#!/bin/bash

BAIKAL_VERSION="0.8.0"

#~ echo -e "\n*** Set root password"
#~ passwd
sed 's/^root:[^:]*:\(.*\)/root:!:\1/' -i /etc/shadow

echo -e "\n*** Updating system"
pacman-key --init
pacman-key --populate archlinuxarm
pacman -Syu


echo -e "\n** Misc utils (vim, wget, hostname)"
pacman --noconfirm -S vim inetutils wget
pacman --noconfirm -R vi
ln -sf vim /usr/bin/vi


echo -e "\n*** Installing cron system"
pacman --noconfirm -S cronie
systemctl enable cronie; systemctl start cronie
echo -e '#!/bin/sh\npacman --noconfirm -Syu\nreboot' > /etc/cron.monthly/system-upate
chmod +x /etc/cron.monthly/system-upate


echo -e "\n*** Installing and configuring web server"
pacman --noconfirm -S apache php-fpm php-apache php-sqlite
sed -e 's/^#\(LoadModule proxy_module\)/\1/' -e 's/^#\(LoadModule proxy_fcgi_module\)/\1/' -i /etc/httpd/conf/httpd.conf
cat > /etc/httpd/conf/extra/php-fpm.conf << EOF
DirectoryIndex index.php index.html
<FilesMatch \.php$>
    SetHandler "proxy:unix:/run/php-fpm/php-fpm.sock|fcgi://localhost/"
</FilesMatch>
EOF
echo "Include conf/extra/php-fpm.conf" >> /etc/httpd/conf/httpd.conf
sed -e 's/;\(date.timezone\).*/\1 = Europe\/Paris/' -e 's/;\(extension=pdo_sqlite\)/\1/' -e 's/;\(extension=sqlite3\)/\1/' -i /etc/php/php.ini


echo -e "\n*** Enabling HTTPS / Let's Encrypt + HSTS"
fqdn=$(cat /etc/hosts | grep $(hostname) | cut -f2 -d' ')
pacman --noconfirm -S acme.sh socat
mkdir -p /etc/letsencrypt
domain="alarmpi.endres.fr"
acme.sh --issue --standalone -d $domain
acme.sh --install-cert -d $domain --cert-file /etc/letsencrypt/$domain-cert.pem --key-file /etc/letsencrypt/$domain-key.pem --fullchain-file /etc/letsencrypt/$domain-chain.pem
HEADERS="Header always set Strict-Transport-Security \"max-age=31536000; includeSubDomains; preload\"\n\
Header always set Referrer-Policy no-referrer\n\
Header always set X-Content-Type-Options nosniff\n\
Header always set X-Frame-Options deny\n\
Header always set X-XSS-Protection \"1; mode=block\""
sed -e 's/^#\(LoadModule ssl_module\)/\1/' -e 's/^#\(LoadModule socache_shmcb_module\)/\1/' \
	-e 's@^#\(Include conf/extra/httpd-ssl.conf\)@\1@' -e 's/^#\(LoadModule rewrite_module\)/\1/' \
	-e 's/^#\(LoadModule http2_module\)/\1/' -i /etc/httpd/conf/httpd.conf
sed -e "s@^\(SSLCertificateFile\) .*@\1 /etc/letsencrypt/$fqdn-cert.pem@" -e "s@^\(SSLCertificateKeyFile\) .*@\1 /etc/letsencrypt/$fqdn-key.pem@" \
	-e "s@^#\(SSLCertificateChainFile\) .*@\1 /etc/letsencrypt/$fqdn-chain.pem@" -e "s/ServerName .*/ServerName $fqdn:443\n$HEADERS/" \
	-i /etc/httpd/conf/extra/httpd-ssl.conf
echo "Protocols h2 http/1.1" >> /etc/httpd/conf/httpd.conf
mkdir /etc/httpd/conf/vhosts
cat > /etc/httpd/conf/vhosts/$fqdn.conf << EOF
<VirtualHost *:80> 
    ServerName $fqdn
    RewriteEngine on
    RewriteCond %{HTTPS} off
    RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
</VirtualHost>
EOF
echo "Include conf/vhosts/$fqdn.conf" >> /etc/httpd/conf/httpd.conf

systemctl enable php-fpm; systemctl start php-fpm
systemctl enable httpd; systemctl start httpd

cat > /etc/cron.monthly/acme << EOF
#!/bin/sh
systemctl stop httpd
for domain in \$(ls /etc/letsencrypt | cut -f1 -d- | sort -u); do
    acme.sh --renew --domain \$domain
    acme.sh --install-cert -d \$domain --cert-file /etc/letsencrypt/\$domain-cert.pem --key-file /etc/letsencrypt/\$domain-key.pem --fullchain-file /etc/letsencrypt/\$domain-chain.pem
done
systemctl start httpd
EOF
chmod +x /etc/cron.monthly/acme


echo -e "\n*** Setup backup service (GrafikaWeb)"
pacman --noconfirm -S rsnapshot
echo "/srv/backups	/data/backups	none	bind	0	0" >> /etc/fstab
mkdir /srv/backups /data/backups; mount /data/backups
cat > /etc/rsnapshot.conf << EOF
config_version	1.2

snapshot_root	/srv/backups/

cmd_cp		/usr/bin/cp
cmd_rm		/usr/bin/rm
cmd_rsync	/usr/bin/rsync
cmd_logger	/usr/bin/logger
cmd_ssh		/usr/bin/ssh

