start

#!/bin/bash
set -e

# shellcheck disable=SC1091
. /app/venv/bin/activate

find_nss_wrapper() {
    for candidate in \
        /usr/lib/*/libnss_wrapper.so \
        /usr/lib/libnss_wrapper.so \
        /lib/*/libnss_wrapper.so \
        /lib/libnss_wrapper.so; do
        for path in $candidate; do
            if [ -f "$path" ]; then
                echo "$path"
                return 0
            fi
        done
    done
    return 1
}

ipv6_available() {
    local weblate_nginx_ipv6_value=${WEBLATE_NGINX_IPV6:-auto}
    weblate_nginx_ipv6_value=${weblate_nginx_ipv6_value,,}

    if [[ $weblate_nginx_ipv6_value == "0" || $weblate_nginx_ipv6_value == "false" || $weblate_nginx_ipv6_value == "no" || $weblate_nginx_ipv6_value == "off" ]]; then
        return 1
    fi

    if [[ $weblate_nginx_ipv6_value == "1" || $weblate_nginx_ipv6_value == "true" || $weblate_nginx_ipv6_value == "yes" || $weblate_nginx_ipv6_value == "on" ]]; then
        return 0
    fi

    if [[ ! -f /proc/net/if_inet6 ]]; then
        return 1
    fi

    if [[ -r /proc/sys/net/ipv6/conf/all/disable_ipv6 ]] && [[ $(cat /proc/sys/net/ipv6/conf/all/disable_ipv6) == "1" ]]; then
        return 1
    fi

    return 0
}

run_weblate() {
    "$WEBLATE_CMD" "$@"
}

runserver_has_web_service() {
    local weblate_service=${WEBLATE_SERVICE:-}
    [[ -z $weblate_service || $weblate_service == "web" ]]
}

service_runs_migrations() {
    local weblate_service=${WEBLATE_SERVICE:-}
    [[ -z $weblate_service || $weblate_service == "celery-beat" ]]
}

NGINX_PID_FILE=/run/nginx.pid

fail_dep() {
    >&2 echo "$1 not running!"
    >&2 echo
    >&2 echo "$1 is expected to run as separate Docker container."
    >&2 echo
    >&2 echo "Please see our docs for more details:"
    >&2 echo "https://docs.weblate.org/en/latest/admin/install/docker.html"
    exit 1
}

load_secret_from_file() {
    local secret_name=$1
    local file_var="${secret_name}_FILE"
    local file_path="${!file_var:-}"
    local secret_value

    if [[ -z $file_path ]]; then
        return 0
    fi

    if [[ ! -r $file_path ]]; then
        echo "Error: Password file '$file_path' not found or not readable" >&2
        exit 1
    fi

    # Command substitution strips trailing LF; drop a leftover CR from CRLF files.
    secret_value=$(cat "$file_path")
    secret_value=${secret_value%$'\r'}
    declare -gx "$secret_name=$secret_value"
}

# Allow sensitive settings to be defined in files
# in order to support Docker secrets.
load_secret_env_files() {
    load_secret_from_file POSTGRES_PASSWORD
    load_secret_from_file REDIS_PASSWORD
    load_secret_from_file WEBLATE_ADMIN_PASSWORD
    load_secret_from_file WEBLATE_EMAIL_HOST_PASSWORD
    load_secret_from_file WEBLATE_AUTH_LDAP_BIND_PASSWORD
}

initialize_env_defaults() {
    : "${CLIENT_MAX_BODY_SIZE:=1000m}"
    export CLIENT_MAX_BODY_SIZE
}

startup_warning() {
    local message=$1

    message=${message//$'\n'/ }
    message=${message//$'\r'/ }
    >&2 echo "Warning: $message"
    if [[ -n ${WEBLATE_DOCKER_WARNING_MESSAGES:-} ]]; then
        WEBLATE_DOCKER_WARNING_MESSAGES+=$'\n'
    fi
    WEBLATE_DOCKER_WARNING_MESSAGES+="$message"
    export WEBLATE_DOCKER_WARNING_MESSAGES
    if [[ -n ${WEBLATE_DOCKER_WARNING_REPORT:-} ]]; then
        printf '%s\n' "$message" >> "$WEBLATE_DOCKER_WARNING_REPORT/warnings" || true
    fi
}

