#!/bin/bash
# Generated by igos-build/hookseal.py from the nginx recipe's
# post_install() function at build time. Do not edit inside the archive —
# edit the recipe and rebuild.
# package: nginx-1.29.8
set -e
    set -e
    # nginx user/group is declared by /usr/lib/sysusers.d/nginx.conf
    # and created by the pkm canonical sysusers hook before this
    # lifecycle hook runs.

    # State / log / cache / runtime directories owned by the daemon
    # user. The systemd unit's ReadWritePaths references these
    # explicitly. /etc/nginx is root-owned (config integrity); only
    # the daemon-writable paths get the nginx user.
    # /etc/nginx and /etc/nginx/conf.d are NOT created here: both ship as
    # owned payload from do_install, so re-creating them from the hook would
    # place a manifest-invisible copy over one pkm owns (hook-contract wave).
    install -dm755 -o nginx -g nginx /var/log/nginx              2>/dev/null || true
    install -dm755 -o nginx -g nginx /var/cache/nginx            2>/dev/null || true
    install -dm755 -o nginx -g nginx /var/cache/nginx/client_temp 2>/dev/null || true
    install -dm755 -o nginx -g nginx /var/cache/nginx/proxy_temp  2>/dev/null || true

    # The self-signed cert + key at /etc/nginx/ssl/ are NOT generated here.
    # nginx-tls-keygen.service (which nginx.service Requires=) generates them
    # per-machine on the target at first service start — never at build/install
    # time, so no shared key material ships in the archive (F43).

    systemctl daemon-reload                              2>/dev/null || true
    apparmor_parser -r /etc/apparmor.d/usr.sbin.nginx    2>/dev/null || true
