From 8d1c27cafdbeebb8f8d4d297fc07d5aa1c8f418a Mon Sep 17 00:00:00 2001
From: Ed Geraghty <ed@geraghty.family>
Date: Mon, 25 Aug 2025 17:50:53 +0100
Subject: [PATCH 01/10] Move logging out to a helper script

Means we can reuse the logic
---
 Dockerfile                      |  6 +--
 scripts/container-entrypoint.sh | 68 +++++----------------------------
 scripts/logging.sh              | 62 ++++++++++++++++++++++++++++++
 3 files changed, 74 insertions(+), 62 deletions(-)
 create mode 100644 scripts/logging.sh

diff --git a/Dockerfile b/Dockerfile
index dd6798b..065f959 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -118,8 +118,8 @@ FROM alpine:${MAIN_IMAGE_ALPINE_VERSION}
     COPY ./templates/Caddyfile-http.template /etc/caddy/Caddyfile-http
     COPY ./templates/Caddyfile-https.template /etc/caddy/Caddyfile-https
 
-    # Copy and setup entrypoint script
-    COPY --chmod=755 ./scripts/container-entrypoint.sh /container-entrypoint.sh
+    # Copy and setup scripts into a safe bin directory
+    COPY --chmod=755 ./scripts/ /usr/local/bin/
 
     # Default HTTPS port - override with $PUBLIC_LISTEN_PORT environment variable
     EXPOSE 443
@@ -128,4 +128,4 @@ FROM alpine:${MAIN_IMAGE_ALPINE_VERSION}
     HEALTHCHECK --interval=30s --timeout=10s --start-period=30s --retries=3 \
         CMD headscale version && caddy version || exit 1
 
-    ENTRYPOINT ["/container-entrypoint.sh"]
+    ENTRYPOINT ["/usr/local/bin/container-entrypoint.sh"]
diff --git a/scripts/container-entrypoint.sh b/scripts/container-entrypoint.sh
index 6bec04e..7040fec 100755
--- a/scripts/container-entrypoint.sh
+++ b/scripts/container-entrypoint.sh
@@ -5,6 +5,15 @@
 
 set -euo pipefail
 
+helper="$(dirname "${BASH_SOURCE[0]}")/logging.sh"
+if [[ -r "${helper}" ]]; then
+	# shellcheck source=/dev/null
+	source "${helper}"
+else
+	echo "Missing helper file: ${helper}" >&2
+	exit 1
+fi
+
 # Global flags
 abort_config=false
 litestream_enabled=true
@@ -27,65 +36,6 @@ ACME_EAB_BLOCK=""
 CLOUDFLARE_ACME_BLOCK=""
 SECURITY_HEADERS_BLOCK=""
 
