#!/usr/bin/env bash
# Unlock and mount Dankserver's encrypted entropy volume.
#
# The desktop flow uses the system's crypttab and fstab entries.  Reuse those
# entries here instead of embedding a passphrase, mount options, or ownership
# changes in this helper.  udisksctl reads the passphrase through its secure
# desktop/terminal authentication path.
set -euo pipefail

MOUNTPOINT='/mnt/entropy'
MAPPER='/dev/mapper/luks-cd86c728-459e-4f3a-bcc2-41ecf84685ec'

if mountpoint -q "$MOUNTPOINT"; then
    printf '%s is already mounted.\n' "$MOUNTPOINT"
    exit 0
fi

if [ ! -e /dev/md0 ]; then
    printf 'ERROR: RAID device /dev/md0 is not available.\n' >&2
    exit 1
fi

if [ ! -e "$MAPPER" ]; then
    udisksctl unlock --block-device /dev/md0
fi

# udisks2 may mount automatically as part of unlocking.  Do not attempt a
# second mount in that case.
if ! mountpoint -q "$MOUNTPOINT"; then
    sudo mount "$MOUNTPOINT"
fi
printf 'Mounted %s.\n' "$MOUNTPOINT"