#!/bin/bash

eval "$(ucr shell)"

CONFIG="$(univention-app shell mattermost cat /etc/univention/base.conf)"
DATADIR="/var/lib/univention-appcenter/apps/mattermost/data"
CONFIG_JSON="${DATADIR}/config/config.json"

if [ ! -e $CONFIG_JSON ]; then
	echo "Config file does not yet exist. Skipping configure."
	exit 0
fi

CONFIG_HOSTNAME="$(echo "$CONFIG" | sed -n 's/^mattermost\/hostname: \(.*\)/\1/p')"
if [ -z ${CONFIG_HOSTNAME} ]; then
	# use default hostname if CONFIG_HOSTNAME is not set
	echo "setting default hostname"
	HOST="https://${hostname}.${domainname}:8234/"
	ServerName="${hostname}.${domainname}"
	Ports="Listen 8123
Listen 8234"
	VirtualHostHTTP="*:8123"
	VirtualHostSSL="*:8234"
else
	echo "using custom hostname"
	HOST="https://$CONFIG_HOSTNAME/"
	ServerName="$CONFIG_HOSTNAME"
	Ports=""
	VirtualHostHTTP="*:80"
	VirtualHostSSL="*:443"
fi

CONFIG_IFRAME="$(echo "$CONFIG" | sed -n 's/^mattermost\/iframe: \(.*\)/\1/p')"
if [ ! -z ${CONFIG_IFRAME} ]; then
	echo "allowing Mattermost to be embedded"
	IFRAME1="	# Optional headers if Mattermost should be accesible from within Kopano WebApp
	Header set X-Frame-Options \"ALLOW-FROM https://${CONFIG_IFRAME}\"
	Header edit Content-Security-Policy ^(.*)$ \"\$1;frame-ancestors 'self' https://${CONFIG_IFRAME}\""
	IFRAME2="		# Optional headers if Mattermost should be accesible from within Kopano WebApp
		Header unset X-Frame-Options
		Header unset Content-Security-Policy"
else
	echo "not setting CSP and x-frame options"
	IFRAME1=""
	IFRAME2=""
fi

CONFIG_SSLCERTIFICATE="$(echo "$CONFIG" | sed -n 's/^mattermost\/sslcertificate: \(.*\)/\1/p')"
if [ ! -z ${CONFIG_SSLCERTIFICATE} ] && [ -f ${CONFIG_SSLCERTIFICATE} ]; then
	echo "using custom certificate"
	SSLCERTIFICATE="$CONFIG_SSLCERTIFICATE"
elif [ ! -z $(ucr get apache2/ssl/certificate) ]; then
	echo "using ucr defined certificate"
	SSLCERTIFICATE=$(ucr get apache2/ssl/certificate)
else
	echo "using ucs default certificate"
	SSLCERTIFICATE="/etc/univention/ssl/${hostname}.${domainname}/cert.pem"
fi

CONFIG_SSLKEY="$(echo "$CONFIG" | sed -n 's/^mattermost\/sslkey: \(.*\)/\1/p')"
if [ ! -z ${CONFIG_SSLKEY} ] && [ -f ${CONFIG_SSLKEY} ]; then
	echo "using custom private key"
	SSLKEY="$CONFIG_SSLKEY"
elif [ ! -z $(ucr get apache2/ssl/key) ]; then
	echo "using ucr defined private key"
	SSLKEY=$(ucr get apache2/ssl/key)
else
	echo "using ucs default privat key"
	SSLKEY="/etc/univention/ssl/${hostname}.${domainname}/private.key"
fi

CONFIG_SSLCA="$(echo "$CONFIG" | sed -n 's/^mattermost\/sslca: \(.*\)/\1/p')"
if [ ! -z ${CONFIG_SSLCA} ] && [ -f ${CONFIG_SSLCA} ]; then
	echo "using custom ca"
	SSLCA="$CONFIG_SSLCA"
elif [ ! -z $(ucr get apache2/ssl/ca) ]; then
	echo "using ucr defined ca"
	SSLCA=$(ucr get apache2/ssl/ca)
else
	echo "using ucs default ca"
	SSLCA="/etc/univention/ssl/ucsCA/CAcert.pem"
fi

CONFIG_SSLCHAIN="$(echo "$CONFIG" | sed -n 's/^mattermost\/sslchain: \(.*\)/\1/p')"
if [ ! -z ${CONFIG_SSLCHAIN} ] && [ -f ${CONFIG_SSLHAIN} ]; then
	echo "using custom chain"
	SSLCHAIN="SSLCertificateChainFile $CONFIG_SSLCHAIN"
elif [ ! -z $(ucr get apache2/ssl/certificatechain) ]; then
	echo "using ucr defined chain"
	SSLCHAIN="SSLCertificateChainFile $(ucr get apache2/ssl/certificatechain)"
fi

