#!/bin/bash

PATH=/usr/local/sbin:/usr/sbin:/sbin:/usr/local/bin:/usr/bin:/bin

echo -e "\n--- installing packages"
PACKAGES="mariadb-server mariadb-client mariadb-backup"
PACKAGES="$PACKAGES apache2 certbot python-certbot-apache"
PACKAGES="$PACKAGES php libapache2-mod-php php-gd php-xml php-json php-mysql php-sqlite3 php-mbstring"
PACKAGES="$PACKAGES javascript-common libao-common libao4 libcurl3-gnutls libflac8 libjs-cropper libjs-prototype libjs-scriptaculous libogg0 libspeex1 libvorbis0a libvorbisenc2 libvorbisfile3 php-getid3 vorbis-tools php-curl"
PACKAGES="$PACKAGES curl wget zstd rsnapshot less tree zip unzip anacron" #openssh-server
apt update && apt upgrade -y && apt install -y $PACKAGES || exit

echo -e "\n--- disabling SSH password authentication"
sed 's/^#\(PasswordAuthentication\) yes$/\1 no/' -i /etc/ssh/sshd_config
systemctl reload sshd

IPV6="2001:41d0:304:200::533" #TODO: config
MSK6=64
GW6="2001:41d0:304:200::1"
cat > /etc/network/interfaces.d/51-cloud-init-ipv6.cfg << EOF
auto eth0
iface eth0 inet6 static
mtu 1500
address $IPV6
netmask $MSK6
post-up /sbin/ip -6 route add $GW6 dev eth0
post-up /sbin/ip -6 route add default via $GW6 dev eth0
pre-down /sbin/ip -6 route del default via $GW6 dev eth0
pre-down /sbin/ip -6 route del $GW6 dev eth0
EOF
systemctl restart networking

( cd /usr/local/sbin ; wget https://backups.endres.fr/wp-server/scripts.tar.gz -O - | tar -zxvf - )
build-packages.sh

#recommended method to keep system up to date is using "unattended-upgrades" package
cat > /etc/cron.daily/auto-update << EOF
#!/bin/sh
apt update
apt -y upgrade
build-packages.sh
EOF
chmod +x /etc/cron.daily/auto-update
systemctl enable anacron
systemctl start anacron

echo -en "\nchoose a database root password: "
read -s password

cat > /etc/wp-server.cfg << EOF
DB_PASSWORD="$password"
WWW_PATH="/srv/wordpress"
BACKUP_PATH="/srv/backups"
EOF
chmod 640 /etc/wp-server.cfg
source /etc/wp-server.cfg


echo -e "\n--- configuring Apache web server"
mkdir -p $WWW_PATH
a2enmod http2
a2enmod rewrite
a2enmod ssl
a2enmod dav*
a2dissite 000-default
systemctl restart apache2


echo -e "\n--- configuring MariaDB database"
cat > mysql-$$.tmp << EOF
DELETE FROM mysql.user WHERE User='';
DELETE FROM mysql.user WHERE User='root' AND Host NOT IN ('localhost', '127.0.0.1', '::1');
DROP DATABASE IF EXISTS test;
set password for 'root'@'localhost' = password('$DB_PASSWORD');
flush privileges;
EOF
mysql -u root < mysql-$$.tmp
rm -f mysql-$$.tmp


echo -e "\n--- configuring backups"
#web application
mkdir -p $BACKUP_PATH/www
mv /usr/local/sbin/index-backup.php $BACKUP_PATH/www/
mv /usr/local/sbin/w3.css $BACKUP_PATH/www/
cat > $BACKUP_PATH/www/robots.txt << EOF
User-agent: *
Disallow: /
EOF
touch /etc/htpasswd
#loaded from backup:
#~ cat > /etc/apache2/sites-enabled/backups.grafikaweb.fr.conf << EOF
#~ <VirtualHost *:80> 
  #~ ServerName backups.grafikaweb.fr
  #~ RewriteEngine on
  #~ RewriteCond %{SERVER_NAME}=backups.grafikaweb.fr
  #~ RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
#~ </VirtualHost>

#~ <VirtualHost *:443> 
  #~ ServerName backups.grafikaweb.fr
  #~ Protocols h2 http:/1.1

  #~ DocumentRoot $BACKUP_PATH/www/
  #~ <Directory $BACKUP_PATH/www>
    #~ Options FollowSymLinks
    #~ AllowOverride Limit Options FileInfo
    #~ DirectoryIndex index.php
    #~ Require all granted
  #~ </Directory>

  #~ Include /etc/letsencrypt/options-ssl-apache.conf
  #~ SSLCertificateFile /etc/letsencrypt/live/grafikaweb.fr/fullchain.pem
  #~ SSLCertificateKeyFile /etc/letsencrypt/live/grafikaweb.fr/privkey.pem
#~ </VirtualHost>
#~ EOF

cat > /etc/rsnapshot.conf << EOF
config_version	1.2

snapshot_root	$BACKUP_PATH/

cmd_cp		/usr/bin/cp
cmd_rm		/usr/bin/rm
cmd_rsync	/usr/bin/rsync
cmd_logger	/usr/bin/logger

retain	daily	7
retain	weekly	4
retain	monthly	12

lockfile	/var/run/rsnapshot.pid

backup	$WWW_PATH/	wp-content/
backup_exec	backup-databases.sh
backup	/var/lib/mysql-dump/	mysql-dump/
backup	/etc/apache2/sites-available/	sites-available/
backup	/etc/letsencrypt/	letsencrypt/
backup	/etc/htpasswd	htpasswd/
EOF

rm -f /etc/cron.d/rsnapshot
for d in daily weekly monthly; do
	echo -e "#\!/bin/sh\nrsnapshot $d" > /etc/cron.$d/rsnapshot
	chmod +x /etc/cron.$d/rsnapshot
done


echo -e "\n--- configuring sync"
mkdir -p $BACKUP_PATH/www/sync/logs
chown www-data $BACKUP_PATH/www/sync/logs
cat > $BACKUP_PATH/www/sync/logs/.htaccess << EOF
Order deny,allow
Deny from all
EOF
mv /usr/local/sbin/index-sync.php $BACKUP_PATH/www/sync
ln -sf ../w3.css $BACKUP_PATH/www/sync
