#!/bin/bash

eval "$(ucr shell)"

CONFIG="$(univention-app shell mattermost cat /etc/univention/base.conf)"
DATADIR="/var/lib/univention-appcenter/apps/mattermost/data"
CONFIG_JSON="${DATADIR}/config/config.json"

# hostname and domainname are defined through "$(ucr shell)", have a fallback to satisfy shellcheck
hostname=${hostname:-host}
domainname=${domainname:-domain}

if [ ! -e $CONFIG_JSON ]; then
	echo "Config file does not yet exist. Skipping configure."
	exit 0
fi

CONFIG_HOSTNAME="$(echo "$CONFIG" | sed -n 's/^mattermost\/hostname: \(.*\)/\1/p')"
if [ -z "${CONFIG_HOSTNAME}" ]; then
	# use default hostname if CONFIG_HOSTNAME is not set
	echo "setting default hostname"
	HOST="https://${hostname}.${domainname}:8234/"
	ServerName="${hostname}.${domainname}"
	Ports="Listen 8123
Listen 8234"
	VirtualHostHTTP="*:8123"
	VirtualHostSSL="*:8234"
else
	echo "using custom hostname"
	HOST="https://$CONFIG_HOSTNAME/"
	ServerName="$CONFIG_HOSTNAME"
	Ports=""
	VirtualHostHTTP="*:80"
	VirtualHostSSL="*:443"
fi

CONFIG_IFRAME="$(echo "$CONFIG" | sed -n 's/^mattermost\/iframe: \(.*\)/\1/p')"
if [ -n "${CONFIG_IFRAME}" ]; then
	echo "allowing Mattermost to be embedded"
	IFRAME="	# Optional headers if Mattermost should be accesible from within Kopano WebApp
	Header set X-Frame-Options \"ALLOW-FROM https://${CONFIG_IFRAME}\"
	Header set Content-Security-Policy \"frame-ancestors 'self' https://${CONFIG_IFRAME}\""
else
	echo "not setting CSP and x-frame options"
	IFRAME=""
fi

CONFIG_SSLCERTIFICATE="$(echo "$CONFIG" | sed -n 's/^mattermost\/sslcertificate: \(.*\)/\1/p')"
if [ -n "${CONFIG_SSLCERTIFICATE}" ] && [ -f "${CONFIG_SSLCERTIFICATE}" ]; then
	echo "using custom certificate"
	SSLCERTIFICATE="$CONFIG_SSLCERTIFICATE"
elif [ -n "$(ucr get apache2/ssl/certificate)" ]; then
	echo "using ucr defined certificate"
	SSLCERTIFICATE=$(ucr get apache2/ssl/certificate)
else
	echo "using ucs default certificate"
	SSLCERTIFICATE="/etc/univention/ssl/${hostname}.${domainname}/cert.pem"
fi

CONFIG_SSLKEY="$(echo "$CONFIG" | sed -n 's/^mattermost\/sslkey: \(.*\)/\1/p')"
if [ -n "${CONFIG_SSLKEY}" ] && [ -f "${CONFIG_SSLKEY}" ]; then
	echo "using custom private key"
	SSLKEY="$CONFIG_SSLKEY"
elif [ -n "$(ucr get apache2/ssl/key)" ]; then
	echo "using ucr defined private key"
	SSLKEY=$(ucr get apache2/ssl/key)
else
	echo "using ucs default privat key"
	SSLKEY="/etc/univention/ssl/${hostname}.${domainname}/private.key"
fi

CONFIG_SSLCA="$(echo "$CONFIG" | sed -n 's/^mattermost\/sslca: \(.*\)/\1/p')"
if [ -n "${CONFIG_SSLCA}" ] && [ -f "${CONFIG_SSLCA}" ]; then
	echo "using custom ca"
	SSLCA="$CONFIG_SSLCA"
elif [ -n "$(ucr get apache2/ssl/ca)" ]; then
	echo "using ucr defined ca"
	SSLCA=$(ucr get apache2/ssl/ca)
else
	echo "using ucs default ca"
	SSLCA="/etc/univention/ssl/ucsCA/CAcert.pem"
fi

