#!/bin/sh
# postinst script for bacula-cn
#
# see: dh_installdeb(1)

set -e

# Source debconf library.
. /usr/share/debconf/confmodule

# summary of how this script can be called:
#        * <postinst> `configure' <most-recently-configured-version>
#        * <old-postinst> `abort-upgrade' <new version>
#        * <conflictor's-postinst> `abort-remove' `in-favour' <package>
#          <new-version>
#        * <postinst> `abort-remove'
#        * <deconfigured's-postinst> `abort-deconfigure' `in-favour'
#          <failed-install-package> <version> `removing'
#          <conflicting-package> <version>
# for details, see http://www.debian.org/doc/debian-policy/ or
# the debian-policy package

generate_fd_config() {
    FD_CONFIG=/etc/bacula/bacula-fd.conf

    if [ -s $FD_CONFIG ] && grep -q 'PKI Keypair' $FD_CONFIG; then
        echo $FD_CONFIG already exists, skipping.
    else
        umask 077
      
        if [ -e $FD_CONFIG -a ! -e $FD_CONFIG.bak ]; then
            cp -av $FD_CONFIG $FD_CONFIG.bak
        fi

        echo Generating $FD_CONFIG
        rm -f $REQUEST_FILE
        cat >$FD_CONFIG <<EOF
#
# List Directors who are permitted to contact this File daemon
#
Director {
  Name = sysbackup-dir
  Password = "$PASS_FD"

  TLS Enable = yes
  TLS Require = yes
  TLS Verify Peer = yes
  # Allow only the Director to connect
  TLS Allowed CN = "sysbackup.carnet.hr"
  TLS CA Certificate File = "/etc/bacula/sysbackup.pem"
  # This is a server certificate. It is used by connecting
  # directors to verify the authenticity of this file daemon
  TLS Certificate = "/etc/bacula/bacula-fd.pem"
  TLS Key = "/etc/bacula/bacula-fd.pem"
  TLS DH File = "/etc/bacula/dh2048.pem"
}

#
# "Global" File daemon configuration specifications
#
FileDaemon {                          # this is me
  Name = $HOST-fd
  FDport = 9102                  # where we listen for the director
  WorkingDirectory = /var/lib/bacula
  Pid Directory = /run/bacula
  Maximum Concurrent Jobs = 20
  Plugin Directory = /usr/lib/bacula
  FDAddress = $IP

  # you need these TLS entries so the FD and SD can communicate
  TLS Enable = yes
  TLS Require = yes
  TLS CA Certificate File = "/etc/bacula/sysbackup.pem"
  TLS Certificate = "/etc/bacula/bacula-fd.pem"
  TLS Key = "/etc/bacula/bacula-fd.pem"

  # you need these PKI entries to encrypt data before sending it to backup
  PKI Signatures = Yes            # Enable Data Signing
  PKI Encryption = Yes            # Enable Data Encryption
  PKI Keypair = "/etc/bacula/bacula-fd.pem"    # Public and Private Keys
}

# Send all messages except skipped files back to Director
Messages {
  Name = Standard
  director = sysbackup-dir = all, !skipped, !restored
}
EOF
    fi
}

generate_bconsole_config() {
    BCONSOLE_CONFIG=/etc/bacula/bconsole.conf

    if [ -s $BCONSOLE_CONFIG ] && grep -q 'Console {' $BCONSOLE_CONFIG; then
        echo $BCONSOLE_CONFIG already exists, skipping.
    else
        umask 077

        if [ -e $BCONSOLE_CONFIG -a ! -e $BCONSOLE_CONFIG.bak ]; then
            cp -av $BCONSOLE_CONFIG $BCONSOLE_CONFIG.bak
        fi

        echo Generating $BCONSOLE_CONFIG
        rm -f $REQUEST_FILE
        cat >$BCONSOLE_CONFIG <<EOF
#
# Bacula User Agent (or Console) Configuration File
#

Director {
  Name = sysbackup-dir
  DIRport = 9101
  address = sysbackup.carnet.hr
  Password = "__INVALID__"   # not used

  # you need these TLS entries so the bconsole and Director can communicate
  TLS Enable = yes
  TLS Require = yes
  TLS CA Certificate File = "/etc/bacula/sysbackup.pem"
  TLS Certificate = "/etc/bacula/bacula-fd.pem"
  TLS Key = "/etc/bacula/bacula-fd.pem"
}

Console {
  Name = $HOST-acl
  Password = "$PASS_BCONSOLE"
}
EOF
    fi
}

generate_dh() {
    DH_FILE=/etc/bacula/dh2048.pem

    if [ -s $DH_FILE ]; then
        echo $DH_FILE already exists, skipping.
    else
        umask 077

        echo Generating $DH_FILE
        ###openssl dhparam -out $DH_FILE -5 1024
        openssl dhparam -out $DH_FILE -2 2048
 	
    fi
}

generate_cert() {
    CERT_FILE=/etc/bacula/bacula-fd.pem

    if [ -s $CERT_FILE ]; then
        echo $CERT_FILE already exists, skipping.
    else
        umask 077

        echo Generating $CERT_FILE
        rm -f $REQUEST_FILE
        openssl req -new -newkey rsa:2048 -nodes -keyout $CERT_FILE \
            -subj "/C=HR/ST=Croatia/O=CARNet/OU=sysbackup/CN=$IP" \
            -x509 -extensions usr_cert -days $((365*10)) \
            -out $CERT_FILE
    fi
}

restart_bacula() {
    if [ -x "/etc/init.d/bacula-fd" ]; then
        if [ -x "`which invoke-rc.d 2>/dev/null`" ]; then
            invoke-rc.d bacula-fd restart || exit $?
        else
            /etc/init.d/bacula-fd restart || exit $?
        fi
    fi
}

random_string() {
    head -n 20 /dev/urandom | openssl dgst -sha1 | sed 's/^.* //'
}

send_request() {
    # cleanup gpg files
    rm -rf /var/lib/bacula-cn

    if [ -e $REQUEST_FILE ]; then
        echo Config has not changed, skipping request.
        return
    fi

