#!/bin/bash

# VPN Client app for YunoHost
# Copyright (C) 2015 Julien Vaubourg <julien@vaubourg.com>
# Contribute at https://github.com/labriqueinternet/vpnclient_ynh
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU Affero General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU Affero General Public License for more details.
#
# You should have received a copy of the GNU Affero General Public License
# along with this program.  If not, see <http://www.gnu.org/licenses/>.

#=================================================
# GENERIC START
#=================================================
# IMPORT GENERIC HELPERS
#=================================================

source _common.sh
source /usr/share/yunohost/helpers

#=================================================
# MANAGE SCRIPT FAILURE
#=================================================

# Exit if an error occurs during the execution of the script
ynh_abort_if_errors

#=================================================
# RETRIEVE ARGUMENTS FROM THE MANIFEST
#=================================================

# Retrieve arguments
domain=$YNH_APP_ARG_DOMAIN
path_url=$YNH_APP_ARG_PATH

app=$YNH_APP_INSTANCE_NAME

#=================================================
# CHECK IF THE APP CAN BE INSTALLED WITH THESE ARGS
#=================================================

# Check destination directory
final_path="/var/www/$app"
test ! -e "$final_path" || ynh_die "This path already contains a folder"

# Normalize the url path syntax
path_url=$(ynh_normalize_url_path "$path_url")

# Check web path availability
ynh_webpath_available "$domain" "$path_url"
# Register (book) web path
ynh_webpath_register "$app" "$domain" "$path_url"

#=================================================
# STORE SETTINGS FROM MANIFEST
#=================================================

ynh_app_setting_set "$app" domain "$domain"
ynh_app_setting_set "$app" final_path "$final_path"

#=================================================
# STANDARD MODIFICATIONS
#=================================================
# INSTALL DEPENDENCIES
#=================================================

ynh_install_app_dependencies "$pkg_dependencies"

#=================================================
# SPECIFIC SETUP
#=================================================

# This is an upgrade?
upgrade=$([ -z ${VPNCLIENT_UPGRADE+x} ] && echo true || echo false)

if ! $upgrade; then

  # Save arguments
  ynh_app_setting_set $app service_enabled 0
  ynh_app_setting_set $app server_name none
  ynh_app_setting_set $app server_port 1194
  ynh_app_setting_set $app server_proto udp
  ynh_app_setting_set $app ip6_addr none
  ynh_app_setting_set $app ip6_net none
  ynh_app_setting_set $app login_user "${login_user}"
  ynh_app_setting_set $app login_passphrase "${login_passphrase}"
  ynh_app_setting_set $app dns0 89.234.141.66
  ynh_app_setting_set $app dns1 2001:913::8

fi

# Install IPv6 scripts
sudo install -o root -g root -m 0755 ../conf/ipv6_expanded /usr/local/bin/
sudo install -o root -g root -m 0755 ../conf/ipv6_compressed /usr/local/bin/

# Install command-line cube file loader
sudo install -o root -g root -m 0755 ../conf/ynh-vpnclient-loadcubefile.sh /usr/local/bin/

# Copy confs
sudo mkdir -pm 0755 /var/log/nginx/
sudo chown root:admins /etc/openvpn/
sudo chmod 775 /etc/openvpn/
sudo mkdir -pm 0755 /etc/yunohost/hooks.d/post_iptable_rules/

sudo install -b -o root -g admins -m 0664 ../conf/openvpn_client.conf.tpl /etc/openvpn/client.conf.tpl
sudo install -o root -g root -m 0644 ../conf/openvpn_client.conf.tpl /etc/openvpn/client.conf.tpl.restore
sudo install -b -o root -g root -m 0644 ../conf/nginx_vpnadmin.conf "/etc/nginx/conf.d/${domain}.d/vpnadmin.conf"
sudo install -b -o root -g root -m 0644 ../conf/phpfpm_vpnadmin.conf /etc/php5/fpm/pool.d/vpnadmin.conf
sudo install -b -o root -g root -m 0755 ../conf/hook_post-iptable-rules /etc/yunohost/hooks.d/90-vpnclient.tpl
sudo install -b -o root -g root -m 0644 ../conf/openvpn@.service /etc/systemd/system/

