#!/bin/bash
# brun.sh [--env A,B] [--push LOCALFILE]... -- CMD ARGS   — run CMD in the browser LXC (CT 9330 on demo-hp).
# Secrets named with --env are read from THIS process's env (run brun.sh under `sec run A,B -- …`) and
# travel on stdin through envrun.py, never on a command line. Files pushed land in /root/work/.
set -euo pipefail
CT=${BR_CT:-9361}; envs=""; pushes=()
while [ "$1" != "--" ]; do
  case "$1" in --env) envs=$2; shift 2;; --push) pushes+=("$2"); shift 2;; *) echo "brun: bad arg $1" >&2; exit 1;; esac
done; shift
for f in "${pushes[@]}"; do
  ssh demo-hp "cat > /tmp/brun-push-$(basename "$f")" < "$f"
  ssh demo-hp "LC_ALL=C pct push $CT /tmp/brun-push-$(basename "$f") /root/work/$(basename "$f") && rm -f /tmp/brun-push-$(basename "$f")"
done
{
  IFS=, read -ra names <<< "$envs"
  # each entry is NAME or SRC:DST (send the value of SRC under the name DST)
  for n in "${names[@]}"; do [ -n "$n" ] || continue; src=${n%%:*}; dst=${n##*:}
    printf '%s=%s\n' "$dst" "$(printf '%s' "${!src}" | base64 -w0)"; done
  printf '\n'
} | ssh demo-hp "LC_ALL=C pct exec $CT -- /usr/local/bin/envrun.py $(printf '%q ' "$@")"