#!/usr/bin/env bash
#
# Puppet ENC entrypoint. Puppet's exec node_terminus invokes:
#     external_nodes = /usr/local/bin/encapi-enc
# and calls it as `encapi-enc <certname>`. This shim forwards to
# `encapi-cli classify <certname>`, sourcing /etc/encapi/enc.conf for
# ENCAPI_URL (and, if reads were ever locked down, ENCAPI_WRITE_TOKEN).
set -euo pipefail

[ -r /etc/encapi/enc.conf ] && . /etc/encapi/enc.conf

exec /usr/local/bin/encapi-cli classify "$1"