#!/usr/bin/env bash

ui_host=oolon.kosherinata.internal
ws_host=frootmig.kosherinata.internal
app_fqdn=blekin.kosherinata.internal

repo_path=~/git/grenade/blekin
fedora_trusted_root_path=/etc/pki/ca-trust/source/anchors/root-internal.pem
fedora_intermediate_path=/etc/pki/ca-trust/source/anchors/intermediate-internal.pem


if ssh ${ws_host} 'id blekin 2> /dev/null || sudo useradd --system --create-home --home-dir /var/lib/blekin --user-group blekin'; then
    echo "blekin system user created or observed on ${ws_host}"
else
    echo "failed to create blekin system user on ${ws_host}"
    exit 1
fi
if rsync \
    --archive \
    --compress \
    --rsync-path 'sudo rsync' \
    --chown root:root \
    ${repo_path}/asset/systemd/blekin.service \
    ${ws_host}:/etc/systemd/system/blekin.service \
    && ssh ${ws_host} sudo systemctl daemon-reload; then
    echo "blekin.service synced to ${ws_host}"
else
    echo "failed to sync blekin.service to ${ws_host}"
    exit 1
fi
if ssh ${ws_host} systemctl is-active --quiet blekin.service; then
    if ssh ${ws_host} sudo systemctl restart blekin.service; then
        echo "blekin.service restarted on ${ws_host}"
    else
        echo "failed to restart blekin.service on ${ws_host}"
        exit 1
    fi
else
    if ssh ${ws_host} sudo systemctl start blekin.service; then
        echo "blekin.service started on ${ws_host}"
    else
        echo "failed to start blekin.service on ${ws_host}"
        exit 1
    fi
fi

app_cert_is_valid=false
app_cert_remote_path=/etc/nginx/tls/cert/${app_fqdn}.pem
app_key_remote_path=/etc/nginx/tls/key/${app_fqdn}.pem
app_cert_local_path=/tmp/${app_fqdn}.pem

if rsync \
    --archive \
    --compress \
    --rsync-path 'sudo rsync' \
    ${ui_host}:${app_cert_remote_path} \
    ${app_cert_local_path} 2> /dev/null; then
    if openssl verify \
        -trusted ${fedora_trusted_root_path} \
        -untrusted ${fedora_intermediate_path} \
        ${app_cert_local_path}; then
        echo "verified ${app_fqdn} cert from ${ui_host}"
        app_cert_is_valid=true
    else
        echo "failed to verify ${app_fqdn} cert from ${ui_host}"
        exit 1
    fi
else
    echo "observed missing ${app_fqdn} cert on ${ui_host}"
fi
if [ "${app_cert_is_valid}" = "true" ]; then
    echo "observed valid cert for ${app_fqdn} on ${ui_host}"
else
    if rsync \
        --archive \
        --compress \
        --rsync-path 'sudo rsync' \
        --chmod 600 \
        --chown root:root \
        ~/.step/secrets/provisioner \
        ${ui_host}:/tmp/provisioner; then
        echo "provisioner secret synced to ${ui_host}"
    else
        echo "failed to sync provisioner secret to ${ui_host}"
        exit 1
    fi
    if ssh ${ui_host} sudo step ca certificate \
        --force \
        --provisioner lair \
        --provisioner-password-file /tmp/provisioner \
        --ca-url https://ca.internal \
        --root /etc/pki/ca-trust/source/anchors/root-internal.pem \
        --san ${app_fqdn} \
        ${app_fqdn} \
        ${app_cert_remote_path} \
        ${app_key_remote_path}; then
        echo "acquired ${app_fqdn} cert on ${ui_host}"
    else
        echo "failed to acquire ${app_fqdn} cert on ${ui_host}"
    fi
    ssh ${ui_host} sudo rm -f /tmp/provisioner
fi

if rsync \
    --archive \
    --compress \
    --rsync-path 'sudo rsync' \
    --chown root:root \
    ${repo_path}/asset/nginx/${app_fqdn}.conf \
    ${ui_host}:/etc/nginx/sites-available/${app_fqdn}.conf; then
    echo "${app_fqdn}.conf synced to ${ui_host}"
else
    echo "failed to sync ${app_fqdn}.conf to ${ui_host}"
fi
if ssh ${ui_host} sudo ln -sf /etc/nginx/sites-available/${app_fqdn}.conf /etc/nginx/sites-enabled/${app_fqdn}.conf; then
    echo "${app_fqdn} enabled on ${ui_host}"
else
    echo "failed to enable ${app_fqdn} on ${ui_host}"
fi
if ssh ${ui_host} 'sudo nginx -t && sudo systemctl reload nginx.service'; then
    echo "nginx reloaded on ${ui_host}"
else
    echo "failed to reload nginx on ${ui_host}"
fi

# todo:

# frootmig:
# sudo useradd --system --create-home --home-dir /var/lib/blekin --user-group blekin
# sync asset/sudoers.d/ws_gitea_ci to /etc/sudoers.d/gitea_ci

# oolon:
# ssh ${ui_host} sudo mkdir -p /etc/nginx/tls/${app_fqdn}
# sudo semanage fcontext -a -t httpd_sys_content_t "/var/www/blekin.kosherinata.internal(/.*)?"
# sudo restorecon -Rv /var/www/blekin.kosherinata.internal/
# sync asset/sudoers.d/ui_gitea_ci to /etc/sudoers.d/gitea_ci
# # Create the service definition
#sudo firewall-cmd --permanent --new-service=blekin
#sudo firewall-cmd --permanent --service=blekin --set-description="blekin e-RIC RFB proxy"
#sudo firewall-cmd --permanent --service=blekin --add-port=3000/tcp

# Enable it in the active zone
#sudo firewall-cmd --permanent --add-service=blekin
#sudo firewall-cmd --reload