#!/bin/bash

if [ $# -ne 7 ]; then
    echo "create-bundle: argument error" >&2
    echo "usage: create-bundle [yes|no] <uid> <home> <server> <addr> <port> <proto>" >&2
    exit 1
fi

crcrt=$1
shift

uid=$1
home=$2
server=$3
addr=$4
port=$5
proto=$6

ssl=/etc/univention/ssl

# create or renew certificate for user
if /usr/sbin/univention-certificate check -name "${uid}.openvpn"; then
  if [ "$crtcr" = yes ]; then
    defdays=$(ucr get ssl/default/days)
    if [ -z "$defdays" ]; then
        defdays=1825
    fi
    univention-certificate renew -days ${defdays} -name "${uid}.openvpn"
  fi
else
    univention-certificate new -name "${uid}.openvpn"
fi

# prepare a matching client config (for versions < 2.3)
cat > "${ssl}/${uid}.openvpn/${server}-pre23.ovpn" <<-ENDOFCLIENTCONFIG
	# client config for server ${server}

	client
	dev tun0
	proto ${proto}
	remote ${addr} ${port}
	tls-remote ${server}
	resolv-retry infinite
	nobind
	persist-key
	persist-tun
	ca CAcert.pem
	cert cert.pem
	key private.key
	cipher AES-256-CBC
	comp-lzo
	verb 3
	auth-user-pass

	script-security 2
	up /etc/openvpn/update-resolv-conf 
	down /etc/openvpn/update-resolv-conf

ENDOFCLIENTCONFIG

# prepare a matching client config (windows, versions < 2.3)
cat > "${ssl}/${uid}.openvpn/win-${server}-pre23.ovpn" <<-ENDOFWINCLIENTCONFIG
	# windows client config for server ${server}

	client
	dev tun
	proto ${proto}
	remote ${addr} ${port}
	tls-remote ${server}
	resolv-retry infinite
	nobind
	persist-key
	persist-tun
	ca CAcert.pem
	cert cert.pem
	key private.key
	cipher AES-256-CBC
	comp-lzo
	verb 3
	auth-user-pass

ENDOFWINCLIENTCONFIG

# prepare a matching client config
cat > "${ssl}/${uid}.openvpn/${server}.ovpn" <<-ENDOFCLIENTCONFIG
	# client config for server ${server}

	client
	dev tun0
	proto ${proto}
	remote ${addr} ${port}
	verify-x509-name ${server} name-prefix
	resolv-retry infinite
	nobind
	persist-key
	persist-tun
	ca CAcert.pem
	cert cert.pem
	key private.key
	cipher AES-256-CBC
	comp-lzo
	verb 3
	auth-user-pass

	script-security 2
	up /etc/openvpn/update-resolv-conf 
	down /etc/openvpn/update-resolv-conf

ENDOFCLIENTCONFIG

# prepare a matching client config (windows)
cat > "${ssl}/${uid}.openvpn/win-${server}.ovpn" <<-ENDOFWINCLIENTCONFIG
	# windows client config for server ${server}

	client
	dev tun
	proto ${proto}
	remote ${addr} ${port}
	verify-x509-name ${server} name-prefix
	resolv-retry infinite
	nobind
	persist-key
	persist-tun
	ca CAcert.pem
	cert cert.pem
	key private.key
	cipher AES-256-CBC
	comp-lzo
	verb 3
	auth-user-pass

ENDOFWINCLIENTCONFIG

eval "$(ucr shell)"

# zip all required files into home if it exists,
# always put a copy into download directory for user
umask 037
rdy2gobas="/var/www/readytogo"
readytogo="${rdy2gobas}/${uid}/"
mkdir -p "${readytogo}"

pw=$(cat /etc/ldapper-m.secret)

cat > "${readytogo}/.htaccess" <<-ENDOFHTACCESS
AuthBasicProvider ldap
AuthType Basic
AuthName "secret"
AuthLDAPURL "ldap://$ldap_server_name:$ldap_server_port/$ldap_base?uid"
AuthLDAPBindDN "uid=ldapper-m-$hostname,cn=users,$ldap_base"
AuthLDAPBindPassword $pw
Require ldap-user ${uid}

ENDOFHTACCESS
chgrp www-data "${readytogo}/.htaccess" "${rdy2gobas}" "${rdy2gobas}/.htaccess" "${rdy2gobas}/notfound.html" "${readytogo}"
chmod 640 "${readytogo}/.htaccess"
chmod 750 "${rdy2gobas}" "${rdy2gobas}/.htaccess" "${rdy2gobas}/notfound.html" "${readytogo}"

if [ ! -f /etc/apache2/mods-enabled/ldap.load ] || [ ! -f /etc/apache2/mods-enabled/authnz_ldap.load ]; then
    a2enmod ldap
    a2enmod authnz_ldap
    /etc/init.d/apache2 restart
fi

bundle="${readytogo}/openvpn-${server}-${uid}.zip"
umask 037

zip -j "$bundle" \
    "${ssl}/ucsCA/CAcert.pem" \
    "${ssl}/${uid}.openvpn/cert.pem" \
    "${ssl}/${uid}.openvpn/private.key" \
    "${ssl}/${uid}.openvpn/${server}.ovpn" \
    "${ssl}/${uid}.openvpn/win-${server}.ovpn" \
    "${ssl}/${uid}.openvpn/${server}-pre23.ovpn" \
    "${ssl}/${uid}.openvpn/win-${server}-pre23.ovpn"
chown "$uid" "$bundle"
chgrp www-data "$bundle"

if [ -d "$home" ]; then
    umask 077
    bundle2="${home}/openvpn-${server}-${uid}.zip"
    cp "$bundle" "${bundle2}"
    chown "$uid"."Domain Users" "${bundle2}"
fi

# insert a list of all available packages for the user into download.html
umask 037
templates=/usr/lib/openvpn-int/templates
rm -f "${readytogo}/download.html"
cp ${templates}/download.head "${readytogo}/download.html"
for rtgp in $(cd "${readytogo}" && echo "openvpn-"*"-${uid}.zip"); do
    echo "<p><a href=\"/readytogo/${uid}/${rtgp}\">${rtgp}</a><hr/></p>"
done >> "${readytogo}/download.html"
cat ${templates}/download.tail >> "${readytogo}/download.html"
chgrp www-data "${readytogo}/download.html"
chmod 640 "${readytogo}/download.html"




exit 0
