#!/bin/bash

set -e

do_init_regen() {
    if [[ $EUID -ne 0 ]]; then
        echo "You must be root to run this script" 1>&2
        exit 1
    fi

    cd /usr/share/yunohost/conf/yunohost

    [[ -d /etc/yunohost ]] || mkdir -p /etc/yunohost

    # set default current_host
    [[ -f /etc/yunohost/current_host ]] \
        || echo "yunohost.org" >/etc/yunohost/current_host

    # copy default services and firewall
    [[ -f /etc/yunohost/firewall.yml ]] \
        || cp firewall.yml /etc/yunohost/firewall.yml

    # allow users to access /media directory
    [[ -d /etc/skel/media ]] \
        || (mkdir -p /media && ln -s /media /etc/skel/media)

    # Cert folders
    mkdir -p /etc/yunohost/certs
    chown -R root:ssl-cert /etc/yunohost/certs
    chmod 750 /etc/yunohost/certs

    # App folders
    mkdir -p /etc/yunohost/apps
    chmod 700 /etc/yunohost/apps
    mkdir -p /home/yunohost.app
    chmod 755 /home/yunohost.app

    # Domain settings
    mkdir -p /etc/yunohost/domains
    chmod 700 /etc/yunohost/domains

    # Backup folders
    mkdir -p /home/yunohost.backup/archives
    chmod 750 /home/yunohost.backup/archives
    chown root:root /home/yunohost.backup/archives # This is later changed to root:admins once the admins group exists

    # Empty ssowat json persistent conf
    echo "{}" >'/etc/ssowat/conf.json.persistent'
    chmod 644 /etc/ssowat/conf.json.persistent
    chown root:root /etc/ssowat/conf.json.persistent

    # Empty service conf
    touch /etc/yunohost/services.yml

    mkdir -p /var/cache/yunohost/repo
    chown root:root /var/cache/yunohost
    chmod 700 /var/cache/yunohost

    cp yunohost-api.service /etc/systemd/system/yunohost-api.service
    cp yunohost-firewall.service /etc/systemd/system/yunohost-firewall.service
    cp yunoprompt.service /etc/systemd/system/yunoprompt.service

    systemctl daemon-reload

    systemctl enable yunohost-api.service --quiet
    systemctl start yunohost-api.service
    # Yunohost-firewall is enabled only during postinstall, not init, not 100% sure why

    cp dpkg-origins /etc/dpkg/origins/yunohost

    # Change dpkg vendor
    # see https://wiki.debian.org/Derivatives/Guidelines#Vendor
    if readlink -f /etc/dpkg/origins/default | grep -q debian;
    then
        rm -f /etc/dpkg/origins/default
        ln -s /etc/dpkg/origins/yunohost /etc/dpkg/origins/default
    fi
}

do_pre_regen() {
    pending_dir=$1

    cd /usr/share/yunohost/conf/yunohost

    mkdir -p $pending_dir/etc/systemd/system
    mkdir -p $pending_dir/etc/cron.d/
    mkdir -p $pending_dir/etc/cron.daily/

    # add cron job for diagnosis to be ran at 7h and 19h + a random delay between
    # 0 and 20min, meant to avoid every instances running their diagnosis at
    # exactly the same time, which may overload the diagnosis server.
    cat >$pending_dir/etc/cron.d/yunohost-diagnosis <<EOF
SHELL=/bin/bash
0 7,19 * * * root : YunoHost Automatic Diagnosis; sleep \$((RANDOM\\%1200)); yunohost diagnosis run --email > /dev/null 2>/dev/null || echo "Running the automatic diagnosis failed miserably"
EOF

    # Cron job that upgrade the app list everyday
    cat >$pending_dir/etc/cron.daily/yunohost-fetch-apps-catalog <<EOF
#!/bin/bash
sleep \$((RANDOM%3600)); yunohost tools update apps > /dev/null
EOF

    # Cron job that renew lets encrypt certificates if there's any that needs renewal
    cat >$pending_dir/etc/cron.daily/yunohost-certificate-renew <<EOF
#!/bin/bash
yunohost domain cert renew --email
EOF