cleanup_startup_warning_report() {
    local report=${WEBLATE_DOCKER_WARNING_REPORT:-}

    if [[ -z $report ]]; then
        return 0
    fi
    rm -f -- \
        "$report/heartbeat" \
        "$report/hostname" \
        "$report/service" \
        "$report/warnings" || true
    rmdir -- "$report" 2> /dev/null || true
    WEBLATE_DOCKER_WARNING_REPORT=
}

initialize_startup_warning_report() {
    local command=${1:-}
    local data_dir=${WEBLATE_DATA_DIR:-/app/data}
    local report_id
    local warning_root="$data_dir/.docker-startup-warnings"

    if [[ ${WEBLATE_DOCKER_CONTAINER:-} != 1 || $command != "runserver" ]]; then
        return 0
    fi

    report_id=$(cat /proc/sys/kernel/random/uuid)
    WEBLATE_DOCKER_WARNING_REPORT="$warning_root/$report_id"
    WEBLATE_DOCKER_WARNING_HOSTNAME=${HOSTNAME:-unknown}
    WEBLATE_DOCKER_WARNING_SERVICE=${WEBLATE_SERVICE:-all}
    WEBLATE_DOCKER_WARNING_MESSAGES=
    if ! mkdir -p "$WEBLATE_DOCKER_WARNING_REPORT"; then
        >&2 echo "Could not initialize Docker startup warning report."
        WEBLATE_DOCKER_WARNING_REPORT=
        return 0
    fi
    printf '%s\n' \
        "Signature: 8a477f597d28d172789f06886806bc55d" \
        "# Docker startup warning reports are ephemeral." \
        > "$warning_root/CACHEDIR.TAG" || true
    if ! {
        printf '%s\n' "$WEBLATE_DOCKER_WARNING_HOSTNAME" > "$WEBLATE_DOCKER_WARNING_REPORT/hostname" &&
            printf '%s\n' "$WEBLATE_DOCKER_WARNING_SERVICE" > "$WEBLATE_DOCKER_WARNING_REPORT/service" &&
            : > "$WEBLATE_DOCKER_WARNING_REPORT/warnings" &&
            touch "$WEBLATE_DOCKER_WARNING_REPORT/heartbeat" "$WEBLATE_DOCKER_WARNING_REPORT"
    }; then
        >&2 echo "Could not write Docker startup warning report."
        cleanup_startup_warning_report
        return 0
    fi
    export \
        WEBLATE_DOCKER_WARNING_HOSTNAME \
        WEBLATE_DOCKER_WARNING_MESSAGES \
        WEBLATE_DOCKER_WARNING_REPORT \
        WEBLATE_DOCKER_WARNING_SERVICE
    trap cleanup_startup_warning_report EXIT

    # Reports stop being displayed after five minutes. Remove expired ones
    # here to keep the shared data directory bounded after abrupt shutdowns.
    find "$warning_root" \
        -mindepth 1 \
        -maxdepth 1 \
        -type d \
        -mmin +5 \
        -exec rm -rf -- {} + 2> /dev/null || true
}

ensure_data_volume_writable() {
    if [[ ! -w /app/data ]]; then
        echo "The /app/data volume is not writable, please adjust the permissions. Weblate is running as uid $(id -u)"
        echo
        echo "Please see https://github.com/WeblateOrg/docker/issues/2096 in case"
        echo "the permissions on the volume are actually correct."
        exit 1
    fi
}

prepare_ssh_keys() {
    # Fix permissions on SSH private key.
    # Fails silently if the file doesn't exist yet.
    chmod 600 /app/data/ssh/id_rsa 2> /dev/null || true
    chmod 600 /app/data/ssh/id_ed25519 2> /dev/null || true
}

ensure_django_secret() {
    local secret_file=/app/data/secret
    local secret_tmp

