#!/bin/sh -e
set -x
SERVER_NAME='autenticazione.lavoripubblici.sicilia.it'
CERTBOT_EMAIL='admin@mwg.it'
DOCUMENT_ROOT='/var/www/html'

MARIADB_USERNAME='mwg'
MARIADB_PASSWORD='Aw42#1e_w.as'
MARIADB_DATABASE='autenticazione'

FOLDER="$(dirname $(realpath $0))"

apt update
apt -y dist-upgrade
apt install -y apache2 certbot cron libapache2-mod-auth-openidc mariadb-server php php-mysql python

# OpenSSL
sed -i -e 's/^CipherString = .*/CipherString = DEFAULT@SECLEVEL=1/' /etc/ssl/openssl.cnf

# MariaDB
# mysql -e "DROP DATABASE IF EXISTS \`$MARIADB_DATABASE\`;"
if [ "0" = "$(mysql -B -N -e "SHOW DATABASES LIKE '$MARIADB_DATABASE';" | wc -l)" ]; then
    mysql < $FOLDER/file/autenticazione.sql
fi
if [ "0" = "$(mysql -B -N -e \
        "SELECT \`User\` FROM \`mysql\`.\`user\` WHERE \`User\`='$MARIADB_USERNAME' AND \`Host\`='localhost';" | \
        wc -l)" ]; then
    mysql -e "GRANT ALL PRIVILEGES ON \`$MARIADB_DATABASE\`.* TO '$MARIADB_USERNAME'@'localhost' IDENTIFIED BY \
            '$MARIADB_PASSWORD'"
fi
sed -i -e "s/\\(\\s*'password'\\s*=>\\s*\\).*/\\1'$MARIADB_PASSWORD',/" /var/www/App/Config/database.php

# Sshd
mkdir -p /etc/ssh/sshd_config.d
echo 'PasswordAuthentication no' > /etc/ssh/sshd_config.d/mwg.conf

# Autenticazione
cp $FOLDER/usr-local-bin/* /usr/local/bin
. /usr/local/bin/project_env.sh
echo "export SERVER_NAME=$SERVER_NAME" >> /usr/local/bin/project_env.sh
echo "export APPLICATION_URL=https://$SERVER_NAME:443" >> /usr/local/bin/project_env.sh

# Apache
cp $FOLDER/file/ssl-params.conf /etc/apache2/conf-available/
if [ "$(grep /usr/local/bin/project_env.sh /etc/apache2/envvars | wc -l)" = "0" ]; then
    echo '. /usr/local/bin/project_env.sh' >> /etc/apache2/envvars
fi
a2enconf ssl-params
a2enmod headers
a2enmod rewrite
a2enmod ssl
cd /etc/apache2/sites-enabled
find /etc/apache2/sites-enabled -type l -exec sh -c 'a2dissite $(basename {})' \;
cp $FOLDER/file/0certbot.conf /etc/apache2/sites-available
a2ensite 0certbot
systemctl restart apache2

certbot certonly -d $SERVER_NAME --webroot --webroot-path /var/www/certbot -m $CERTBOT_EMAIL --agree-tos \
    --non-interactive --no-eff-email --expand

mkdir -p /etc/apache2/keys
cp $FOLDER/metadata/private.pem $FOLDER/metadata/public.pem /etc/apache2/keys
cp $FOLDER/file/1autenticazione.conf /etc/apache2/sites-available
a2ensite 1autenticazione

/usr/local/bin/auto-update-gov-certificates

# Cronjob
cp $FOLDER/cron/* /etc/cron.d

echo Installazione terminata

# apt purge --auto-remove apache2 certbot cron libapache2-mod-auth-openidc mariadb-server php php-mysql python;rmdir /var/lib/apache2/;rm -Rf /etc/ssl/itaca/

# openssl req -key private.pem -new -x509 -days 3650 -subj /C=IT/ST=Sicilia/O=Regione Siciliana/OU=Autenticazione Lavori Pubblici/CN=Autenticazione Lavori Pubblici -out cert.pem
# openssl pkcs12 -export -inkey private.pem -in cert.pem -out keys.pfx -name autenticazione
# keytool -v -list -keystore keys.pfx