#!/bin/sh
# =============================================================================
# ClamAV 容器入口脚本（POSIX sh 兼容，Alpine/Debian slim 通用）
# =============================================================================
#
# 逻辑：
#   1) 检查 /var/lib/clamav 是否有 .cvd/.cld 签名库文件
#      - 有 → 直接启动 clamd
#      - 没有 → 尝试 freshclam 拉取（外网场景），失败则静默降级（内网正常）
#   2) 光闸摆渡导入：用户把 clamav-db-*.tar.gz 解压到 ./data/clamav/ 后
#      下次 docker restart meshsafe-clamav 会自动加载
# =============================================================================
set -eu

DATA_DIR="/var/lib/clamav"
CVD_COUNT=$(ls -1 "$DATA_DIR"/*.cvd "$DATA_DIR"/*.cld 2>/dev/null | wc -l || true)

echo "[init_clamav] ClamAV 签名库检查..."
echo "[init_clamav] 数据目录: $DATA_DIR 已有签名文件: $CVD_COUNT"

if [ "$CVD_COUNT" -eq 0 ]; then
    echo "[init_clamav] 签名库为空，尝试 freshclam 拉取（外网环境）..."
    if freshclam --stdout 2>&1 | tail -20; then
        NEW_COUNT=$(ls -1 "$DATA_DIR"/*.cvd 2>/dev/null | wc -l || true)
        echo "[init_clamav] freshclam 成功，新签名文件数: $NEW_COUNT"
    else
        echo "[init_clamav] freshclam 失败（内网光闸环境正常，等离线导入）"
        echo "[init_clamav] 离线导入步骤："
        echo "  1. 外网: bash scripts/sync_clamav_db.sh → 生成 clamav-db-*.tar.gz"
        echo "  2. 光闸: 把 tar.gz 摆渡到内网"
        echo "  3. 内网: tar -xzf clamav-db-*.tar.gz -C ./data/clamav/"
        echo "  4. 内网: docker restart meshsafe-clamav"
    fi
fi

echo "[init_clamav] 启动 clamd..."
exec clamd --foreground