    (
        umask 077
        exec 9> /app/data/.django-secret.lock
        flock -x 9

        if [[ ! -s $secret_file ]]; then
            echo "Generating Django secret..."
            secret_tmp=$(mktemp /app/data/.django-secret.XXXXXX)
            trap 'rm -f "$secret_tmp"' EXIT
            # https://github.com/django/django/blob/1.10.2/django/utils/crypto.py#L54-L56
            /app/venv/bin/python -c "from django.utils.crypto import get_random_string; print(get_random_string(50))" > "$secret_tmp"
            if [[ ! -s $secret_tmp ]]; then
                echo "Failed to generate a non-empty Django secret." >&2
                exit 1
            fi
            chmod 600 "$secret_tmp"
            mv -f -- "$secret_tmp" "$secret_file"
            secret_tmp=
            trap - EXIT
        fi

        # Repair secrets created by older container versions or copied into the volume.
        chmod 600 "$secret_file"
    )
}

django_secret_ready() {
    [[ -s /app/data/secret && -r /app/data/secret ]] || return 1
    [[ $(stat -c %a /app/data/secret 2> /dev/null) == "600" ]]
}

wait_for_django_secret() {
    local max_retries=30
    local timeout=0

    until django_secret_ready; do
        if ((timeout >= max_retries)); then
            echo "Django secret was not created by the migration service within $max_retries seconds." >&2
            echo "Ensure exactly one container runs migrations and that /app/data is shared with the same uid." >&2
            exit 1
        fi
        if ((timeout == 0)); then
            echo "Waiting for the migration service to create the Django secret..."
        fi
        sleep 1
        ((timeout += 1))
    done
}

ensure_saml_certificate() {
    # This has to be done early as it is used from the settings_docker.py
    if [[ -n $WEBLATE_SAML_IDP_URL && (! -f /app/data/ssl/saml.key || ! -f /app/data/ssl/saml.crt) ]]; then
        echo "Generating self-signed certificate for SAML..."
        mkdir -p /app/data/ssl
        openssl req \
            -new \
            -newkey rsa:4096 \
            -x509 \
            -days 3652 \
            -nodes \
            -subj "/OU=Weblate/CN=$WEBLATE_SITE_DOMAIN/emailAddress=$WEBLATE_ADMIN_EMAIL" \
            -out /app/data/ssl/saml.crt \
            -keyout /app/data/ssl/saml.key
    fi
}

prepare_runtime_files() {
    prepare_ssh_keys
    ensure_data_volume_writable
    if service_runs_migrations; then
        ensure_django_secret
    else
        wait_for_django_secret
    fi
    ensure_saml_certificate
}

ensure_runtime_user() {
    local nss_wrapper_user_name
    local nss_wrapper_lib

    # Support OpenShift and other arbitrary-UID deployments without modifying
    # the system passwd database. Keep the legacy /etc/passwd append only as a
    # compatibility fallback for derived images that still make it writable.
    if whoami > /dev/null 2>&1; then
        return 0
    fi

    case "${USER_NAME:-weblate}" in
    *[!A-Za-z0-9._-]* | "")
        startup_warning "Ignoring invalid USER_NAME value; using fallback username 'weblate'."
        nss_wrapper_user_name=weblate
        ;;
    *)
        nss_wrapper_user_name=${USER_NAME:-weblate}
        ;;
    esac

    if nss_wrapper_lib=$(find_nss_wrapper); then
        NSS_WRAPPER_PASSWD=/tmp/passwd.nss_wrapper
        NSS_WRAPPER_GROUP=/tmp/group.nss_wrapper

        cp /etc/passwd "$NSS_WRAPPER_PASSWD"
        cp /etc/group "$NSS_WRAPPER_GROUP"

        echo "$nss_wrapper_user_name:x:$(id -u):$(id -g):$nss_wrapper_user_name user:${HOME}:/sbin/nologin" >> "$NSS_WRAPPER_PASSWD"
        if ! grep -q "^[^:]*:[^:]*:$(id -g):" "$NSS_WRAPPER_GROUP"; then
            echo "$nss_wrapper_user_name:x:$(id -g):" >> "$NSS_WRAPPER_GROUP"
        fi