# Copy web sources
sudo mkdir -pm 0755 /var/www/vpnadmin/
sudo cp -a ../sources/* /var/www/vpnadmin/

sudo chown -R root: /var/www/vpnadmin/
sudo chmod -R 0644 /var/www/vpnadmin/*
sudo find /var/www/vpnadmin/ -type d -exec chmod +x {} \;

# Create certificates directory
sudo mkdir -pm 0770 /etc/openvpn/keys/
sudo chown root:admins /etc/openvpn/keys/

#=================================================
# NGINX CONFIGURATION
#=================================================

sudo sed "s|<TPL:NGINX_LOCATION>|${path_url}|g" -i "/etc/nginx/conf.d/${domain}.d/vpnadmin.conf"
sudo sed 's|<TPL:NGINX_REALPATH>|/var/www/vpnadmin/|g' -i "/etc/nginx/conf.d/${domain}.d/vpnadmin.conf"
sudo sed 's|<TPL:PHP_NAME>|vpnadmin|g' -i "/etc/nginx/conf.d/${domain}.d/vpnadmin.conf"

#=================================================
# PHP-FPM CONFIGURATION
#=================================================

sudo sed 's|<TPL:PHP_NAME>|vpnadmin|g' -i /etc/php5/fpm/pool.d/vpnadmin.conf
sudo sed 's|<TPL:PHP_USER>|admin|g' -i /etc/php5/fpm/pool.d/vpnadmin.conf
sudo sed 's|<TPL:PHP_GROUP>|admins|g' -i /etc/php5/fpm/pool.d/vpnadmin.conf
sudo sed 's|<TPL:NGINX_REALPATH>|/var/www/vpnadmin/|g' -i /etc/php5/fpm/pool.d/vpnadmin.conf

# Fix sources
sudo sed "s|<TPL:NGINX_LOCATION>|${path_url}|g" -i /var/www/vpnadmin/config.php

# Copy init script
sudo install -o root -g root -m 0755 ../conf/ynh-vpnclient /usr/local/bin/
sudo install -o root -g root -m 0644 ../conf/ynh-vpnclient.service /etc/systemd/system/

# Copy checker timer
sudo install -o root -g root -m 0755 ../conf/ynh-vpnclient-checker.sh /usr/local/bin/
sudo install -o root -g root -m 0644 ../conf/ynh-vpnclient-checker.service /etc/systemd/system/
sudo install -o root -g root -m 0644 ../conf/ynh-vpnclient-checker.timer /etc/systemd/system/

# Set default inits
# The boot order of these services are important, so they are disabled by default
# and the ynh-vpnclient service handles them.
sudo systemctl disable openvpn
sudo systemctl stop openvpn

sudo systemctl enable php5-fpm
sudo systemctl restart php5-fpm

sudo systemctl reload nginx

sudo systemctl enable ynh-vpnclient
sudo yunohost service add ynh-vpnclient

ynh_systemctl start ynh-vpnclient-checker.service
sudo systemctl enable ynh-vpnclient-checker.service
ynh_systemctl start ynh-vpnclient-checker.timer
sudo systemctl enable ynh-vpnclient-checker.timer

if ! $upgrade; then
  ynh_systemctl start ynh-vpnclient

  # Check configuration consistency

  if [ -z "${crt_server_ca_path}" ]; then
    echo "WARNING: VPN Client is not started because you need to define a server CA through the web admin" >&2
  fi

  if [ -z "${crt_client_key_path}" -a -z "${login_user}" ]; then
    echo "WARNING: VPN Client is not started because you need either a client certificate, either a username (or both)" >&2
  fi
fi

sudo yunohost app ssowatconf