#!/usr/bin/env bash
# NodeMgmt - Galera/NGINX Node Management Scripts

action="$1"

if [ ! -f /opt/idssys/settings/nodemgmt.conf ]; then
	if [ ! -d /opt/idssys/settings ]; then
		mkdir /opt/idssys/settings
	fi
	mv /opt/idssys/nodemgmt/settings.conf /opt/idssys/settings/nodemgmt.conf
fi

source /opt/idssys/defaults/colors.inc
source /opt/idssys/defaults/default.inc
source /opt/idssys/settings/nodemgmt.conf
source /opt/idssys/nodemgmt/defaults.inc


# ========================================================= #

case "$1" in


	newcert)
		echo -e "${idsCL[LightGreen]}Requesting Certificate for '${idsCL[Yellow]}${2}${idsCL[LightGreen]}'...${idsCL[Default]}"
		do_with_root $CERT_DAEMON certonly --webroot -w /var/www/html -d $2
		do_with_root chown -R root:letsencrypt /etc/letsencrypt
		do_with_root chmod -R 6775 /etc/letsencrypt
		echo ""
		echo -e "${idsCL[LightYellow]}Waiting for certifcate replication between the nodes...${idsCL[Default]}"
		sleep 20
		${FOLDER}/nodemgmt-scripts.sh service nginx reload
		exit 0
	;;

	certrenew)
		echo -e "${idsCL[LightGreen]}Renewing Certificates...${idsCL[Default]}"
		do_with_root $CERT_DAEMON renew --webroot -w /var/www/html 2>&1 | tee /opt/idssys/nodemgmt/cert-renewal.lastrun
		do_with_root chown -R root:letsencrypt /etc/letsencrypt 2>&1 | tee -a /opt/idssys/nodemgmt/cert-renewal.lastrun
		do_with_root chmod -R 6775 /etc/letsencrypt 2>&1 | tee -a /opt/idssys/nodemgmt/cert-renewal.lastrun
		echo -e "${idsCL${idsCL[LightYellow]}}Waiting for certifcate replication between the nodes...${idsCL[Default]}"
		sleep 20
		${FOLDER}/nodemgmt-scripts.sh service nginx reload 2>&1 | tee -a /opt/idssys/nodemgmt/cert-renewal.lastrun
		exit 0
	;;

	nightlyrenew)
		rm -f /opt/idssys/nodemgmt/cert-renewal.lastrun
		do_with_root $CERT_DAEMON renew --webroot -w /var/www/html &>> /opt/idssys/nodemgmt/cert-renewal.lastrun
		do_with_root chown -R root:letsencrypt /etc/letsencrypt &>> /opt/idssys/nodemgmt/cert-renewal.lastrun
		do_with_root chmod -R 6775 /etc/letsencrypt &>> /opt/idssys/nodemgmt/cert-renewal.lastrun
		sleep 20
		${FOLDER}/nodemgmt-scripts.sh service nginx reload &>> /opt/idssys/nodemgmt/cert-renewal.lastrun
		exit 0
	;;
	
	delsite)
		DEL_SITE=${2}
		echo -e "${idsCL[LightRed]}Deleting site '${idsCL[Red]}${DEL_SITE}${idsCL[LightRed]}'...${idsCL[Default]}"
		echo ""
		
		echo -e "${idsCL[LightRed]}[[Removing Files and Folders]]${idsCL[Default]}"
		echo -e "${idsCL[LightRed]}-------------------------------------------${idsCL[Default]}"
	