        export LD_PRELOAD="$nss_wrapper_lib${LD_PRELOAD:+ $LD_PRELOAD}"
        export NSS_WRAPPER_PASSWD
        export NSS_WRAPPER_GROUP
        return 0
    fi

    if [[ -w /etc/passwd ]]; then
        echo "$nss_wrapper_user_name:x:$(id -u):$(id -g):$nss_wrapper_user_name user:${HOME}:/sbin/nologin" >> /etc/passwd
        return 0
    fi

    echo "Current uid $(id -u) has no passwd entry and no writable fallback is available."
    echo "Install libnss-wrapper or provide a passwd entry for the runtime uid."
    exit 1
}

require_site_domain() {
    if [[ -z $WEBLATE_SITE_DOMAIN ]]; then
        echo "Missing WEBLATE_SITE_DOMAIN, please configure it"
        exit 1
    fi
}

export_runtime_env() {
    # Export Weblate variables.
    export WEBLATE_CMD="/app/venv/bin/weblate"
    export WEBLATE_PY_PATH="/app/data/python/customize"

    # Provide sane default value.
    : "${POSTGRES_SSL_MODE:=prefer}"
    export POSTGRES_SSL_MODE

    # Export variables for psql use.
    export PGPASSWORD="$POSTGRES_PASSWORD"
    export PGSSLMODE="$POSTGRES_SSL_MODE"
}

configure_timezone() {
    local zonefile

    # Update the time zone.
    if [[ ! -w /tmp/localtime ]]; then
        return 0
    fi

    zonefile="/usr/share/zoneinfo/$WEBLATE_TIME_ZONE"
    if [[ -n $WEBLATE_TIME_ZONE && -f $zonefile ]]; then
        cat "$zonefile" > /tmp/localtime
    else
        cat /usr/share/zoneinfo/Etc/UTC > /tmp/localtime
    fi
}

ensure_customize_app() {
    # Create fake Python app for customization.
    if [[ ! -d $WEBLATE_PY_PATH ]]; then
        echo "Creating $WEBLATE_PY_PATH"
        mkdir -p "$WEBLATE_PY_PATH/static"
        touch "$WEBLATE_PY_PATH/__init__.py"
        touch "$WEBLATE_PY_PATH/models.py"
    fi
}

check_weblate_config() {
    if ! run_weblate check; then
        >&2 echo "Failed to load configuration, please see errors above."
        exit 1
    fi
}

wait_for_shell_dependency() {
    local wait_label=$1
    local failure_label=$2
    local dependency_location=$3
    local dependency_check=$4
    local max_retries=30
    local timeout=0

    until run_weblate shell -c "$dependency_check" > /dev/null; do
        >&2 echo "$wait_label at $dependency_location is unavailable - retrying $((max_retries - timeout))"
        ((timeout += 1))
        if ((timeout > max_retries)); then
            run_weblate shell -c "$dependency_check"
            fail_dep "$failure_label"
        fi
        sleep 1
    done
}

wait_for_redis() {
    wait_for_shell_dependency \
        redis \
        redis \
        "${REDIS_HOST:-cache}" \
        'from django.core.cache import cache; cache.get("ping")'
}

set_postgres_connection_defaults() {
    : "${POSTGRES_HOST:=database}"
    : "${POSTGRES_PORT:=}"
    export POSTGRES_HOST
    export POSTGRES_PORT
}

wait_for_database() {
    wait_for_shell_dependency \
        "Database server" \
        PostgreSQL \
        "${POSTGRES_HOST:-db}" \
        'from weblate.auth.models import User; User.objects.raw("SELECT 1")'
}

database_version_check_enabled() {
    case $WEBLATE_DATABASES in
    0 | [fF][aA][lL][sS][eE] | [nN][oO])
        return 1
        ;;
    *)
        return 0
        ;;
    esac
}

check_postgres_version() {
    local pgversion

    if ! database_version_check_enabled; then
        >&2 echo "Database is up"
        return 0
    fi