# create special apache config (should ideally use a subdomain, but we'll settle for a custom port for now)
cat <<-EOF >"/etc/apache2/sites-available/mattermost.conf"

#################################################################
# generated by Mattermost app join script, do not edit manually #
#################################################################

${Ports}

<VirtualHost ${VirtualHostHTTP}>
        ServerName ${ServerName}
        ServerAdmin webmaster@example.org

        ErrorLog \${APACHE_LOG_DIR}/mattermost-error.log
        CustomLog \${APACHE_LOG_DIR}/mattermost-access.log combined

        # Enforce HTTPS:
        RewriteEngine On
        RewriteCond %{REQUEST_URI} !^/.well-known/acme-challenge/
        RewriteCond %{HTTPS} !=on
        RewriteRule ^/?(.*) https://%{SERVER_NAME}:8234/\$1 [R,L]
</VirtualHost>

<VirtualHost ${VirtualHostSSL}>
        SSLEngine on
        ServerName ${ServerName}
        ServerAdmin webmaster@example.org

        SSLCertificateFile ${SSLCERTIFICATE}
        SSLCertificateKeyFile ${SSLKEY}
        SSLCACertificateFile ${SSLCA}
	${SSLCHAIN}

        ErrorLog \${APACHE_LOG_DIR}/mattermost-error.log
        CustomLog \${APACHE_LOG_DIR}/mattermost-access.log combined

        RewriteEngine On
        RewriteCond %{REQUEST_URI} ^/api/v1/websocket [NC,OR]
        RewriteCond %{HTTP:UPGRADE} ^WebSocket$ [NC,OR]
        RewriteCond %{HTTP:CONNECTION} ^Upgrade$ [NC]
        RewriteRule .* ws://127.0.0.1:8065%{REQUEST_URI} [P,QSA,L]
        RewriteCond %{DOCUMENT_ROOT}/%{REQUEST_FILENAME} !-f
        RewriteRule .* http://127.0.0.1:8065%{REQUEST_URI} [P,QSA,L]
        RequestHeader set X-Forwarded-Proto "https"

        RequestHeader unset If-Modified-Since
        RequestHeader unset If-None-Match
	${IFRAME1}
        <LocationMatch "/api/(?<version>v[0-9]+)/(?<users>users/)?websocket$">
                Require all granted
                ProxyPassReverse ws://127.0.0.1:8065/api/%{env:MATCH_VERSION}/%{env:MATCH_USERS}websocket
                ProxyPassReverseCookieDomain 127.0.0.1 ${ServerName}
		${IFRAME2}
        </LocationMatch>
        <Location />
                Require all granted
                ProxyPassReverse http://127.0.0.1:8065/
                ProxyPassReverseCookieDomain 127.0.0.1 ${ServerName}
		${IFRAME2}
        </Location>

        ProxyPreserveHost On
        ProxyRequests Off
</VirtualHost>
EOF

cat <<-EOF >"/etc/apache2/ucs-sites.conf.d/mattermost.conf"

#################################################################
# generated by Mattermost app join script, do not edit manually #
#################################################################

Redirect 303 /mattermost ${HOST}
EOF

a2ensite mattermost
invoke-rc.d apache2 reload

# update links to mattermost for portal
PORTAL="ucs/web/overview/entries/admin/mattermost"
ucr set \
  ${PORTAL}/description="Mattermost login" \
  ${PORTAL}/description/de="Login für Mattermost" \
  ${PORTAL}/label?"Mattermost" \
  ${PORTAL}/label/de?"Mattermost" \
  ${PORTAL}/link="$HOST" \
  ${PORTAL}/priority?95

# read value of RequireEmailVerification, default to false if not set
CONFIG_RequireEmailVerification="$(echo "$CONFIG" | sed -n 's/^mattermost\/RequireEmailVerification: \(.*\)/\1/p')"
CONFIG_RequireEmailVerification=${CONFIG_RequireEmailVerification:-false}

# update hostname in Mattermost
sed -i'' -e 's|"SiteURL":.*|"SiteURL": "'$HOST'",|' \
-e 's|"RequireEmailVerification":.*,|"RequireEmailVerification": '$CONFIG_RequireEmailVerification',|g' \
$CONFIG_JSON

# reset ConnectionSecurity of ServiceSettings back to empty in case the admin accidentally changed it
sed -i'' \
 -e '/\ServiceSettings/,/ConnectionSecurity/ s/"ConnectionSecurity": "TLS"/"ConnectionSecurity": ""/' \
 $CONFIG_JSON