		nid=1
		for nip in "${NODE_HOSTS[@]}"
		do
			if [[ $(/sbin/ip -o -4 addr list ens192 | awk '{print $4}' | cut -d/ -f1) == *"${nip}"* ]]; then
				nip='localhost'
				NCMD=''
			else
				NCMD="ssh root@${nip}"
			fi
			echo -en "Removing from iDS-Node${nid} ($nip)... ${idsCL[Default]}"
			${NCMD} rm -f /etc/nginx/sites-available/${DEL_SITE}.conf
			${NCMD} rm -f /etc/nginx/sites-enabled/${DEL_SITE}.conf
			${NCMD} rm -rf /var/www/${DEL_SITE}
			${NCMD} rm -rf /etc/letsencrypt/archive/${DEL_SITE}
			${NCMD} rm -rf /etc/letsencrypt/live/${DEL_SITE}
			${NCMD} rm -f /etc/letsencrypt/renewal/${DEL_SITE}.conf
			echo -e "${idsCL[Green]}OK${idsCL[Default]}"
			nid=`expr $nid + 1`
		done
		echo ""
		${FOLDER}/nodemgmt-scripts.sh service nginx reload
		echo -e "${idsCL[LightRed]}Site has been deleted.${idsCL[Default]}"
		
	;;
	newsite)
		while [ $# -gt 0 ]; do
		    case "$1" in
		        -site) NEW_SITE=${2};;
		        -type) SITE_TYPE=${2};;
		        -ssl) CREATE_SSL=${2};;
				-proxy_scheme) PROXYSCHEME=${2};;
				-proxy_host) PROXYHOST=${2};;
				-proxy_port) PROXYPORT=${2};;
		   	 	-*)
					echo "Invalid option: '${1}' requires an argument" 1>&2
					echo ""
					echo -e "Usage: ${idsCL[Yellow]}nodemgmt newcert${idsCL[Default]} {"
					width=33
					printf "%-${width}s- %s\n" "    -site {FQDN address(,es)}" "(*required)"
					printf "%-${width}s- %s\n" "    -ssl {true or false}" "(defaults to true)"
					printf "%-${width}s- %s\n" "    -type {'local' or 'proxy'}" "(defaults to local)"
					printf "%-${width}s- %s\n" "    -scheme {http or https}" "(required if type set to proxy)"
					printf "%-${width}s- %s\n" "    -host {IP or FQDN}" "(required if type set to proxy)"
					printf "%-${width}s- %s\n" "    -port {host port}" "(required if type set to proxy)"
					echo "}"
					exit 1;;
		    esac
			shift
		done
		
		if [ -z ${SITE_TYPE+x} ]; then SITE_TYPE=local; fi
		if [ -z ${CREATE_SSL+x} ]; then CREATE_SSL=true; fi
			
		if [ "${NEW_SITE}" != "" ]; then
			if [[ ${NEW_SITE} == *","* ]]; then
				IFS=,
				NEW_SITES=(${NEW_SITE})
				unset IFS
				MAIN_SITE=${NEW_SITES[0]}
				NGINX_SERVERNAME=${NEW_SITE//[,]/ }
			else
				MAIN_SITE=${NEW_SITE}
				NGINX_SERVERNAME=${NEW_SITE}
				
			fi
			if [ "${SITE_TYPE}" = "proxy" ]; then
				if [ ! -z ${PROXYSCHEME+x} ] && [ ! -z ${PROXYHOST+x} ] && [ ! -z ${PROXYPORT+x} ]; then GO=true; fi
				else GO=true; fi
			if [ "${GO}" = "true" ]; then
				echo -e "${idsCL[LightGreen]}Setting up new site for '${idsCL[Yellow]}${MAIN_SITE}${idsCL[LightGreen]}' {${NGINX_SERVERNAME}}...${idsCL[Default]}"
				echo ""
				if [ "${SITE_TYPE}" = "local" ]; then
					echo -e "server {
	listen 8080;" > /etc/nginx/sites-available/${MAIN_SITE}.conf
				if [ "${CREATE_SSL}" = "true" ]; then
					echo -e "	listen 8443 ssl http2;" >> /etc/nginx/sites-available/${MAIN_SITE}.conf
				fi
				echo -e "
	server_name ${NGINX_SERVERNAME};
	
	set \$base /var/www/${MAIN_SITE};
	root \$base/public_html;