    # Fetch server version.
    pgversion=$(psql -h "$POSTGRES_HOST" -p "$POSTGRES_PORT" -d "${POSTGRES_DB:-$POSTGRES_DATABASE}" -U "$POSTGRES_USER" -t -A -c 'SHOW server_version_num;') || {
        >&2 echo "Failed to connect to PostgreSQL to determine server version"
        exit 1
    }

    unset PGPASSWORD

    >&2 echo "Postgres $pgversion is up"

    # Check if supported PostgreSQL version is used.
    if ((pgversion < 120000)); then
        >&2 echo "PostgreSQL 12 or newer is required to run Weblate"
        >&2 echo "See https://docs.weblate.org/en/latest/admin/install/docker.html#upgrading-postgresql-container"
        exit 1
    fi
}

resolve_celery_worker_mode() {
    local mode_options
    local split_option
    local -a split_options=()

    if [[ -z ${CELERY_WORKER_MODE:-} ]]; then
        if [[ ${CELERY_SINGLE_PROCESS:-0} == 1 ]]; then
            CELERY_WORKER_MODE=single
            startup_warning "CELERY_SINGLE_PROCESS is deprecated; use CELERY_WORKER_MODE=single instead."
        else
            CELERY_WORKER_MODE=combined
        fi
    elif [[ ${CELERY_SINGLE_PROCESS:-0} == 1 ]]; then
        startup_warning "CELERY_SINGLE_PROCESS is deprecated and ignored because CELERY_WORKER_MODE is set; remove CELERY_SINGLE_PROCESS."
    fi

    case $CELERY_WORKER_MODE in
    combined | split | single) ;;
    *)
        >&2 echo "Invalid CELERY_WORKER_MODE '$CELERY_WORKER_MODE'; expected combined, split, or single."
        exit 1
        ;;
    esac

    if [[ $CELERY_WORKER_MODE != split ]]; then
        for split_option in \
            CELERY_MAIN_OPTIONS \
            CELERY_NOTIFY_OPTIONS \
            CELERY_MEMORY_OPTIONS \
            CELERY_TRANSLATE_OPTIONS \
            CELERY_BACKUP_OPTIONS; do
            if [[ -n ${!split_option:-} ]]; then
                split_options+=("$split_option")
            fi
        done
    fi

    if ((${#split_options[@]})); then
        mode_options="CELERY_${CELERY_WORKER_MODE^^}_OPTIONS"
        startup_warning "CELERY_WORKER_MODE=$CELERY_WORKER_MODE ignores split worker options: ${split_options[*]}; use $mode_options or CELERY_WORKER_MODE=split."
    fi

    export CELERY_WORKER_MODE
}

prepare_supervisor_services() {
    if service_runs_migrations; then
        DO_MIGRATE=1
    else
        DO_MIGRATE=0
    fi
    SUPERVISOR_CONF=/run/supervisor.conf.d/

    # Select which services to run.
    mkdir -p "$SUPERVISOR_CONF"
    # Remove possible stale files from previous start.
    rm -f "$SUPERVISOR_CONF"/*

    if [[ -n ${WEBLATE_DOCKER_WARNING_REPORT:-} ]]; then
        ln -s /etc/supervisor/conf.d/docker-warning-heartbeat.conf "$SUPERVISOR_CONF"
    fi

    if [[ -n $WEBLATE_SERVICE ]]; then
        ln -s "/etc/supervisor/conf.d/$WEBLATE_SERVICE.conf" "$SUPERVISOR_CONF"
        return 0
    fi

    # Symlink all non-celery services.
    find /etc/supervisor/conf.d \
        -type f \
        ! -name 'celery-*.conf' \
        ! -name 'docker-warning-heartbeat.conf' \
        -exec ln -s -t "$SUPERVISOR_CONF" {} +

