#!/bin/sh
set -e

python manage.py migrate --noinput
python manage.py ensure_admin
python manage.py purge_ratelimits

# Forwarded headers are evaluated by core.middleware.ProxyMiddleware (TRUSTED_PROXIES),
# not by gunicorn, so gunicorn keeps its default of trusting none of them from remote peers.
# The control socket (gunicorn >= 26) is not used and /app is read-only for the app user.
exec gunicorn config.wsgi:application \
    --bind 0.0.0.0:8000 \
    --workers "${GUNICORN_WORKERS:-2}" \
    --threads "${GUNICORN_THREADS:-4}" \
    --timeout "${GUNICORN_TIMEOUT:-120}" \
    --no-control-socket \
    --access-logfile -