	access_log  /var/www/${NEW_SITE}/nginx_logs/access.log;
	error_log  /var/www/${NEW_SITE}/nginx_logs/error.log warn;" >> /etc/nginx/sites-available/${MAIN_SITE}.conf

				if [ "${CREATE_SSL}" = "true" ]; then
					echo -e "
	ssl_certificate /etc/letsencrypt/live/${MAIN_SITE}/fullchain.pem;
	ssl_certificate_key /etc/letsencrypt/live/${MAIN_SITE}/privkey.pem;
	include conf.d/include/ssl-ciphers.conf;" >> /etc/nginx/sites-available/${MAIN_SITE}.conf
				fi
				echo -e "
	index index.php;

	location / {
		try_files \$uri \$uri/ /index.php?\$query_string;" >> /etc/nginx/sites-available/${MAIN_SITE}.conf
				if [ "${CREATE_SSL}" = "true" ]; then
					echo -e "		include conf.d/include/force-ssl.conf;" >> /etc/nginx/sites-available/${MAIN_SITE}.conf
				fi
				echo -e "	}

	location ~ \.php\$ {
		fastcgi_pass unix:/var/run/php/php7.2-fpm.sock;
		include conf.d/include/php_fastcgi.conf;
	}

	include conf.d/include/general.conf;" >> /etc/nginx/sites-available/${MAIN_SITE}.conf
				if [ "${CREATE_SSL}" = "true" ]; then
					echo -e "	include conf.d/include/letsencrypt-acme-challenge.conf;" >> /etc/nginx/sites-available/${MAIN_SITE}.conf
				fi
				echo -e "}" >> /etc/nginx/sites-available/${MAIN_SITE}.conf
				
				for nip in "${NODE_HOSTS[@]}"
				do
					if [[ $(/sbin/ip -o -4 addr list ens192 | awk '{print $4}' | cut -d/ -f1) == *"${nip}"* ]]; then NCMD=''
						else NCMD="ssh root@${nip}"
					fi
					${NCMD} mkdir -p /var/www/${MAIN_SITE}/{public_folder,nginx_logs}
				done
				nodemgmt set-permissions ${MAIN_SITE}
				
			else
				
				echo -e "server {
	set \$forward_scheme ${PROXYSCHEME};
	set \$server         \"${PROXYHOST}\";
	set \$port           ${PROXYPORT};

	listen 8080;" > /etc/nginx/sites-available/${MAIN_SITE}.conf
				if [ "${CREATE_SSL}" = "true" ]; then
					echo -e "	listen 8443 ssl http2;" >> /etc/nginx/sites-available/${MAIN_SITE}.conf
				fi
				echo -e "
	server_name ${NGINX_SERVERNAME};" >> /etc/nginx/sites-available/${MAIN_SITE}.conf
				if [ "${CREATE_SSL}" = "true" ]; then
					echo -e "
	include conf.d/include/letsencrypt-acme-challenge.conf;
	include conf.d/include/ssl-ciphers.conf;
	ssl_certificate /etc/letsencrypt/live/${MAIN_SITE}/fullchain.pem;
	ssl_certificate_key /etc/letsencrypt/live/${MAIN_SITE}/privkey.pem;" >> /etc/nginx/sites-available/${MAIN_SITE}.conf
				fi
				echo -e "
	access_log /var/www/!NGINX-Logs/proxy-${MAIN_SITE}.log proxy;