    case $CELERY_WORKER_MODE in
    combined)
        # Symlink the combined worker and scheduler.
        ln -s /etc/supervisor/conf.d/celery-combined.conf "$SUPERVISOR_CONF"
        ln -s /etc/supervisor/conf.d/celery-beat.conf "$SUPERVISOR_CONF"
        ;;
    single)
        # Symlink single process service and scheduler only.
        ln -s /etc/supervisor/conf.d/celery-single.conf "$SUPERVISOR_CONF"
        ln -s /etc/supervisor/conf.d/celery-beat.conf "$SUPERVISOR_CONF"
        ;;
    split)
        # Symlink the scheduler and all queue-specific workers.
        find /etc/supervisor/conf.d -type f -name 'celery-*.conf' ! -name 'celery-combined.conf' ! -name 'celery-single.conf' -exec ln -s -t "$SUPERVISOR_CONF" {} +
        ;;
    esac
}

run_startup_maintenance() {
    if ((DO_MIGRATE == 1)); then
        echo "Starting database migration..."
        if ! run_weblate migrate; then
            echo
            echo "Database migration has failed. Please check the error message above."
            echo "Note: Upgrading across major versions is not supported. In case you are upgrading"
            echo "      from a 4.x version, please upgrade to 5.0.2 first."
            echo
            echo "      Using following for the docker-compose.yaml:"
            echo
            echo "          image: weblate/weblate:5.0.2.2"
            exit 1
        fi

        # Create or update admin account.
        if [[ -n $WEBLATE_ADMIN_PASSWORD ]]; then
            echo "Updating admin user password (unset WEBLATE_ADMIN_PASSWORD to disable)..."
            run_weblate createadmin --password="$WEBLATE_ADMIN_PASSWORD" --update --email="$WEBLATE_ADMIN_EMAIL" --name="$WEBLATE_ADMIN_NAME"
        else
            run_weblate createadmin --email="$WEBLATE_ADMIN_EMAIL" --name="$WEBLATE_ADMIN_NAME" || true
        fi

        echo "Refreshing stats..."
        run_weblate ensure_stats
    fi

    collect_web_static_assets
}

collect_web_static_assets() {
    if [[ ${EARLY_COLLECTSTATIC_DONE:-0} == 1 ]]; then
        return 0
    fi

    run_weblate collectstatic --noinput
    EARLY_COLLECTSTATIC_DONE=1
}

prepare_runtime_sockets_and_pids() {
    # WSGI socket dir.
    mkdir -p /run/granian/
    GRANIAN_SOCKET=/run/granian/granian.sock
    rm -f "$GRANIAN_SOCKET"

    # Celery pid, remove possible stale PID file.
    mkdir -p /run/celery
    rm -f /run/celery/beat.pid
}

detect_builtin_ssl() {
    # Detect SSL setup.
    if [[ -f /app/data/ssl/privkey.pem ]]; then
        WEBLATE_BUILTIN_SSL=1
        if [[ -z $WEBLATE_IP_PROXY_HEADER ]]; then
            # Use X-Forwarded-For from the built-in nginx
            export WEBLATE_IP_PROXY_HEADER=HTTP_X_FORWARDED_FOR
        fi
    else
        WEBLATE_BUILTIN_SSL=
    fi
}

configure_forwarded_for() {
    detect_builtin_ssl

    if [[ $WEBLATE_IP_PROXY_HEADER != "HTTP_X_FORWARDED_FOR" ]]; then
        return 0
    fi

    if [[ -n ${WEBLATE_IP_PROXY_OFFSET:-} && $WEBLATE_IP_PROXY_OFFSET != 0 ]]; then
        startup_warning "Ignoring WEBLATE_IP_PROXY_OFFSET=$WEBLATE_IP_PROXY_OFFSET: the built-in nginx normalizes X-Forwarded-For to one address."
    fi
    export WEBLATE_IP_PROXY_OFFSET=0
}

generate_nginx_config() {
    local early_nginx=${1:-}

    # Make sure WEBLATE_ANUBIS_URL is set.
    : "${WEBLATE_ANUBIS_URL:=}"
    : "${WEBLATE_ENABLE_HTTPS:=}"
    : "${WEBLATE_TRUSTED_PROXY_ADDRESSES:=}"
    if ipv6_available; then
        WEBLATE_ENABLE_IPV6=1
    else
        WEBLATE_ENABLE_IPV6=
    fi

