#!/usr/bin/bash
#
# /usr/bin/iris_ctl -- Script for initializing and updating IRIS
#
# Copyright (C) 2012-2025  Minnesota Department of Transportation
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.

function check_initialized() {
	if [ -r /etc/iris/iris-server.keystore ]; then
		echo "/etc/iris/iris-server.keystore already exists."
		exit 1
	fi
	if [ -r /etc/iris/iris-client.keystore ]; then
		echo "/etc/iris/iris-client.keystore already exists."
		exit 1
	fi
	return 0
}

function update_client_properties() {
	echo "Updating client properties"
	host=`hostname -f`
	p_client=/etc/iris/iris-client.properties
	sed -i ''s,.*keystore.file=.*,keystore.file=http://$host/iris-client/iris-client.keystore,'' $p_client
	sed -i ''s,.*sonar.host=.*,sonar.host=$host,'' $p_client
}

function create_keystores() {
	echo "Creating IRIS keystores"
	k_pws=`head -c8 < /dev/random | base64`
	k_pwc=`head -c8 < /dev/random | base64`
	k_opts="-noprompt -alias iris-sonar"
	k_cert=/etc/iris/iris-sonar-public.cert
	k_server=/etc/iris/iris-server.keystore
	k_client=/etc/iris/iris-client.keystore
	k_sopts="$k_opts -keystore $k_server -storetype JKS -storepass $k_pws -keypass $k_pws"
	k_copts="$k_opts -keystore $k_client -storetype JKS -storepass $k_pwc -keypass $k_pwc"
	k_gopts="-genkeypair -keyalg RSA -keysize 2048 -validity 1825"
	d_name="CN=iris_ctl"
	umask 0037
	/usr/bin/rm -f $k_cert $k_server $k_client
	/usr/bin/keytool $k_sopts $k_gopts -dname "$d_name"
	/usr/bin/keytool $k_sopts -export -file $k_cert
	/usr/bin/keytool $k_copts -import -file $k_cert
	chown tms:tms $k_server $k_cert $k_client
	p_server=/etc/iris/iris-server.properties
	p_client=/etc/iris/iris-client.properties
	sed_s="s:.*keystore.password=.*:keystore.password=$k_pws:"
	sed_c="s:.*keystore.password=.*:keystore.password=$k_pwc:"
	sed -i ''$sed_s'' $p_server
	sed -i ''$sed_c'' $p_client
}

function init_db() {
	echo "Initializing PostgreSQL database"
	umask 0077
	pwd_file=/var/lib/pgsql/.pgpass
	pg_pwd=`head -c8 < /dev/random | base64`
	echo $pg_pwd > $pwd_file
	echo "*:*:*:postgres:$pg_pwd" >> $pwd_file
	chown postgres:postgres $pwd_file
	su --login postgres -c "initdb -A password --pwfile $pwd_file"
	pg_conf=/var/lib/pgsql/data/postgresql.conf
	echo "#" >> $pg_conf
	echo "# Settings for IRIS osm schema" >> $pg_conf
	echo "maintenance_work_mem = 256MB" >> $pg_conf
	echo "temp_buffers = 128MB" >> $pg_conf
	systemctl enable postgresql.service
	systemctl start postgresql.service
}

function create_tms_user() {
	echo "Creating the tms db user"
	tms_pwd=`head -c8 < /dev/random | base64`
	p_server=/etc/iris/iris-server.properties
	sed_p="s:.*db.password=.*:db.password=$tms_pwd:"
	sed -i ''$sed_p'' $p_server
	create_user='echo "CREATE USER tms NOSUPERUSER NOCREATEDB NOCREATEROLE PASSWORD '\'$tms_pwd\''" | psql'
	su --login postgres -c "$create_user"
}

function create_tms_database() {
	echo "Creating tms database"
	create_db="createdb tms; psql tms -f /var/lib/iris/sql/tms-template.sql"
	su --login postgres -c "$create_db"
}

function configure_selinux() {
	echo "Configuring SELinux for nginx"
	semanage port -a -t http_port_t -p tcp 3030
	setsebool -P httpd_can_network_connect true
}

function configure_firewall() {
	echo "Configuring firewall"
	firewall-cmd --permanent --add-port=1037/tcp
	firewall-cmd --reload
}

function configure_services() {
	echo "Configuring services"
	systemctl enable nginx.service
	systemctl start nginx.service
	systemctl enable iris.service
}

function echo_success() {
	echo
	echo "Successfully initialized the IRIS server"
	echo
}

function create_links() {
	version="5.81.0"
	echo "Creating IRIS links for verion $version"
	host=`hostname -f`
	ln -snf /usr/share/java/iris-server/iris-server-$version.jar /usr/share/java/iris-server/iris-server.jar
	sed -i ''s,@@WEBSTART.HOST@@,$host,'' /var/www/html/iris-client/iris-client.jnlp
	install -o nginx -g nginx -m 0444 /etc/iris/iris-client.keystore /var/www/html/iris-client/
	install -o nginx -g nginx -m 0444 /etc/iris/iris-client.properties /var/www/html/iris-client/
	SED_STR='3s,^,\# DO NOT EDIT -- copied from /etc/iris by iris_ctl update\n,'
	sed -i "$SED_STR" /var/www/html/iris-client/iris-client.properties
}

function update_database() {
	echo
	# FIXME: run required SQL migrate scripts
}

case "$1" in
	init)
		check_initialized
		update_client_properties
		create_keystores
		init_db
		create_tms_user
		create_tms_database
		configure_selinux
		configure_firewall
		configure_services
		create_links
		echo_success
		;;
	cert)
		create_keystores
		;;
	update)
		create_links
		update_database
		;;
	*)
		echo $"Usage: $0 {init|update}"
		exit 1
esac