	location / {" >> /etc/nginx/sites-available/${MAIN_SITE}.conf
	if [ "${CREATE_SSL}" = "true" ]; then
		echo -e "		include conf.d/include/force-ssl.conf;" >> /etc/nginx/sites-available/${MAIN_SITE}.conf
	fi
	echo -e "		include conf.d/include/proxy.conf;
	}
}
" >> /etc/nginx/sites-available/${MAIN_SITE}.conf
			fi
			ln -s /etc/nginx/sites-available/${MAIN_SITE}.conf /etc/nginx/sites-enabled/${MAIN_SITE}.conf
			if [ "${CREATE_SSL}" = "true" ]; then
				${FOLDER}/nodemgmt-scripts.sh newcert ${NEW_SITE}
			else
				${FOLDER}/nodemgmt-scripts.sh service nginx reload
			fi
			echo ""
			echo -e "${idsCL[LightGreen]}The new site for '${idsCL[LightGreen]}${NEW_SITE}${idsCL[Default]}' has been created.${idsCL[Default]}"
			echo ""
		else
			echo "Missing proxy arguments"
			exit 1
		fi
	else
		echo "Missing arguments"
		echo ""
		echo -e "Usage: ${idsCL[Yellow]}nodemgmt newcert${idsCL[Default]} {"
		width=33
		printf "%-${width}s- %s\n" "    -site {FQDN address(,es)}" "(*required)"
		printf "%-${width}s- %s\n" "    -ssl {true or false}" "(defaults to true)"
		printf "%-${width}s- %s\n" "    -type {'local' or 'proxy'}" "(defaults to local)"
		printf "%-${width}s- %s\n" "    -scheme {http or https}" "(required if type set to proxy)"
		printf "%-${width}s- %s\n" "    -host {IP or FQDN}" "(required if type set to proxy)"
		printf "%-${width}s- %s\n" "    -port {host port}" "(required if type set to proxy)"
		echo "}"
		exit 1
	fi 
	exit 1
	;;
	
	update)
		exit 0
	;;
	
	status)
		echo -e "${idsCL[Yellow]} NodeMgmt - Galera/NGINX Node Management${idsCL[Default]}  ${idsCL[DarkGray]}(ver-${VERS})${idsCL[Default]}"
		
		if [ ! -z ${LOCAL_SERVICES+x} ]; then
			lip=$(/sbin/ip -o -4 addr list ens192 | awk '{print $4}' | cut -d/ -f1)
			echo -e "${idsCL[Yellow]}-------------------------------------------------------------${idsCL[Default]}"
			echo -e "Node hostname:		${idsST[Bold]}${idsCL[LightCyan]}${NODE_HOSTNAME} (${lip})${idsST[Reset]}${idsCL[LightCyan]} - localhost${idsCL[Default]}"
			for srvc in "${LOCAL_SERVICES[@]}"
			do
				if [[ "mysql,nginx,gitea,haproxy,keepalived,maxscale" = *"${srvc}"* ]]; then spc="	"; else spc=""; fi
				echo -en "${NM_SERVICES[${srvc}]}   	$spc"
				if [ $(pgrep ${srvc} | wc -l) -gt "0" ]; then
					echo -e "${idsCL[Green]}Running${idsCL[Default]}"
					else echo -e "${idsCL[Red]}Not Running${idsCL[Default]}"
				fi
			done
		fi
		
		nid=1
		for nip in "${NODE_HOSTS[@]}"
		do
			if [[ $(/sbin/ip -o -4 addr list ens192 | awk '{print $4}' | cut -d/ -f1) == *"${nip}"* ]]; then NCMD=''; LH='- localhost'
				else NCMD="ssh root@${nip}"; LH=''
			fi
			
			echo -e "${idsCL[Yellow]}-------------------------------------------------------------${idsCL[Default]}"
			echo -e "Node hostname:		${idsST[Bold]}${idsCL[LightCyan]}iDS-Node${nid} (${nip})${idsST[Reset]}${idsCL[LightCyan]} ${LH}${idsCL[Default]}"
			for srvc in "${NODE_SERVICES[@]}"
			do
				if [[ "mysql,nginx,gitea,haproxy,keepalived,maxscale" = *"${srvc}"* ]]; then spc="	"; else spc=""; fi
				echo -en "${NM_SERVICES[${srvc}]}   	$spc"
				if [ $(${NCMD} pgrep ${srvc} | wc -l) -gt "0" ]; then
					echo -e "${idsCL[Green]}Running${idsCL[Default]}"
					else echo -e "${idsCL[Red]}Not Running${idsCL[Default]}"
				fi
			done
			nid=`expr $nid + 1`
		done

