddns/ssl
            cp -L "$CERT_FILE" /etc/shielddns/ssl/fullchain.pem
            cp -L "$KEY_FILE" /etc/shielddns/ssl/privkey.pem
            chown -R shielddns:shielddns /etc/shielddns/ssl
            export CERT_FILE="/etc/shielddns/ssl/fullchain.pem"
            export KEY_FILE="/etc/shielddns/ssl/privkey.pem"
        fi
    fi

    echo "Successfully prepared environment. Dropping privileges to 'shielddns' user."
    exec su-exec shielddns "$0" "$@"
fi

# Sanitize upstreams (replace commas with spaces)
UPSTREAM_DNS=$(echo "${UPSTREAM_DNS}" | tr ',' ' ')
UPSTREAM_DOT=$(echo "${UPSTREAM_DOT}" | tr ',' ' ')

# ------------------------------------------------------------------------------
# 1.5. SSL Fallback Check
# ------------------------------------------------------------------------------
if [ ! -f "$CERT_FILE" ] || [ ! -f "$KEY_FILE" ]; then
    echo "⚠️  WARNING: SSL Certificates not found at ${CERT_FILE} or ${KEY_FILE}!"
    echo "⚙️  Generating self-signed fallback certificate..."

    mkdir -p "${DATA_DIR:-/etc/shielddns}/ssl"
    FALLBACK_CERT="${DATA_DIR:-/etc/shielddns}/ssl/selfsigned.crt"
    FALLBACK_KEY="${DATA_DIR:-/etc/shielddns}/ssl/selfsigned.key"

    if [ ! -f "$FALLBACK_CERT" ]; then
        openssl req -x509 -nodes -days 3650 -newkey rsa:2048 \
            -keyout "$FALLBACK_KEY" -out "$FALLBACK_CERT" \
            -subj "/C=DE/ST=ShieldDNS/L=ShieldDNS/O=ShieldDNS/OU=ShieldDNS/CN=shielddns.local" \
            2>/dev/null
    fi

    CERT_FILE="$FALLBACK_CERT"
    KEY_FILE="$FALLBACK_KEY"
    echo "✅  ShieldDNS will continue with self-signed certificates (Insecure)."
fi

# ------------------------------------------------------------------------------
# 2. Port Conflict & Availability Checks
# ------------------------------------------------------------------------------
is_port_busy() {
    local PORT=$1
    if [ -n "$PORT" ] && [ "$PORT" != "null" ]; then
        if nc -z 127.0.0.1 "$PORT" 2>/dev/null; then return 0; fi
    fi
    return 1
}

DNS_PORT="53"
if is_port_busy "${DNS_PORT}"; then
    echo "⚠️  Port 53 is BUSY. Switching DNS to Fallback Port: 10053"
    DNS_PORT="10053"
fi

if is_port_busy "${DOT_PORT}"; then
    if [ "${DOT_PORT}" = "853" ]; then
        echo "⚠️  Port 853 is BUSY. Switching DoT to Fallback Port: 8853"
        DOT_PORT="8853"
    fi
fi

# ------------------------------------------------------------------------------
# 3. ShieldDNS Execution Environment
# ------------------------------------------------------------------------------
echo "🌍 Starting ShieldDNS backend on Port ${DOH_PORT}..."

# Export for Go backend
export CERT_FILE
export KEY_FILE
export INTERNAL_DOH_PORT=${INTERNAL_DOH_PORT:-"5553"}
export ADMIN_PORT=${DOH_PORT} # Listen directly on the public port
export DNS_PORT
export DOT_PORT
export GOMAXPROCS=$(nproc 2>/dev/null || echo 1)

# Initial Corefile (if backend hasn't generated one yet)
ACTUAL_COREDNS_PORT="${INTERNAL_DOH_PORT}"
if [ ! -f "$COREFILE_PATH" ]; then
    cat <<EOF > $COREFILE_PATH
.:${DNS_PORT} {
    forward . ${UPSTREAM_DNS}
    log
    errors
}
tls://.:${DOT_PORT} {
    tls ${CERT_FILE} ${KEY_FILE}
    forward . ${UPSTREAM_DNS}
    log
    errors
}
https://.:${ACTUAL_COREDNS_PORT} {
    tls ${CERT_FILE} ${KEY_FILE}
    forward . ${UPSTREAM_DNS}
    log
    errors
}
EOF
fi

/usr/bin/shielddns-admin &
ADMIN_PID=$!

# CoreDNS is managed by the Go backend (shielddns-admin)
# so it handles log parsing and restarts automatically.

wait -n $ADMIN_PID
echo "⏹️  Shutting down services..."
# Kill all background jobs gracefully
kill -TERM $(jobs -p) 2>/dev/null || true
echo "ℹ️  ShieldDNS has stopped."
exit 0