    # If we subscribed to a dyndns domain, add the corresponding cron
    # - delay between 0 and 60 secs to spread the check over a 1 min window
    # - do not run the command if some process already has the lock, to avoid queuing hundreds of commands...
    if ls -l /etc/yunohost/dyndns/K*.key 2>/dev/null; then
        cat >$pending_dir/etc/cron.d/yunohost-dyndns <<EOF
SHELL=/bin/bash
# Every 10 minutes,
#   - (sleep random 60 is here to spread requests over a 1-min window)
#   - if ip.yunohost.org answers ping (basic check to validate that we're connected to the internet and yunohost infra aint down)
#   - and if lock ain't already taken by another command
#   - trigger yunohost dyndns update
*/10 * * * * root : YunoHost DynDNS update; sleep \$((RANDOM\\%60)); ! ping -q -W5 -c1 ip.yunohost.org >/dev/null 2>&1 || test -e /var/run/moulinette_yunohost.lock || yunohost dyndns update >> /dev/null
EOF
    else
        # (Delete cron if no dyndns domain found)
        touch $pending_dir/etc/cron.d/yunohost-dyndns
    fi

    # Skip ntp if inside a container (inspired from the conf of systemd-timesyncd)
    if systemctl | grep -q 'ntp.service'
    then
        mkdir -p ${pending_dir}/etc/systemd/system/ntp.service.d/
        cat >${pending_dir}/etc/systemd/system/ntp.service.d/ynh-override.conf <<EOF
[Unit]
ConditionCapability=CAP_SYS_TIME
ConditionVirtualization=!container
EOF
    fi

    # Make nftable conflict with yunohost-firewall
    mkdir -p ${pending_dir}/etc/systemd/system/nftables.service.d/
    cat >${pending_dir}/etc/systemd/system/nftables.service.d/ynh-override.conf <<EOF
[Unit]
# yunohost-firewall and nftables conflict with each other
Conflicts=yunohost-firewall.service
ConditionFileIsExecutable=!/etc/init.d/yunohost-firewall
ConditionPathExists=!/etc/systemd/system/multi-user.target.wants/yunohost-firewall.service
EOF

    # Don't suspend computer on LidSwitch
    mkdir -p ${pending_dir}/etc/systemd/logind.conf.d/
    cat >${pending_dir}/etc/systemd/logind.conf.d/ynh-override.conf <<EOF
[Login]
HandleLidSwitch=ignore
HandleLidSwitchDocked=ignore
HandleLidSwitchExternalPower=ignore
EOF

    cp yunohost-api.service ${pending_dir}/etc/systemd/system/yunohost-api.service
    cp yunohost-firewall.service ${pending_dir}/etc/systemd/system/yunohost-firewall.service
    cp yunoprompt.service ${pending_dir}/etc/systemd/system/yunoprompt.service
    cp proc-hidepid.service ${pending_dir}/etc/systemd/system/proc-hidepid.service

    mkdir -p ${pending_dir}/etc/dpkg/origins/
    cp dpkg-origins ${pending_dir}/etc/dpkg/origins/yunohost

}

do_post_regen() {
    regen_conf_files=$1

    ######################
    # Enfore permissions #
    ######################

    chmod 770 /home/yunohost.backup
    chmod 770 /home/yunohost.backup/archives
    chmod 700 /var/cache/yunohost
    chown root:admins /home/yunohost.backup
    chown root:admins /home/yunohost.backup/archives
    chown root:root /var/cache/yunohost

    [ ! -e /var/www/.well-known/ynh-diagnosis/ ] || chmod 775 /var/www/.well-known/ynh-diagnosis/

    # NB: x permission for 'others' is important for ssl-cert (and maybe mdns), otherwise slapd will fail to start because can't access the certs
    chmod 755 /etc/yunohost

    find /etc/systemd/system/*.service -type f | xargs -r chown root:root
    find /etc/systemd/system/*.service -type f | xargs -r chmod 0644

    if ls -l /etc/php/*/fpm/pool.d/*.conf
    then
        chown root:root /etc/php/*/fpm/pool.d/*.conf
        chmod 644 /etc/php/*/fpm/pool.d/*.conf
    fi

