#!/bin/sh

set -euo pipefail

# Initialize random passwords if needed

if ! vault kv list [[ .vault.prefix ]]kv/service 2>/dev/null | grep -q -E '^[[ .instance ]]$'; then
  vault kv put [[ .vault.prefix ]]kv/service/[[ .instance ]] \
    django_secret=$(pwgen -s -n 50 1)
fi

for PWD in django_secret; do
  if ! vault kv get -field ${PWD} [[ .vault.prefix ]]kv/service/[[ .instance ]] >/dev/null 2>&1; then
    vault kv patch [[ .vault.prefix ]]kv/service/[[ .instance ]] \
      ${PWD}=$(pwgen -s -n 50 1)
  fi
done