    # report disk sizes
    DF_FILE=$(mktemp bacula-cn.XXXXXXXXXX)
    df -h > $DF_FILE

    # dodaj i /media i /mnt
    test -d /media && du -hs /media || true >> $DF_FILE
    test -d /mnt && du -hs /mnt || true >> $DF_FILE

    # report database sizes
    DB_FILE=$(mktemp bacula-cn.XXXXXXXXXX)
    if [ -d /var/lib/mysql -o -d /var/lib/postgresql ]; then
        du -sh /var/lib/mysql /var/lib/postgresql >$DB_FILE 2>/dev/null || true
    fi

    # generate client config
    FD_FILE=$(mktemp bacula-cn.XXXXXXXXXX)
    cat >> $FD_FILE <<EOF
# Requested by $CONTACT on $DATE
Client {
  Name = $HOST-fd
  @/etc/bacula/include/client-debian-default.conf
  Address = $IP
  Password = "$PASS_FD"         # password for bacula-fd(8)
  TLS CA Certificate File = "/etc/bacula/clients.d/$HOST-fd.pem"
}

Console {
  Name = $HOST-acl
  @/etc/bacula/include/acl-default.conf
  Password = "$PASS_BCONSOLE"         # password for bconsole(8)
  JobACL = $HOST, RestoreFiles
  ClientACL = $HOST-fd
}

Job {
  Name = "$HOST"
  Client = $HOST-fd
  JobDefs = "Job_TapeBackup"
  Messages = messages-$HOST
}

Messages {
  Name = messages-$HOST
  @/etc/bacula/include/messages-defaults.conf
  mail = $EMAIL = all, !skipped
}
EOF

    # client certificate
    PEM_FILE=$(mktemp bacula-cn.XXXXXXXXXX)
    sed -n '/BEGIN CERTIFICATE/,/END CERTIFICATE/p' \
        /etc/bacula/bacula-fd.pem > $PEM_FILE

    # send using web service
    echo Sending sysbackup request.
    [ -s $DB_FILE ] && DB_PARAM="-F db=@$DB_FILE;filename=db.txt"
    if curl --fail --silent --show-error \
         -F "contact=$CONTACT" \
         -F "host=$HOST" \
         -F "ip=$IP" \
         -F "df=@$DF_FILE;filename=df.txt" \
         $DB_PARAM \
         -F "fd=@$FD_FILE;filename=$HOST-fd.conf" \
         -F "pem=@$PEM_FILE;filename=$HOST-fd.pem" \
         --cacert /etc/ssl/certs/ca-certificates.crt \
         https://sysbackup.carnet.hr/bacapp.php >/dev/null
    then
        touch $REQUEST_FILE
    fi

    # cleanup
    rm -f $DF_FILE $DB_FILE $FD_FILE $PEM_FILE

   # report problems
    if [ ! -e $REQUEST_FILE ]; then
        db_input high bacula-cn/request-failed || true
        db_go || true
    fi
}
   
fix_privileges() {
   # fix privileges 
   
    chown root:bacula /etc/bacula/bacula-fd.pem /etc/bacula/bacula-fd.conf /etc/bacula/bconsole.conf
    chmod 640 /etc/bacula/bacula-fd.pem /etc/bacula/bacula-fd.conf /etc/bacula/bconsole.conf  
}
 
set_pinning() {
   # set pin to version from stretch, because bacula 9.* isn't compatible

   PINFILE=/etc/apt/preferences.d/99-carnet

   test -f $PINFILE || touch $PINFILE

   cp-update bacula-cn $PINFILE <<EOF

Package: bacula-fd
Pin: version 7.4.4*
Pin-Priority: 1001

Package: bacula-common
Pin: version 7.4.4*
Pin-Priority: 1001

Package: bacula-console
Pin: version 7.4.4*
Pin-Priority: 1001

EOF

}

load_config() {
    db_get bacula-cn/hostname
    HOST=$RET

    db_get bacula-cn/ip
    IP=$RET

    db_get bacula-cn/contact
    CONTACT=$RET
    EMAIL=${CONTACT#*<}
    EMAIL=${EMAIL%>*}

    PASS_FD=$( random_string )
    PASS_BCONSOLE=$( random_string )

    DATE=$( date '+%Y-%m-%d' )

    REQUEST_FILE=/etc/bacula/bacula-fd.txt
}

case "$1" in
    configure)
        load_config

        generate_cert
        generate_dh
        generate_fd_config
        generate_bconsole_config

	fix_privileges
	set_pinning

        restart_bacula
        send_request

        db_stop
    ;;

    abort-upgrade|abort-remove|abort-deconfigure)
    ;;

    *)
        echo "postinst called with unknown argument \`$1'" >&2
        exit 1
    ;;
esac

# dh_installdeb will replace this with shell code automatically
# generated by other debhelper scripts.

#DEBHELPER#

exit 0