CONFIG_SSLCHAIN="$(echo "$CONFIG" | sed -n 's/^mattermost\/sslchain: \(.*\)/\1/p')"
if [ -n "${CONFIG_SSLCHAIN}" ] && [ -f "${CONFIG_SSLCHAIN}" ]; then
	echo "using custom chain"
	SSLCHAIN="SSLCertificateChainFile $CONFIG_SSLCHAIN"
elif [ -n "$(ucr get apache2/ssl/certificatechain)" ]; then
	echo "using ucr defined chain"
	SSLCHAIN="SSLCertificateChainFile $(ucr get apache2/ssl/certificatechain)"
fi

# create special apache config (should ideally use a subdomain, but we'll settle for a custom port for now)
cat <<-EOF >"/etc/apache2/sites-available/mattermost.conf"

#################################################################
# generated by Mattermost app join script, do not edit manually #
#################################################################

${Ports}

<VirtualHost ${VirtualHostHTTP}>
        ServerName ${ServerName}
        ServerAdmin webmaster@example.org

        ErrorLog \${APACHE_LOG_DIR}/mattermost-error.log
        CustomLog \${APACHE_LOG_DIR}/mattermost-access.log combined

        # Enforce HTTPS:
        RewriteEngine On
        RewriteCond %{REQUEST_URI} !^/.well-known/acme-challenge/
        RewriteCond %{HTTPS} !=on
        RewriteRule ^/?(.*) $HOST\$1 [R,L]
</VirtualHost>

<VirtualHost ${VirtualHostSSL}>
        SSLEngine on
        ServerName ${ServerName}
        ServerAdmin webmaster@example.org

        SSLCertificateFile ${SSLCERTIFICATE}
        SSLCertificateKeyFile ${SSLKEY}
        SSLCACertificateFile ${SSLCA}
	${SSLCHAIN}

        ErrorLog \${APACHE_LOG_DIR}/mattermost-error.log
        CustomLog \${APACHE_LOG_DIR}/mattermost-access.log combined

        RewriteEngine On
        RewriteCond %{REQUEST_URI} /api/v[0-9]+/(users/)?websocket [NC,OR]
        RewriteCond %{HTTP:UPGRADE} ^WebSocket$ [NC,OR]
        RewriteCond %{HTTP:CONNECTION} ^Upgrade$ [NC]
        RewriteRule .* ws://127.0.0.1:8065%{REQUEST_URI} [P,QSA,L]

        RequestHeader set X-Forwarded-Proto "https"

        RequestHeader unset If-Modified-Since
        RequestHeader unset If-None-Match
	${IFRAME}

        <LocationMatch "/api/v(?<apiversion>[0-9]+)/(?<apiusers>users/)?websocket">
                Require all granted
                ProxyPass ws://127.0.0.1:8065/api/v%{env:MATCH_APIVERSION}/%{env:MATCH_APIUSERS}websocket
                ProxyPassReverse ws://127.0.0.1:8065/api/v%{env:MATCH_APIVERSION}/%{env:MATCH_APIUSERS}websocket
                ProxyPassReverseCookieDomain 127.0.0.1 ${ServerName}
        </LocationMatch>

        <Location />
                Require all granted
                ProxyPass http://127.0.0.1:8065/
                ProxyPassReverse http://127.0.0.1:8065/
                ProxyPassReverseCookieDomain 127.0.0.1 ${ServerName}
        </Location>

        ProxyPreserveHost On
        ProxyRequests Off
</VirtualHost>

EOF

cat <<-EOF >"/etc/apache2/ucs-sites.conf.d/mattermost.conf"

#################################################################
# generated by Mattermost app join script, do not edit manually #
#################################################################

Redirect 303 /mattermost ${HOST}
EOF

a2ensite mattermost
invoke-rc.d apache2 reload

# update links to mattermost for portal
PORTAL="ucs/web/overview/entries/admin/mattermost"
ucr set \
  ${PORTAL}/description="Mattermost login" \
  ${PORTAL}/description/de="Login für Mattermost" \
  ${PORTAL}/label?"Mattermost" \
  ${PORTAL}/label/de?"Mattermost" \
  ${PORTAL}/link="$HOST"