-#######################################
-# Log with different levels
-# Arguments:
-#   $1 - Log level (INFO, WARN, ERROR)
-#   $2 - Message to log
-#######################################
-log_with_level() {
-    local level="${1}"
-    local message="${2}"
-    local timestamp;
-
-	timestamp=$(date +"%Y-%m-%d %H:%M:%S")
-
-	case "${level^^}" in
-        ERROR)
-            echo "[${timestamp}] ERROR: ${message}" >&2
-            ;;
-        WARN)
-            echo "[${timestamp}] WARN: ${message}" >&2
-            ;;
-        *)
-            echo "[${timestamp}] INFO: ${message}"
-            ;;
-    esac
-}
-
-#######################################
-# Log an informational message
-# Arguments:
-#   `$1` - Message to log
-#######################################
-log_info() {
-    log_with_level "INFO" "${1}"
-}
-
-#######################################
-# Log a warning message
-# Arguments:
-#   `$1` - Message to log
-#######################################
-log_warn() {
-    log_with_level "WARN" "${1}"
-}
-
-#######################################
-# Log an error message and set abort flag
-# Arguments:
-#   `$1` - Message to log
-# Globals:
-#   `abort_config`
-# Returns:
-#   `false`
-#######################################
-log_error() {
-    log_with_level "ERROR" "${1}"
-    abort_config=true
-    false
-}
-
 #######################################
 # Check if an environment variable is defined. This explicitly includes `null` and `empty string`.
 # Arguments:
diff --git a/scripts/logging.sh b/scripts/logging.sh
new file mode 100644
index 0000000..25742e9
--- /dev/null
+++ b/scripts/logging.sh
@@ -0,0 +1,62 @@
+#!/bin/bash
+
+#######################################
+# Log with different levels
+# Arguments:
+#   $1 - Log level (INFO, WARN, ERROR)
+#   $2 - Message to log
+#######################################
+log_with_level() {
+    local level="${1}"
+    local message="${2}"
+    local timestamp;
+
+    timestamp=$(date +"%Y-%m-%d %H:%M:%S")
+
+    case "${level^^}" in
+        ERROR)
+            echo "[${timestamp}] ERROR: ${message}" >&2
+            ;;
+        WARN)
+            echo "[${timestamp}] WARN: ${message}" >&2
+            ;;
+        *)
+            echo "[${timestamp}] INFO: ${message}"
+            ;;
+    esac
+}
+
+#######################################
+# Log an informational message
+# Arguments:
+#   `$1` - Message to log
+#######################################
+log_info() {
+    log_with_level "INFO" "${1}"
+}
+
+#######################################
+# Log a warning message
+# Arguments:
+#   `$1` - Message to log
+#######################################
+log_warn() {
+    log_with_level "WARN" "${1}"
+}
+
+#######################################
+# Log an error message and set abort flag
+# Arguments:
+#   `$1` - Message to log
+# Globals:
+#   `abort_config`
+# Returns:
+#   `false`
+#######################################
+log_error() {
+    log_with_level "ERROR" "${1}"
+    # Ensure caller can rely on abort_config being set; the main script defines it but
+    # if not present yet this will create it in the current shell environment.
+    abort_config=true
+    false
+}

From ce719d4b275b90a2c60718128fdbc96a5697c5ef Mon Sep 17 00:00:00 2001
From: Ed Geraghty <ed@geraghty.family>
Date: Mon, 25 Aug 2025 18:03:30 +0100
Subject: [PATCH 02/10] Move variables check out, and generalise sourcing

---
 scripts/container-entrypoint.sh | 107 ++++++--------------------------
 scripts/variables-check.sh      |  82 ++++++++++++++++++++++++
 2 files changed, 100 insertions(+), 89 deletions(-)
 create mode 100644 scripts/variables-check.sh

diff --git a/scripts/container-entrypoint.sh b/scripts/container-entrypoint.sh
index 7040fec..f995f9d 100755
--- a/scripts/container-entrypoint.sh
+++ b/scripts/container-entrypoint.sh
@@ -5,14 +5,11 @@
 
 set -euo pipefail
 
-helper="$(dirname "${BASH_SOURCE[0]}")/logging.sh"
-if [[ -r "${helper}" ]]; then
-	# shellcheck source=/dev/null
-	source "${helper}"
-else
-	echo "Missing helper file: ${helper}" >&2
-	exit 1
-fi
+# Minimal associative array of helper scripts (edit to add names)
+declare helper_scripts=(
+	"logging.sh"
+	"variables-check.sh"
+)
 
 # Global flags
 abort_config=false
@@ -36,36 +33,6 @@ ACME_EAB_BLOCK=""
 CLOUDFLARE_ACME_BLOCK=""
 SECURITY_HEADERS_BLOCK=""
 
-#######################################
-# Check if an environment variable is defined. This explicitly includes `null` and `empty string`.
-# Arguments:
-#   $1 - Variable name
-# Returns:
-#   `true` if defined, otherwise `false`
-#######################################
-env_var_is_defined() {
-	# Only allow variable names with letters, numbers, and underscores, not starting with a number
-	if ! [[ "${1}" =~ ^[a-zA-Z_][a-zA-Z0-9_]*$ ]]; then
-		log_error "Invalid environment variable name: '${1}'"
-		return
-	fi
-
-	# Consider a variable defined if it is set in the environment, even if the value is an empty string.
-	# ${param+word} expands to 'word' when the parameter is set (even if null), otherwise empty.
-	[[ "${!1+set}" == "set" ]]
-}
-
-#######################################
-# Ensure an environment variable is populated
-# Arguments:
-#   $1 - Variable name
-# Returns:
-#   `true` if populated, otherwise `false`
-#######################################
-require_env_var() {
-	env_var_is_defined "${1}" || log_error "Environment variable '${1}' is required"
-}
-
 ########################################
 # Create a directory if it doesn't exist
 # Arguments:
@@ -80,31 +47,6 @@ create_directory_if_not_exists() {
 	fi
 }
 
