#!/bin/sh
# lchat-env-install <name> — write stdin to /data/<name>.env (0600 lchat:lchat).
# The narrow, audited path for operators to place service/instance secrets
# without a root shell:  sops -d file.env | ssh <box> sudo lchat-env-install <name>
set -eu
name="$1"
case "$name" in */*|*..*|"") echo "bad name" >&2; exit 1 ;; esac
umask 077
t=$(mktemp /data/.envtmp.XXXXXX)
cat > "$t"
chown lchat:lchat "$t"
chmod 600 "$t"
mv "$t" "/data/$name.env"
echo "wrote /data/$name.env"