retain	daily	7
retain	weekly	4
retain	monthly	12

lockfile	/var/run/rsnapshot.pid

backup	root@51.210.148.242:/srv/wordpress/	wp-content/
backup_exec	ssh root@51.210.148.242 "backup-databases.sh"
backup	root@51.210.148.242:/var/lib/mysql-dump/	mysql-dump/
backup	root@51.210.148.242:/etc/apache2/sites-available/	sites-available/
backup	root@51.210.148.242:/etc/letsencrypt	letsencrypt/
backup	root@51.210.148.242:/etc/htpasswd	htpasswd/
EOF
for d in daily weekly monthly; do
    echo -e '#!/bin/sh\n'"rsnapshot $d" > /etc/cron.$d/rsnapshot
    chmod +x /etc/cron.$d/rsnapshot
done


echo -e "\n*** Setup backup web application"
pacman --noconfirm -S zip
systemctl stop httpd
scp root@51.210.148.242:/etc/htpasswd /etc/
mkdir /srv/backups/www
scp root@51.210.148.242:/srv/backups/www/index.php /srv/backups/www/
ipv4=$(cat /etc/hosts | grep $(hostname) | cut -f1 -d' ')
domain=$(cat /etc/hosts | grep $(hostname) | cut -f4 -d' ')
echo "$ipv4 backups.$domain backups" >> $MOUNTPOINT/etc/hosts
domain="backups.$domain"
acme.sh --issue --standalone -d $domain
acme.sh --install-cert -d $domain --cert-file /etc/letsencrypt/$domain-cert.pem --key-file /etc/letsencrypt/$domain-key.pem --fullchain-file /etc/letsencrypt/$domain-chain.pem
cat > /etc/httpd/conf/vhosts/$domain.conf << EOF
<VirtualHost *:80> 
    ServerName $domain
    RewriteEngine on
    RewriteCond %{HTTPS} off
    RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
</VirtualHost>

<VirtualHost *:443> 
    ServerName $domain
    DocumentRoot /srv/backups/www/
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
    Header always set Referrer-Policy no-referrer
    Header always set X-Content-Type-Options nosniff
    Header always set X-Frame-Options deny
    Header always set X-XSS-Protection "1; mode=block"
    <Directory /srv/backups/www>
		Require all granted
	</Directory>
    SSLCertificateFile /etc/letsencrypt/$domain-cert.pem
    SSLCertificateChainFile /etc/letsencrypt/$domain-chain.pem
    SSLCertificateKeyFile /etc/letsencrypt/$domain-key.pem
</VirtualHost>
EOF
echo "Include conf/vhosts/$domain.conf" >> /etc/httpd/conf/httpd.conf
mkdir /srv/backups/www/wp-server
mv /root/scripts.tar.gz /srv/backups/www/wp-server/


echo -e "\n*** Setup calendar and contacts (Baikal)"
pacman --noconfirm -S unzip
mkdir /data/baikal /srv/baikal
echo "/data/baikal	/srv/baikal	none	bind	0	0" >> /etc/fstab
mount /data/baikal
cat > /usr/local/bin/update-baikal << EOF
#!/bin/sh
if [ -z "\$1" ]; then
    echo "usage: \$0 baikal_version"
    echo "example: \$0 0.8.0"
    exit 1
fi
wget https://github.com/sabre-io/Baikal/releases/download/$BAIKAL_VERSION/baikal-\$1.zip || exit 2
unzip baikal-\$1.zip ; rm baikal-\$1.zip
rsync -a baikal/ /srv/baikal ; rm -rf baikal
chown -R http:http /srv/baikal/{config,Specific}
EOF
chmod +x /usr/local/bin/update-baikal
update-baikal $BAIKAL_VERSION

ipv4=$(cat /etc/hosts | grep $(hostname) | cut -f1 -d' ')
domain=$(cat /etc/hosts | grep $(hostname) | cut -f4 -d' ')
echo "$ipv4 baikal.$domain baikal" >> $MOUNTPOINT/etc/hosts
domain="baikal.$domain"
acme.sh --issue --standalone -d $domain
acme.sh --install-cert -d $domain --cert-file /etc/letsencrypt/$domain-cert.pem --key-file /etc/letsencrypt/$domain-key.pem --fullchain-file /etc/letsencrypt/$domain-chain.pem
cat > /etc/httpd/conf/vhosts/$domain.conf << EOF
<VirtualHost *:80> 
    ServerName $domain
    RewriteEngine on
    RewriteCond %{HTTPS} off
    RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
</VirtualHost>

<VirtualHost *:443> 
    ServerName $domain
    DocumentRoot /srv/baikal/html/
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
    Header always set Referrer-Policy no-referrer
    Header always set X-Content-Type-Options nosniff
    Header always set X-Frame-Options deny
    Header always set X-XSS-Protection "1; mode=block"
    Header always set Content-Security-Policy "default-src 'self'"
    SSLCertificateFile /etc/letsencrypt/$domain-cert.pem
    SSLCertificateChainFile /etc/letsencrypt/$domain-chain.pem
    SSLCertificateKeyFile /etc/letsencrypt/$domain-key.pem
    
    RewriteEngine on
    RewriteRule /.well-known/carddav /dav.php [R=308,L]
    RewriteRule /.well-known/caldav  /dav.php [R=308,L]

    <Directory "/srv/baikal/html">
	    Options FollowSymlinks
	    AllowOverride All
        Require all granted
    </Directory>
</VirtualHost>
EOF
echo "Include conf/vhosts/$domain.conf" >> /etc/httpd/conf/httpd.conf
systemctl start httpd

systemctl reload cronie


echo -e "\n*** Setup /home directory & syncthing"
echo "/data/home	/home	none	bind	0	0" >> /etc/fstab
mount /data/home

pacman -S syncthing
useradd -g users -m frank
mkdir /home/frank/.ssh
cp /root/.ssh/authorized_keys /home/frank/.ssh/
chown -R frank:users /home/frank/.ssh
systemctl enable syncthing@frank.service
systemctl start syncthing@frank.service