-########################################
-# Check environment variable is set, or default (and optionally validate with regex - now you have two problems)
-# Arguments:
-#   $1 - Variable name
-#   $2 - Default value
-#   $3 - Validation regex pattern (optional)
-#   $4 - Error message for invalid values (optional)
-########################################
-check_env_var_or_set_default() {
-	local var_name="${1}"
-	local default_value="${2}"
-	local pattern="${3:-}"
-	local error_msg="${4:-}"
-	
-	# Set default value if variable is not populated
-	if ! env_var_is_defined "${var_name}"; then
-		export "${var_name}"="${default_value}"
-	fi
-	
-	# Validate with regex if pattern provided
-	if [[ -n "${pattern}" && ! "${!var_name}" =~ ${pattern} ]]; then
-		log_error "${error_msg:-"Invalid '${var_name}' value: '${!var_name}'"}"
-	fi
-}
-
 ########################################
 # Log enabled/disabled status for configuration summary
 # Arguments:
@@ -130,32 +72,6 @@ log_feature_status() {
 	fi
 }
 
-#######################################
-# Validate a port number
-# Arguments:
-#   $1 - Variable name containing the port
-# Returns:
-#   `true` if deemed valid, otherwise `false`
-#######################################
-validate_port() {
-    local port="${1}"
-
-    # Make sure our port is numeric
-    if ! [[ "${!port}" =~ ^[0-9]+$ ]]; then
-        log_error "Port '${port}' is not numeric."
-    fi
-
-    # Check no leading zeros (except for port '0')
-    if [[ "${!port}" =~ ^0[0-9]+$ ]]; then
-        log_error "Port '${port}' has a leading zero."
-    fi
-
-    # Check port is within valid range
-    if [[ "${!port}" -lt 1 ]] || [[ "${!port}" -gt 65535 ]]; then
-        log_error "Port '${port}' must be a valid port within the range of 1-65535."
-    fi
-}
-
 #######################################
 # Generic configuration file creator with template substitution
 # Arguments:
@@ -684,4 +600,17 @@ run() {
 	start_headscale_service
 }
 