    # Generate nginx configuration.
    mkdir -p /tmp/nginx
    /app/venv/bin/python \
        /etc/nginx/generate-site.py \
        /etc/nginx \
        "$WEBLATE_URL_PREFIX" \
        "$WEBLATE_IP_PROXY_HEADER" \
        "$WEBLATE_TRUSTED_PROXY_ADDRESSES" \
        "$CLIENT_MAX_BODY_SIZE" \
        "$WEBLATE_BUILTIN_SSL" \
        "$WEBLATE_ANUBIS_URL" \
        "$WEBLATE_SITE_DOMAIN" \
        "$WEBLATE_ENABLE_HTTPS" \
        "$GRANIAN_SOCKET" \
        "$WEBLATE_ENABLE_IPV6" \
        "$early_nginx" \
        > /tmp/nginx/weblate-site.conf
}

start_early_nginx() {
    local early_nginx_pid
    local start_retries=5
    local timeout=0

    if ! runserver_has_web_service; then
        return 0
    fi

    collect_web_static_assets
    prepare_runtime_sockets_and_pids
    generate_nginx_config 1
    rm -f "$NGINX_PID_FILE"

    echo "Starting nginx early to serve the startup page..."
    /usr/sbin/nginx

    while ((timeout < start_retries)); do
        if [[ -s $NGINX_PID_FILE ]]; then
            early_nginx_pid=$(cat "$NGINX_PID_FILE")
            if kill -0 "$early_nginx_pid" 2> /dev/null; then
                EARLY_NGINX_STARTED=1
                return 0
            fi
        fi
        ((timeout += 1))
        sleep 1
    done

    echo "Early nginx did not start cleanly"
    exit 1
}

stop_early_nginx() {
    local early_nginx_pid
    local graceful_retries=5
    local term_retries=5
    local final_retries=5
    local timeout=0

    if [[ ${EARLY_NGINX_STARTED:-0} != 1 ]]; then
        return 0
    fi

    if [[ ! -s $NGINX_PID_FILE ]]; then
        EARLY_NGINX_STARTED=0
        return 0
    fi

    early_nginx_pid=$(cat "$NGINX_PID_FILE")
    if ! kill -0 "$early_nginx_pid" 2> /dev/null; then
        rm -f "$NGINX_PID_FILE"
        EARLY_NGINX_STARTED=0
        return 0
    fi

    kill -QUIT "$early_nginx_pid" 2> /dev/null || true

    while kill -0 "$early_nginx_pid" 2> /dev/null; do
        ((timeout += 1))
        if ((timeout > graceful_retries)); then
            echo "Timed out draining early nginx, sending TERM..."
            kill -TERM "$early_nginx_pid" 2> /dev/null || true
            timeout=0
            break
        fi
        sleep 1
    done

    if kill -0 "$early_nginx_pid" 2> /dev/null; then
        while kill -0 "$early_nginx_pid" 2> /dev/null; do
            ((timeout += 1))
            if ((timeout > term_retries)); then
                echo "Early nginx did not stop after TERM, forcing shutdown..."
                break
            fi
            sleep 1
        done
    fi

    if kill -0 "$early_nginx_pid" 2> /dev/null; then
        kill -KILL "$early_nginx_pid" 2> /dev/null || true
        timeout=0
        while kill -0 "$early_nginx_pid" 2> /dev/null; do
            ((timeout += 1))
            if ((timeout > final_retries)); then
                echo "Early nginx did not stop after forced shutdown; leaving pid file in place." >&2
                return 1
            fi
            sleep 1
        done
    fi

    rm -f "$NGINX_PID_FILE"
    EARLY_NGINX_STARTED=0
}

calculate_worker_defaults() {
    local combined_workers
    local processors
    local prefork_workers

    # Calculate number of processes, at least 2, at most 4, depending on CPU cores.
    if [[ -z $WEBLATE_WORKERS ]]; then
        processors=$(nproc)
        if ((processors < 2)); then
            WEBLATE_WORKERS=2
        elif ((processors > 4)); then
            WEBLATE_WORKERS=4
        else
            WEBLATE_WORKERS=$processors
        fi
        echo "Auto-scaled to $WEBLATE_WORKERS processes, adjust by setting WEBLATE_WORKERS"
    fi

