#!/bin/sh
# Local-only automatic unseal. The root token is never mounted in this container.
set -eu
export VAULT_ADDR=http://127.0.0.1:8200
vault server -config=/etc/vault/server.hcl &
pid=$!
trap 'kill -TERM "$pid"; wait "$pid"' TERM INT
until [ -s /bootstrap/unseal ]; do
    kill -0 "$pid" || exit 1
    sleep 1
done
until vault operator unseal "$(cat /bootstrap/unseal)" >/dev/null 2>&1; do
    kill -0 "$pid" || exit 1
    sleep 1
done
wait "$pid"