+helpers_dir="$(dirname "${BASH_SOURCE[0]}")"
+
+for key in "${!helper_scripts[@]}"; do
+	helper="${helpers_dir}/${helper_scripts[$key]}"
+	if [[ -r "${helper}" ]]; then
+		# shellcheck source=/dev/null
+		source "${helper}"
+	else
+		echo "Missing helper file: ${helper}" >&2
+		exit 1
+	fi
+done
+
 run
diff --git a/scripts/variables-check.sh b/scripts/variables-check.sh
new file mode 100644
index 0000000..b5f3fb9
--- /dev/null
+++ b/scripts/variables-check.sh
@@ -0,0 +1,82 @@
+#!/bin/bash
+
+#######################################
+# Check if an environment variable is defined. This explicitly includes `null` and `empty string`.
+# Arguments:
+#   $1 - Variable name
+# Returns:
+#   `true` if defined, otherwise `false`
+#######################################
+env_var_is_defined() {
+	# Only allow variable names with letters, numbers, and underscores, not starting with a number
+	if ! [[ "${1}" =~ ^[a-zA-Z_][a-zA-Z0-9_]*$ ]]; then
+		log_error "Invalid environment variable name: '${1}'"
+		return
+	fi
+
+	# Consider a variable defined if it is set in the environment, even if the value is an empty string.
+	# ${param+word} expands to 'word' when the parameter is set (even if null), otherwise empty.
+	[[ "${!1+set}" == "set" ]]
+}
+
+#######################################
+# Ensure an environment variable is populated
+# Arguments:
+#   $1 - Variable name
+# Returns:
+#   `true` if populated, otherwise `false`
+#######################################
+require_env_var() {
+	env_var_is_defined "${1}" || log_error "Environment variable '${1}' is required"
+}
+
+########################################
+# Check environment variable is set, or default (and optionally validate with regex - now you have two problems)
+# Arguments:
+#   $1 - Variable name
+#   $2 - Default value
+#   $3 - Validation regex pattern (optional)
+#   $4 - Error message for invalid values (optional)
+########################################
+check_env_var_or_set_default() {
+	local var_name="${1}"
+	local default_value="${2}"
+	local pattern="${3:-}"
+	local error_msg="${4:-}"
+	
+	# Set default value if variable is not populated
+	if ! env_var_is_defined "${var_name}"; then
+		export "${var_name}"="${default_value}"
+	fi
+	
+	# Validate with regex if pattern provided
+	if [[ -n "${pattern}" && ! "${!var_name}" =~ ${pattern} ]]; then
+		log_error "${error_msg:-"Invalid '${var_name}' value: '${!var_name}'"}"
+	fi
+}
+
+#######################################
+# Validate a port number
+# Arguments:
+#   $1 - Variable name containing the port
+# Returns:
+#   `true` if deemed valid, otherwise `false`
+#######################################
+validate_port() {
+    local port="${1}"
+
+    # Make sure our port is numeric
+    if ! [[ "${!port}" =~ ^[0-9]+$ ]]; then
+        log_error "Port '${port}' is not numeric."
+    fi
+
+    # Check no leading zeros (except for port '0')
+    if [[ "${!port}" =~ ^0[0-9]+$ ]]; then
+        log_error "Port '${port}' has a leading zero."
+    fi
+
+    # Check port is within valid range
+    if [[ "${!port}" -lt 1 ]] || [[ "${!port}" -gt 65535 ]]; then
+        log_error "Port '${port}' must be a valid port within the range of 1-65535."
+    fi
+}

From 771ea2f064e3c31514d0b70f06ccf48d5c857266 Mon Sep 17 00:00:00 2001
From: Ed Geraghty <ed@geraghty.family>
Date: Mon, 25 Aug 2025 18:09:38 +0100
Subject: [PATCH 03/10] Fix the function name

---
 scripts/container-entrypoint.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/container-entrypoint.sh b/scripts/container-entrypoint.sh
index f995f9d..5b89b9a 100755
--- a/scripts/container-entrypoint.sh
+++ b/scripts/container-entrypoint.sh
@@ -5,7 +5,7 @@
 
 set -euo pipefail
 
-# Minimal associative array of helper scripts (edit to add names)
+# Minimal associative array of helper scripts
 declare helper_scripts=(
 	"logging.sh"
 	"variables-check.sh"

From e3c89f404461bbdfdd7ef6f34eaf15ced3be703c Mon Sep 17 00:00:00 2001
From: Ed Geraghty <ed@geraghty.family>
Date: Mon, 25 Aug 2025 18:10:05 +0100
Subject: [PATCH 04/10] Move defaults to a helper

---
 scripts/container-entrypoint.sh | 13 +------------
 scripts/defaults.sh             | 14 ++++++++++++++
 2 files changed, 15 insertions(+), 12 deletions(-)
 create mode 100644 scripts/defaults.sh

diff --git a/scripts/container-entrypoint.sh b/scripts/container-entrypoint.sh
index 5b89b9a..f19cca9 100755
--- a/scripts/container-entrypoint.sh
+++ b/scripts/container-entrypoint.sh
@@ -7,6 +7,7 @@ set -euo pipefail
 
 # Minimal associative array of helper scripts
 declare helper_scripts=(
+	"defaults.sh"
 	"logging.sh"
 	"variables-check.sh"
 )
@@ -15,18 +16,6 @@ declare helper_scripts=(
 abort_config=false
 litestream_enabled=true
 https_enabled=true
-caddyfile_cleartext=/etc/caddy/Caddyfile-http
-caddyfile_https=/etc/caddy/Caddyfile-https
-headscale_config="/etc/headscale/config.yaml"
-
-# Defaults used throughout the script
-public_listen_port_default=443
-headscale_extra_records_path_default="/data/headscale/extra-records.json"
-headscale_magic_dns_default="true"
-headscale_ipv6_prefix_default="fd7a:115c:a1e0::/48"
-headscale_ipv4_prefix_default="100.64.0.0/10"
-headscale_ip_allocation_default="sequential"
-headscale_gomaxprocs_default=1
 
