docker-entrypoint.sh

#!/bin/sh
# Materialize rite.toml from environment at container start.
# A fully-formed config mounted at /etc/rite/rite.mounted.toml wins.
set -eu

CONF="${RITE_CONFIG:-/etc/rite/rite.toml}"
mkdir -p "$(dirname "$CONF")"

if [ -f /etc/rite/rite.mounted.toml ]; then
  echo "Using mounted rite config." >&2
  cp /etc/rite/rite.mounted.toml "$CONF"
  exec "$@"
fi

IRIS_URL="${RITE_IRIS_BASE_URL:-}"
IRIS_API_TOKEN="${RITE_IRIS_API_TOKEN:-}"

# TOML basic-string escaping: backslash and double quote must be escaped,
# and control characters (everything except tab) plus DEL cannot appear raw
# in a basic string. GNU sed is required: -z processes the value as a single
# NUL-delimited record (environment values cannot contain NUL), which makes
# embedded newlines matchable without a placeholder byte. Values are also
# expected to be valid UTF-8 — like Rust's own env reading, which cannot
# yield non-UTF-8 strings, so no sanitization is attempted here.
toml_escape() {
  printf '%s' "$1" | sed -z \
    -e 's/\\/\\\\/g' \
    -e 's/"/\\"/g' \
    -e 's/\x01/\\u0001/g' \
    -e 's/\x02/\\u0002/g' \
    -e 's/\x03/\\u0003/g' \
    -e 's/\x04/\\u0004/g' \
    -e 's/\x05/\\u0005/g' \
    -e 's/\x06/\\u0006/g' \
    -e 's/\x07/\\u0007/g' \
    -e 's/\x08/\\b/g' \
    -e 's/\x0a/\\n/g' \
    -e 's/\x0b/\\u000b/g' \
    -e 's/\x0c/\\f/g' \
    -e 's/\x0d/\\r/g' \
    -e 's/\x0e/\\u000e/g' \
    -e 's/\x0f/\\u000f/g' \
    -e 's/\x10/\\u0010/g' \
    -e 's/\x11/\\u0011/g' \
    -e 's/\x12/\\u0012/g' \
    -e 's/\x13/\\u0013/g' \
    -e 's/\x14/\\u0014/g' \
    -e 's/\x15/\\u0015/g' \
    -e 's/\x16/\\u0016/g' \
    -e 's/\x17/\\u0017/g' \
    -e 's/\x18/\\u0018/g' \
    -e 's/\x19/\\u0019/g' \
    -e 's/\x1a/\\u001a/g' \
    -e 's/\x1b/\\u001b/g' \
    -e 's/\x1c/\\u001c/g' \
    -e 's/\x1d/\\u001d/g' \
    -e 's/\x1e/\\u001e/g' \
    -e 's/\x1f/\\u001f/g' \
    -e 's/\x7f/\\u007f/g'
}

IRIS_URL_TOML=$(toml_escape "$IRIS_URL")
IRIS_API_TOKEN_TOML=$(toml_escape "$IRIS_API_TOKEN")

{
  printf '%s\n' "# Generated by docker-entrypoint.sh — do not edit in place."
  if [ -n "$IRIS_URL" ]; then
    printf '\n%s\n' "[sources.iris]"
    printf '%s\n' "enabled = true"
    # printf, never echo: dash's builtin echo interprets \n, \\, \b, \f, \r
    # in its arguments and would corrupt the escapes emitted above. The
    # runtime image (Debian bookworm) uses dash as /bin/sh.
    printf 'base_url = "%s"\n' "$IRIS_URL_TOML"
    if [ -n "$IRIS_API_TOKEN" ]; then
      printf 'api_token = "%s"\n' "$IRIS_API_TOKEN_TOML"
    fi
  fi
} > "$CONF"

exec "$@"