#!/bin/sh
# If the operator mounted extra trusted CA certificates (e.g. an internal
# PKI root, common when LMS's OIDC provider sits behind a private CA),
# pick them up before starting. update-ca-certificates needs root, so this
# runs before we drop privileges to the lms user.
set -e

if [ -d /usr/local/share/ca-certificates ] && [ -n "$(ls -A /usr/local/share/ca-certificates 2>/dev/null)" ]; then
	update-ca-certificates
fi

exec su-exec lms:lms "$@"