 # Caddyfile block placeholders 
 ACME_EAB_BLOCK=""
diff --git a/scripts/defaults.sh b/scripts/defaults.sh
new file mode 100644
index 0000000..52846a8
--- /dev/null
+++ b/scripts/defaults.sh
@@ -0,0 +1,14 @@
+#!/bin/bash
+# shellcheck disable=SC2034 # This is a defaults file
+caddyfile_cleartext=/etc/caddy/Caddyfile-http
+caddyfile_https=/etc/caddy/Caddyfile-https
+headscale_config="/etc/headscale/config.yaml"
+
+# Defaults used throughout the script
+public_listen_port_default=443
+headscale_extra_records_path_default="/data/headscale/extra-records.json"
+headscale_magic_dns_default="true"
+headscale_ipv6_prefix_default="fd7a:115c:a1e0::/48"
+headscale_ipv4_prefix_default="100.64.0.0/10"
+headscale_ip_allocation_default="sequential"
+headscale_gomaxprocs_default=1
\ No newline at end of file

From 036d48ee2cdc56f7e4b56b796bce0ebd03b01a7b Mon Sep 17 00:00:00 2001
From: Ed Geraghty <ed@geraghty.family>
Date: Mon, 25 Aug 2025 18:10:20 +0100
Subject: [PATCH 05/10] Move feature logging to the logging helper

---
 scripts/container-entrypoint.sh | 25 -------------------------
 scripts/logging.sh              | 25 +++++++++++++++++++++++++
 2 files changed, 25 insertions(+), 25 deletions(-)

diff --git a/scripts/container-entrypoint.sh b/scripts/container-entrypoint.sh
index f19cca9..62ba217 100755
--- a/scripts/container-entrypoint.sh
+++ b/scripts/container-entrypoint.sh
@@ -36,31 +36,6 @@ create_directory_if_not_exists() {
 	fi
 }
 
-########################################
-# Log enabled/disabled status for configuration summary
-# Arguments:
-#   $1 - Feature name
-#   $2 - Boolean condition (true/false)
-#   $3 - Optional additional info when enabled
-#   $4 - Optional: "warn" to use log_warn when disabled, otherwise uses log_info
-########################################
-log_feature_status() {
-	local feature="${1}"
-	local condition="${2}"
-	local extra_info="${3:-}"
-	local warn_on_false="${4:-}"
-	
-	if ${condition}; then
-		log_info "${feature}: enabled${extra_info:+ (${extra_info})}"
-	else
-		if [[ "${warn_on_false}" == "warn" ]]; then
-			log_warn "${feature}: disabled"
-		else
-			log_info "${feature}: disabled"
-		fi
-	fi
-}
-
 #######################################
 # Generic configuration file creator with template substitution
 # Arguments:
diff --git a/scripts/logging.sh b/scripts/logging.sh
index 25742e9..be751ff 100644
--- a/scripts/logging.sh
+++ b/scripts/logging.sh
@@ -60,3 +60,28 @@ log_error() {
     abort_config=true
     false
 }
+
+########################################
+# Log enabled/disabled status for configuration summary
+# Arguments:
+#   $1 - Feature name
+#   $2 - Boolean condition (true/false)
+#   $3 - Optional additional info when enabled
+#   $4 - Optional: "warn" to use log_warn when disabled, otherwise uses log_info
+########################################
+log_feature_status() {
+	local feature="${1}"
+	local condition="${2}"
+	local extra_info="${3:-}"
+	local warn_on_false="${4:-}"
+	
+	if ${condition}; then
+		log_info "${feature}: enabled${extra_info:+ (${extra_info})}"
+	else
+		if [[ "${warn_on_false}" == "warn" ]]; then
+			log_warn "${feature}: disabled"
+		else
+			log_info "${feature}: disabled"
+		fi
+	fi
+}

