#!/usr/bin/env bash
set -euo pipefail

base=/opt/endoleap-infra
dir=$base/foundry/codex
binary=$(realpath "$1")
test -x "$binary"
test -s "$dir/home/auth.json"
test -s "$dir/grants/projects.json"
install -d -m 700 "$dir/run"
chown 1000:1000 "$dir/run"

canvas_env=()
if [[ -s "$dir/canvas.env" ]]; then canvas_env=(--env-file "$dir/canvas.env"); fi

# The host operator supplies an isolated Codex home and starts a single worker.
# The Docker default bridge supplies egress independently of Foundry's network.
docker run -d --name foundry-codex-worker --restart unless-stopped --init \
  --network bridge --user 1000:1000 --cap-drop ALL --security-opt no-new-privileges \
  --read-only --pids-limit 128 --memory 1g --tmpfs /tmp:rw,nosuid,nodev \
  --tmpfs /work:ro,nosuid,nodev --workdir /work \
  --mount "type=bind,source=$binary,target=/opt/foundry,readonly" \
  --mount "type=bind,source=$base/codex-cli,target=/opt/codex,readonly" \
  --mount "type=bind,source=$dir/home,target=/home/node/.codex" \
  --mount "type=bind,source=$dir/run,target=/run/foundry-codex" \
  --mount "type=bind,source=/etc/ssl/certs/ca-certificates.crt,target=/etc/ssl/certs/ca-certificates.crt,readonly" \
  "${canvas_env[@]}" \
  node:24-bookworm-slim /opt/foundry codex-worker