#!/bin/bash
# Create the Nextcloud role + database alongside Keycloak's.
#
# Runs from the postgres image's /docker-entrypoint-initdb.d hook, which fires
# ONLY on a first-time init (empty data directory). Stacks that already have a
# keycloak-db volume from before Nextcloud existed will never run this — run.sh
# performs the same create idempotently before starting Nextcloud to cover that
# upgrade path. Keep the two in sync.
set -euo pipefail

# The password is passed as a psql variable and interpolated with :'pw' so psql
# applies its own literal quoting — a password containing a quote would
# otherwise break the statement (or worse).
psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" \
     -v pw="$NC_DB_PASSWORD" <<-'SQL'
    CREATE ROLE nextcloud LOGIN PASSWORD :'pw';
    CREATE DATABASE nextcloud OWNER nextcloud ENCODING 'UTF8';
SQL

echo "[initdb] nextcloud role and database created"