From 6842559d0ee151f6eeca94f00385e31127671fc5 Mon Sep 17 00:00:00 2001
From: Ed Geraghty <ed@geraghty.family>
Date: Mon, 25 Aug 2025 18:13:45 +0100
Subject: [PATCH 06/10] Reorganise our defaults

---
 scripts/defaults.sh | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/scripts/defaults.sh b/scripts/defaults.sh
index 52846a8..e64efd0 100644
--- a/scripts/defaults.sh
+++ b/scripts/defaults.sh
@@ -1,14 +1,14 @@
 #!/bin/bash
 # shellcheck disable=SC2034 # This is a defaults file
-caddyfile_cleartext=/etc/caddy/Caddyfile-http
-caddyfile_https=/etc/caddy/Caddyfile-https
-headscale_config="/etc/headscale/config.yaml"
-
-# Defaults used throughout the script
 public_listen_port_default=443
+
 headscale_extra_records_path_default="/data/headscale/extra-records.json"
 headscale_magic_dns_default="true"
 headscale_ipv6_prefix_default="fd7a:115c:a1e0::/48"
 headscale_ipv4_prefix_default="100.64.0.0/10"
 headscale_ip_allocation_default="sequential"
-headscale_gomaxprocs_default=1
\ No newline at end of file
+headscale_gomaxprocs_default=1
+
+caddyfile_cleartext=/etc/caddy/Caddyfile-http
+caddyfile_https=/etc/caddy/Caddyfile-https
+headscale_config="/etc/headscale/config.yaml"

From d0e726a65b6554aeda397b62f957c2cd777f3050 Mon Sep 17 00:00:00 2001
From: Ed Geraghty <ed@geraghty.family>
Date: Mon, 25 Aug 2025 18:25:37 +0100
Subject: [PATCH 07/10] Move file operations out to a helper script

---
 scripts/container-entrypoint.sh | 49 +--------------------------------
 scripts/file-operations.sh      | 49 +++++++++++++++++++++++++++++++++
 2 files changed, 50 insertions(+), 48 deletions(-)
 create mode 100644 scripts/file-operations.sh

diff --git a/scripts/container-entrypoint.sh b/scripts/container-entrypoint.sh
index 62ba217..44f2403 100755
--- a/scripts/container-entrypoint.sh
+++ b/scripts/container-entrypoint.sh
@@ -10,6 +10,7 @@ declare helper_scripts=(
 	"defaults.sh"
 	"logging.sh"
 	"variables-check.sh"
+	"file-operations.sh"
 )
 
