#!/bin/sh

VERSION=1

# see https://wiki.univention.de/index.php?title=Integration_with_UCS/Join

. /usr/share/univention-appcenter/joinscripthelper.sh
#$APP # app id
#$APP_VERSION # app version
#$SERVICE # app name
#$CONTAINER # docker container id

. /usr/share/univention-lib/all.sh

joinscript_init

eval "$(ucr shell ldap/base)"
eval "$(ucr shell ldap/server/name)"
eval "$(ucr shell ldap/server/port)"

# add bm-ucs-user
APP_USER=${APP}-systemuser

joinscript_add_app_system_user () {
    #local password
    local pwdfile
    local position

    #password="$(makepasswd)"
    pwdfile="/etc/$APP.secret"

    # create pwdfile at host
    touch ${pwdfile}
    chown root:root ${pwdfile}
    chmod 600 ${pwdfile}
    printf '%s' "${password}" > ${pwdfile}

    # create pwdfile in container
    joinscript_run_in_container touch "$pwdfile"
    joinscript_run_in_container chmod 600 "$pwdfile"
    echo "$password" > $(joinscript_container_file "$pwdfile")

    # create user
    # see https://docs.software-univention.de/app-tutorial-4.0.html#integration:ldap:access
    # for more access permissions
    #position="cn=users,$ldap_base"
    position="cn=dc,cn=computers,$ldap_base"
    eval "$(ucr shell ldap/base)"
    udm users/user create "$@" --ignore_exists \
        --position "$position" \
        --set username="$APP-systemuser" \
        --set password="$password" \
        --set firstname="$SERVICE Service" \
        --set lastname="LDAP Account" \
        --set description="Account used by $SERVICE to authenticate against LDAP directory" \
        --set objectFlag="hidden" \
        --option ldap_pwd || die
    udm users/user modify "$@" \
        --dn "uid=$APP-systemuser,$position" \
        --set password="$password"
}
password=$(< /dev/urandom tr -dc _A-Z-a-z-0-9 | head -c32)
joinscript_add_app_system_user "$@"

ucs_addServiceToLocalhost "${SERVICE}" "$@"

app_config_file=/home/bm_ucs/production.ini
docker_bip=$(ucr get docker/daemon/default/opts/bip | cut -d "/" -f 1)

cat > "$(joinscript_container_file_touch ${app_config_file})" <<- EOF
[uwsgi]
http = 0.0.0.0:8080
master = true
master-fifo = ./.uwsgi.fifo
smart-attach-daemon = /home/bm_ucs/var/run/redis/redis-server.pid /usr/bin/redis-server /home/bm_ucs/etc/redis.conf

processes = 2

harakiri = 60
harakiri-verbose = true
limit-post = 65536
post-buffering = 8192

listen = 128

max-requests = 1000

reload-on-as = 128
reload-on-rss = 96
no-orphans = true


[app:bm-ucs-school]
use = egg:bettermarks-ucs-connector

pyramid.reload_templates = true
pyramid.debug_authorization = true
pyramid.debug_notfound = true
pyramid.debug_routematch = false
pyramid.default_locale_name = en
#pyramid.includes =
#    pyramid_debugtoolbar


# app specific setting
ucs.ldap = True
ucs.ldap.host = ${docker_bip}
ucs.ldap.port = ${ldap_server_port}
ucs.ldap.url= ldap://${docker_bip}:${ldap_server_port}
ucs.ldap.base = ${ldap_base}
ucs.ldap.binddn = uid=${APP_USER},cn=dc,cn=computers,$ldap_base
ucs.ldap.password = ${password}
ucs.static.url = https://static-ucs.bettermarks.com

[composite:main]
use = egg:rutter#urlmap
/bettermarks = bm-ucs-school

[loggers]
keys = root, bm_ucs

[handlers]
keys = console

[formatters]
keys = generic

[logger_root]
level = DEBUG
handlers = console

[logger_bm_ucs]
level = DEBUG
handlers =
qualname = bm_ucs

[handler_console]
class = StreamHandler
args = (sys.stderr,)
level = NOTSET
formatter = generic

[handler_papertrail]
class = logging.handlers.SysLogHandler
args = (('logs5.papertrailapp.com', 25880),1,None,)
formatter = papertrail

[formatter_generic]
format=%(asctime)s - %(process)s/%(thread)s - %(levelname)s - %(name)s - %(message)s
style={

[formatter_papertrail]
format=bm-ucs-school - %(asctime)s - %(levelname)s - %(name)s - %(message)s
style={
EOF
joinscript_run_in_container chown bm_ucs:bm_ucs /home/bm_ucs/production.ini
joinscript_run_in_container bm-ucs-school reload

joinscript_save_current_version

exit 0