#!/usr/bin/env bash
# Check-only by default. Run with 'up' explicitly after host/IP/config approval.
set -euo pipefail
cd "$(dirname "$0")/.."
action="${1:-check}"
case "$action" in check | up) ;; *)
  echo 'usage: bash deploy/asterisk.sh [check|up]' >&2
  exit 2
  ;;
esac
for file in http.conf ari.conf pjsip.conf rtp.conf extensions.conf; do
  test -f "deploy/asterisk/generated/$file" || {
    echo "Missing generated $file" >&2
    exit 1
  }
done
image="$(docker compose -f compose.asterisk.yaml config --format json |
  python3 -c 'import json,sys; print(json.load(sys.stdin)["services"]["asterisk"]["image"])')"
if [[ ! "$image" =~ @sha256:[a-f0-9]{64}$ ]]; then
  echo 'Asterisk image must be pinned to an approved SHA-256 digest' >&2
  exit 1
fi
echo 'Compose, config files and image digest checked; verify container UID, network and fixed egress IP separately.'
if [[ "$action" == up ]]; then
  docker compose -f compose.asterisk.yaml up -d
fi