 # Global flags
@@ -22,54 +23,6 @@ ACME_EAB_BLOCK=""
 CLOUDFLARE_ACME_BLOCK=""
 SECURITY_HEADERS_BLOCK=""
 
-########################################
-# Create a directory if it doesn't exist
-# Arguments:
-#   $1 - Directory path
-# Side Effects:
-#   Calls log_error and sets abort_config=true on failure
-########################################
-create_directory_if_not_exists() {
-	local dir="${1}"
-	if [[ ! -d "${dir}" ]]; then
-		mkdir -p "${dir}" || log_error "Unable to create directory '${dir}'."
-	fi
-}
-
-#######################################
-# Generic configuration file creator with template substitution
-# Arguments:
-#   $1 - Target config file path
-#   $2 - Description for logging
-#   $3 - File permissions (optional, defaults to 600)
-#######################################
-create_config_from_template() {
-    local config_path="${1}"
-    local description="${2}"
-    local permissions="${3:-600}"
-    local temp_config_path
-    
-    temp_config_path=$(mktemp) || {
-        log_error "Unable to create temporary file for ${description}"
-		return
-    }
-
-    if envsubst < "${config_path}" > "${temp_config_path}"; then
-        chmod "${permissions}" "${temp_config_path}"
-        if mv "${temp_config_path}" "${config_path}"; then
-            return
-        else
-            log_error "Unable to move ${description} to final location"
-            rm -f "${temp_config_path}"
-        fi
-    else
-        log_error "Unable to generate ${description}"
-        rm -f "${temp_config_path}"
-    fi
-
-	return
-}
-
 #######################################
 # Set default or validate PUBLIC_LISTEN_PORT
 #######################################
diff --git a/scripts/file-operations.sh b/scripts/file-operations.sh
new file mode 100644
index 0000000..c8f53cf
--- /dev/null
+++ b/scripts/file-operations.sh
@@ -0,0 +1,49 @@
+#!/bin/bash
+
+#######################################
+# Generic configuration file creator with template substitution
+# Arguments:
+#   $1 - Target config file path
+#   $2 - Description for logging
+#   $3 - File permissions (optional, defaults to 600)
+#######################################
+create_config_from_template() {
+    local config_path="${1}"
+    local description="${2}"
+    local permissions="${3:-600}"
+    local temp_config_path
+    
+    temp_config_path=$(mktemp) || {
+        log_error "Unable to create temporary file for ${description}"
+		return
+    }
+
+    if envsubst < "${config_path}" > "${temp_config_path}"; then
+        chmod "${permissions}" "${temp_config_path}"
+        if mv "${temp_config_path}" "${config_path}"; then
+            return
+        else
+            log_error "Unable to move ${description} to final location"
+            rm -f "${temp_config_path}"
+        fi
+    else
+        log_error "Unable to generate ${description}"
+        rm -f "${temp_config_path}"
+    fi
+
+	return
+}
+
+########################################
+# Create a directory if it doesn't exist
+# Arguments:
+#   $1 - Directory path
+# Side Effects:
+#   Calls log_error and sets abort_config=true on failure
+########################################
+create_directory_if_not_exists() {
+	local dir="${1}"
+	if [[ ! -d "${dir}" ]]; then
+		mkdir -p "${dir}" || log_error "Unable to create directory '${dir}'."
+	fi
+}

From e6f74abc795f55808ef94b4a99d0a719712c2b14 Mon Sep 17 00:00:00 2001
From: Ed Geraghty <ed@geraghty.family>
Date: Mon, 25 Aug 2025 18:27:45 +0100
Subject: [PATCH 08/10] Quieten the linter

---
 scripts/logging.sh | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/scripts/logging.sh b/scripts/logging.sh
index be751ff..72d1cd6 100644
--- a/scripts/logging.sh
+++ b/scripts/logging.sh
@@ -1,5 +1,7 @@
 #!/bin/bash
 
+# shellcheck disable=SC2034 # This is a helper file
+
 #######################################
 # Log with different levels
 # Arguments:

From 05428bacf3e1d9ea219098ff29132ec625512c36 Mon Sep 17 00:00:00 2001
From: Ed Geraghty <ed@geraghty.family>
Date: Mon, 25 Aug 2025 18:40:24 +0100
Subject: [PATCH 09/10] Use modern bash array iteration

I'm too old
---
 scripts/container-entrypoint.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/scripts/container-entrypoint.sh b/scripts/container-entrypoint.sh
index 44f2403..b1bb5d4 100755
--- a/scripts/container-entrypoint.sh
+++ b/scripts/container-entrypoint.sh
@@ -519,8 +519,8 @@ run() {
 
 helpers_dir="$(dirname "${BASH_SOURCE[0]}")"
 
-for key in "${!helper_scripts[@]}"; do
-	helper="${helpers_dir}/${helper_scripts[$key]}"
+for helper_script in "${helper_scripts[@]}"; do
+    helper="${helpers_dir}/${helper_script}"
 	if [[ -r "${helper}" ]]; then
 		# shellcheck source=/dev/null
 		source "${helper}"

From 0123fb7273261fcf468ba5fc5c05ebe676d56366 Mon Sep 17 00:00:00 2001
From: Ed Geraghty <ed@geraghty.family>
Date: Mon, 25 Aug 2025 18:41:20 +0100
Subject: [PATCH 10/10] Fix clunky comment

---
 scripts/container-entrypoint.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/container-entrypoint.sh b/scripts/container-entrypoint.sh
index b1bb5d4..196f8a0 100755
--- a/scripts/container-entrypoint.sh
+++ b/scripts/container-entrypoint.sh
@@ -5,7 +5,7 @@
 
 set -euo pipefail
 
-# Minimal associative array of helper scripts
+# Helper scripts
 declare helper_scripts=(
 	"defaults.sh"
 	"logging.sh"