#!/usr/bin/env bash
set -euo pipefail
root="${1:?deployment directory required}"
[[ "$root" == /* && "$root" != / && "$root" != *[!a-zA-Z0-9_/-]* ]] || exit 2
umask 077
mkdir -p "$root/configs"
tmp="$(mktemp "$root/configs/.env.XXXXXX")"
trap 'rm -f "$tmp"' EXIT
cat > "$tmp"
[[ -s "$tmp" ]] || exit 1
# Atomic create-if-absent. Existing configuration and encryption key win.
ln "$tmp" "$root/configs/.env" 2>/dev/null || test -s "$root/configs/.env"