"""Daemon-startup filesystem bootstrap.

Runs once at daemon startup, after the system-config import and before the
first state collection. Creates the runtime directories subsystems
read/write and persists the one-shot nginx legacy-format migration.

Config *files* are deliberately NOT created here: ``get_config`` reads are
pure and return in-memory defaults, and the system-config import must see
absent files in order to adopt live system state on first start. Files are
materialized on the first ``save_config`` (or by the import itself).
"""

from lib import dnsmasq, firewall, network, nginx, wireguard
from lib.common import ensure_dirs

__all__ = ["bootstrap"]


def bootstrap() -> None:
    """Create runtime directories and persist the one-shot nginx migration.

    Idempotent — existing directories are left untouched and the nginx
    migration only rewrites the on-disk file when it actually changes.
    """
    ensure_dirs(
        dnsmasq.CONFIG_DIR,
        dnsmasq.DATA_DIR,
        dnsmasq.FRAGMENTS_DIR,
        firewall.CONFIG_DIR,
        firewall.DATA_DIR,
        network.CONFIG_DIR,
        network.DATA_DIR,
        nginx.CONFIG_DIR,
        nginx.SITES_DIR,
        wireguard.CONFIG_PATH.parent,
    )
    # One-shot legacy-format migration for the nginx config (see
    # ``lib.nginx.get_config``). Runs here, at startup, so read paths stay
    # side-effect free.
    nginx.migrate_config_file()