    # Prefork workers provide more effective parallelism than threads. Keep the
    # notification workers at full concurrency, but limit the heavier queues.
    prefork_workers=$(((WEBLATE_WORKERS + 1) / 2))
    combined_workers=$((WEBLATE_WORKERS * 3))

    # Default values for celery options.
    : "${CELERY_COMBINED_OPTIONS:="--concurrency $combined_workers"}"
    : "${CELERY_MAIN_OPTIONS:="--concurrency $prefork_workers"}"
    : "${CELERY_NOTIFY_OPTIONS:="--concurrency $WEBLATE_WORKERS"}"
    : "${CELERY_TRANSLATE_OPTIONS:="--concurrency $prefork_workers"}"
    : "${CELERY_MEMORY_OPTIONS:="--concurrency 1"}"
    : "${CELERY_BACKUP_OPTIONS:="--concurrency 1"}"
    : "${CELERY_BEAT_OPTIONS:=}"
    : "${CELERY_SINGLE_OPTIONS:=}"
    : "${WEB_WORKERS:="$((WEBLATE_WORKERS <= 3 ? 2 : WEBLATE_WORKERS / 2))"}"
    : "${WEB_BLOCKING_THREADS:="$((WEBLATE_WORKERS * 2))"}"
    : "${GRANIAN_ARGS:=}"

    if ((${WEBLATE_ASGI:-0} == 1)); then
        GRANIAN_INTERFACE=asginl
        GRANIAN_MODE_ARGS=
        GRANIAN_APPLICATION=weblate.asgi:application
    else
        GRANIAN_INTERFACE=wsgi
        GRANIAN_MODE_ARGS="--runtime-threads 2 --blocking-threads $WEB_BLOCKING_THREADS"
        GRANIAN_APPLICATION=weblate.wsgi:application
    fi

    export CELERY_COMBINED_OPTIONS
    export CELERY_MAIN_OPTIONS
    export CELERY_NOTIFY_OPTIONS
    export CELERY_TRANSLATE_OPTIONS
    export CELERY_MEMORY_OPTIONS
    export CELERY_BACKUP_OPTIONS
    export CELERY_BEAT_OPTIONS
    export CELERY_SINGLE_OPTIONS
    export WEB_WORKERS
    export WEB_BLOCKING_THREADS
    export GRANIAN_SOCKET
    export GRANIAN_INTERFACE
    export GRANIAN_MODE_ARGS
    export GRANIAN_APPLICATION
    export GRANIAN_ARGS
}

start_supervisord() {
    # Execute supervisor.
    exec /app/venv/bin/supervisord \
        --loglevel="${SUPERVISOR_LOGLEVEL:-info}" \
        --logfile="${SUPERVISOR_LOGFILE:-/dev/null}" \
        --configuration=/etc/supervisor/supervisord.conf
}

runserver_main() {
    prepare_supervisor_services
    run_startup_maintenance
    prepare_runtime_sockets_and_pids
    generate_nginx_config
    calculate_worker_defaults
    stop_early_nginx
    start_supervisord
}

main() {
    load_secret_env_files
    initialize_env_defaults

    echo "Starting Weblate $WEBLATE_VERSION..."

    prepare_runtime_files
    initialize_startup_warning_report "$@"
    if [[ ${1:-} == "runserver" && -z ${WEBLATE_SERVICE:-} ]]; then
        resolve_celery_worker_mode
    fi
    ensure_runtime_user
    require_site_domain
    export_runtime_env
    configure_timezone
    ensure_customize_app
    if [[ ${1:-} == "runserver" ]]; then
        configure_forwarded_for
    fi
    check_weblate_config
    if [[ ${1:-} == "runserver" ]]; then
        start_early_nginx
    fi
    wait_for_redis
    set_postgres_connection_defaults
    wait_for_database
    check_postgres_version

    if [[ ${1:-} == "runserver" ]]; then
        runserver_main
    fi

    # Start the management command.
    run_weblate "$@"
}

main "$@"