		echo -e "${idsCL[Yellow]}-------------------------------------------------------------${idsCL[Default]}"
		echo ""
	;;
	
	status-check)
		if [ "${STATUS_CHECK_EMAIL}" != "" ]; then
			if [ ! -z ${LOCAL_SERVICES+x} ]; then
				lip=$(/sbin/ip -o -4 addr list ens192 | awk '{print $4}' | cut -d/ -f1)
				for srvc in "${LOCAL_SERVICES[@]}"
				do
					if [ $(pgrep ${srvc} | wc -l) -lt "1" ]; then
						echo "${NM_SERVICES[${srvc}]} is down" | mail -s "${NODE_HOSTNAME}-${nip}" ${STATUS_CHECK_EMAIL}
						touch ${FOLDER}/localhost-${srvc}.down
					elif [ -f ${FOLDER}/localhost-${srvc}.down ]; then
						echo "${NM_SERVICES[${srvc}]} is back UP!" | mail -s "${NODE_HOSTNAME}-${nip}" ${STATUS_CHECK_EMAIL}
						rm -f ${FOLDER}/localhost-${srvc}.down
					fi
				done
			fi
			if [ -z ${LOCAL_SERVICES+x} ] || [ "${2}" = "all" ]; then
				nid=1
				for nip in "${NODE_HOSTS[@]}"
				do
					if [[ $(/sbin/ip -o -4 addr list ens192 | awk '{print $4}' | cut -d/ -f1) == *"${nip}"* ]]; then NCMD=''
						else NCMD="ssh root@${nip}"
					fi
					for srvc in "${NODE_SERVICES[@]}"
					do
						if [ $(${NCMD} pgrep ${srvc} | wc -l) -lt "1" ]; then
							echo "${NM_SERVICES[${srvc}]} is down" | mail -s "iDS-Node${nid}-${nip}" ${STATUS_CHECK_EMAIL}
							touch ${FOLDER}/${nip}-${srvc}.down
						elif [ -f ${FOLDER}/${nip}-${srvc}.down ]; then
							echo "${NM_SERVICES[${srvc}]} is back UP!" | mail -s "iDS-Node${nid}-${nip}" ${STATUS_CHECK_EMAIL}
							rm -f ${FOLDER}/${nip}-${srvc}.down
						fi
					done
					nid=`expr $nid + 1`
				done
			fi
		fi
	;;
		
	set-permissions)
		if [ "${2}" != "" ]; then
			NEW_SITE=${2}
			echo -e "${idsCL[Yellow]}Setting new site folder permissions for (/var/www/${NEW_SITE})${idsCL[Default]}"
		fi
		nid=1
		for nip in "${NODE_HOSTS[@]}"
		do
			if [[ $(/sbin/ip -o -4 addr list ens192 | awk '{print $4}' | cut -d/ -f1) == *"${nip}"* ]]; then
				nip='localhost '
				NCMD=''
			else
				NCMD="ssh root@${nip}"
			fi
			if [ "${NEW_SITE}" != "" ]; then
				echo -en "${idsCL[Cyan]}iDS-Node${nid} (${nip})    ${idsCL[Default]}"
				${NCMD} chown -R www-data:www-data /var/www/$NEW_SITE
				${NCMD} chmod -R 7775 /var/www/$NEW_SITE
				echo -e "${idsCL[Green]}Complete${idsCL[Default]}"
			else
				echo -e "${idsCL[Yellow]}Setting folder permissions for iDS-Node${nid} (${nip})${idsCL[Default]}"
				echo -en "${idsCL[Cyan]}LetsEncrypt Certs    ${idsCL[Default]}"
				${NCMD} chown -R root:letsencrypt /etc/letsencrypt
				${NCMD} chmod -R 6775 /etc/letsencrypt
				echo -e "${idsCL[Green]}Complete${idsCL[Default]}"
				echo -en "${idsCL[Cyan]}Webserver folders    ${idsCL[Default]}"
				${NCMD} chown -R www-data:www-data /var/www
				${NCMD} chmod -R 7775 /var/www
				echo -e "${idsCL[Green]}Complete${idsCL[Default]}"
            	echo -en "${idsCL[Cyan]}Gitea Folder         ${idsCL[Default]}"
				${NCMD} chown -R git:git /var/lib/gitea
				${NCMD} chmod -R 750 /var/lib/gitea
				echo -e "${idsCL[Green]}Complete${idsCL[Default]}"
				echo ""
			fi
			nid=`expr $nid + 1`
		done
		if [ "${NEW_SITE}" != "" ]; then echo ""; fi
	;;
	