    # Certs
    # We do this with find because there could be a lot of them...
    chown -R root:ssl-cert /etc/yunohost/certs
    chmod 750 /etc/yunohost/certs
    find /etc/yunohost/certs/ -type f -exec chmod 640 {} \;
    find /etc/yunohost/certs/ -type d -exec chmod 750 {} \;

    find /etc/cron.*/yunohost-* -type f -exec chmod 755 {} \;
    find /etc/cron.d/yunohost-* -type f -exec chmod 644 {} \;
    find /etc/cron.*/yunohost-* -type f -exec chown root:root {} \;

    setfacl -m g:all_users:--- /var/www
    setfacl -m g:all_users:--- /var/log/nginx
    setfacl -m g:all_users:--- /etc/yunohost
    setfacl -m g:all_users:--- /etc/ssowat

    for USER in $(yunohost user list --quiet --output-as json | jq -r '.users | .[] | .username'); do
        [ ! -e "/home/$USER" ] || setfacl -m g:all_users:--- /home/$USER
    done

    # Domain settings
    mkdir -p /etc/yunohost/domains

    # Misc configuration / state files
    chown root:root $(ls /etc/yunohost/{*.yml,*.yaml,*.json,mysql,psql} 2>/dev/null | grep -vw mdns.yml)
    chmod 600 $(ls /etc/yunohost/{*.yml,*.yaml,*.json,mysql,psql} 2>/dev/null)

    # Apps folder, custom hooks folder
    [[ ! -e /etc/yunohost/hooks.d ]] || (chown root /etc/yunohost/hooks.d && chmod 700 /etc/yunohost/hooks.d)
    [[ ! -e /etc/yunohost/apps ]] || (chown root /etc/yunohost/apps && chmod 700 /etc/yunohost/apps)
    [[ ! -e /etc/yunohost/domains ]] || (chown root /etc/yunohost/domains && chmod 700 /etc/yunohost/domains)

    # Create ssh.app and sftp.app groups if they don't exist yet
    grep -q '^ssh.app:' /etc/group || groupadd ssh.app
    grep -q '^sftp.app:' /etc/group || groupadd sftp.app

    # Propagates changes in systemd service config overrides
    if systemctl | grep -q 'ntp.service'
    then
        [[ ! "$regen_conf_files" =~ "ntp.service.d/ynh-override.conf" ]] || {
            systemctl daemon-reload
            systemctl restart ntp
        }
    fi
    [[ ! "$regen_conf_files" =~ "nftables.service.d/ynh-override.conf" ]] || systemctl daemon-reload
    [[ ! "$regen_conf_files" =~ "login.conf.d/ynh-override.conf" ]] ||  {
        systemctl daemon-reload
        systemctl restart systemd-logind
    }
    [[ ! "$regen_conf_files" =~ "yunohost-firewall.service" ]] || systemctl daemon-reload
    [[ ! "$regen_conf_files" =~ "yunohost-api.service" ]] || systemctl daemon-reload

    if [[ "$regen_conf_files" =~ "yunoprompt.service" ]]; then
        systemctl daemon-reload
        action=$([[ -e /etc/systemd/system/yunoprompt.service ]] && echo 'enable' || echo 'disable')
        systemctl $action yunoprompt --quiet --now
    fi
    if [[ "$regen_conf_files" =~ "proc-hidepid.service" ]]; then
        systemctl daemon-reload
        action=$([[ -e /etc/systemd/system/proc-hidepid.service ]] && echo 'enable' || echo 'disable')
        systemctl $action proc-hidepid --quiet --now
    fi

    # Change dpkg vendor
    # see https://wiki.debian.org/Derivatives/Guidelines#Vendor
    if readlink -f /etc/dpkg/origins/default | grep -q debian;
    then
        rm -f /etc/dpkg/origins/default
        ln -s /etc/dpkg/origins/yunohost /etc/dpkg/origins/default
    fi

    if test -e /etc/yunohost/installed && test -e /etc/profile.d/check_yunohost_is_installed.sh
    then
        rm /etc/profile.d/check_yunohost_is_installed.sh
    fi
}

do_$1_regen ${@:2}