service)
	if [ "${NM_SERVICES[${2}]}" = "" ]; then
		echo -e "${idsCL[Red]}(${2}) is not an allowed service.${idsCL[Default]}"
		exit 1	
	fi
	if [[ "start,stop,restart,reload,enable,disable" != *"${3}"* ]] && [ "${2}" != "daemon-reload" ]; then
		echo -e "${idsCL[Red]}(${3}) is not an allowed service action.${idsCL[Default]}"
		exit 1
	fi
	if [ "$3" = "stop" ]; then ADISP='Stopp'
		elif [ "$3" = "enable" ]; then ADISP='Enabl'
		elif [ "$3" = "disable" ]; then ADISP='Disabl'
		else ADISP="$(tr '[:lower:]' '[:upper:]' <<< ${3:0:1})${3:1}"
	fi
	if [ "$3" = "start" ] &&  [ "$2" = "haproxy" ]; then TACT='restart'; else TACT="${3}"; fi
		
	echo -e "${idsCL[LightGreen]}[[${NM_SERVICES[${2}]} ${ADISP}ing]]${idsCL[Default]}"
	echo -e "${idsCL[LightGreen]}-------------------------------------------${idsCL[Default]}"
	
	nid=1
	for nip in "${NODE_HOSTS[@]}"
	do
		if [[ $(/sbin/ip -o -4 addr list ens192 | awk '{print $4}' | cut -d/ -f1) == *"${nip}"* ]]; then
			nip='localhost'
			NCMD=''
		else
			NCMD="ssh root@${nip}"
		fi
		echo -en "${ADISP}ing on iDS-Node${nid} ($nip)... ${idsCL[Default]}"
		$NCMD systemctl $3 $2
		if [[ "enable,disable" = *"${3}"* ]] || [ "${2}" = "daemon-reload" ]; then
			echo -e "${idsCL[Green]}OK${idsCL[Default]}"
		elif [[ $(${NCMD} pgrep ${2} | wc -l) -gt "0" ]]; then
			echo -e "${idsCL[Green]}OK${idsCL[Default]}"
			elif [ "$3" = "stop" ]; then echo -e "${idsCL[Red]}STOPPED${idsCL[Default]}"
			else echo -e "${idsCL[Red]}ERROR${idsCL[Default]}"
		fi
		nid=`expr $nid + 1`
	done
	
	echo ""
	echo -e "${idsCL[Green]}${NM_SERVICES[${2}]} has been ${ADISP}ed${idsCL[Default]}"
	echo ""
	exit 0
;;

	*)
		echo -e "Usage: ${idsCL[Yellow]}nodemgmt${idsCL[Default]} { ${idsCL[Yellow]}service${idsCL[Default]} [service] [action] | ${idsCL[Yellow]}status${idsCL[Default]} | ${idsCL[Yellow]}newcert${idsCL[Default]} [domain(,s)] | ${idsCL[Yellow]}certrenew${idsCL[Default]} }"
		echo ""
		echo ""
		exit 0
	;;

esac

exit 0