#!/bin/bash
#
# Tine 2.0 for UCS
#
# Copyright 2012-2012 by Metaways Infosystems GmbH
#
# http://www.metaways.de/
#
# All rights reserved.
#
# The source code of this program is made available
# under the terms of the GNU Affero General Public License version 3
# (GNU AGPL V3) as published by the Free Software Foundation.
#
# Binary versions of this program provided by Univention to you as
# well as other copyrighted, protected or trademarked materials like
# Logos, graphics, fonts, specific documentations and configurations,
# cryptographic keys etc. are subject to a license agreement between
# you and Univention and not subject to the GNU AGPL V3.
#
# In the case you use this program under the terms of the GNU AGPL V3,
# the program is provided in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU Affero General Public License for more details.
#
# You should have received a copy of the GNU Affero General Public
# License with the Debian GNU/Linux or Univention distribution in file
# /usr/share/common-licenses/AGPL-3; if not, see
# <http://www.gnu.org/licenses/>.

VERSION="20151117"

. /usr/share/univention-lib/all.sh
. /usr/share/univention-join/joinscripthelper.lib
. /usr/share/univention-appcenter/joinscripthelper.sh

set -e

joinscript_init

SERVICE="Tine 2.0"

eval "$(univention-config-registry shell)"

# save setup password on host
univention-app shell tine20 php -r '$config = require "/etc/tine20/config.inc.php"; echo $config["setupuser"]["password"];'  >/etc/tine20setup.secret
chmod 600 /etc/tine20setup.secret

# setup link
desc_de="Konfigurationen oder Einspielen einer Lizenz (tine20setup, /etc/tine20setup.secret)"
desc_en="Further configuration or license activation (tine20setup, /etc/tine20setup.secret)"
ucr set \
    ucs/web/overview/entries/admin/tine20-setup/description/de="$desc_de" \
    ucs/web/overview/entries/admin/tine20-setup/description="$desc_en" \
    ucs/web/overview/entries/admin/tine20-setup/icon="$ucs_web_overview_entries_service_tine20_icon" \
    ucs/web/overview/entries/admin/tine20-setup/label/de="Tine 2.0 Setup" \
    ucs/web/overview/entries/admin/tine20-setup/label="Tine 2.0 Setup" \
    ucs/web/overview/entries/admin/tine20-setup/link="/tine20/setup.php"

# ldap user
test -d /etc/tine20 || mkdir /etc/tine20
if [ ! -e /etc/tine20/ldapuser.secret ]; then
    # create a user to use for ldap searches
    LDAPPASSWORD=$(makepasswd --minchars=15 --maxchars=20)
    echo -n "$LDAPPASSWORD" > /etc/tine20/ldapuser.secret
    chmod 640 /etc/tine20/ldapuser.secret
    chown root:www-data /etc/tine20/ldapuser.secret
else
    LDAPPASSWORD="$(cat /etc/tine20/ldapuser.secret)"
fi

udm container/cn create "$@" --ignore_exists \
    --position "$ldap_base" \
    --set name=tine20

# create hidden ldap bind user if it does not exist
udm users/user create "$@" --ignore_exists \
    --position "cn=tine20,$ldap_base" \
    --set username="tine20" --set password="$LDAPPASSWORD" \
    --set firstname="$SERVICE Service" --set lastname="LDAP Account" \
    --set description="Account used by $SERVICE to authenticate against LDAP directory" \
    --set objectFlag="hidden" \
    --option ldap_pwd

# always update password
udm users/user modify "$@" --dn "uid=tine20,cn=tine20,$ldap_base" --set password="$LDAPPASSWORD" || true

# active sync apache config
port="$appcenter_apps_tine20_ports_80"
as_options="timeout=4000 connectiontimeout=600 acquire=3000 retry=6"
cat <<-EOF >"/etc/apache2/ucs-sites.conf.d/tine20-app.conf"
# generated by egroupware join script, do not edit manually
ProxyPass /Microsoft-Server-ActiveSync http://127.0.0.1:$port/Microsoft-Server-ActiveSync $as_options
ProxyPassReverse /Microsoft-Server-ActiveSync http://127.0.0.1:$port/Microsoft-Server-ActiveSync
EOF
invoke-rc.d apache2 reload

# only installation
if [ $JS_LAST_EXECUTED_VERSION = 0 ]; then

    # initial setup of Tine 2.0
    LDAPHOST="$ldap_server_name\\:$ldap_server_port"
    LDAPBASE=${ldap_base//,/\\\,}
    if ucs_isServiceUnused "$SERVICE" "$@"; then 
        joinscript_run_in_container php /usr/share/tine20/setup.php --config=/etc/tine20/config.inc.php --install -- \
            adminLoginName="administrator" \
            adminPassword="***" \
            acceptedTermsVersion=1000 \
            authentication="backend:ldap,host:$LDAPHOST,username:uid=tine20\,cn=tine20\,$LDAPBASE,password:$LDAPPASSWORD,bindRequiresDn:1,baseDn:cn=users\,$LDAPBASE,accountFilterFormat:(&(objectClass=posixAccount)(uid=%s))" \
            accounts="backend:ldap,host:$LDAPHOST,username:uid=tine20\,cn=tine20\,$LDAPBASE,password:$LDAPPASSWORD,bindRequiresDn:1,userDn:cn=users\,$LDAPBASE,groupsDn:cn=groups\,$LDAPBASE,defaultUserGroupName:Domain Users,defaultAdminGroupName:Domain Admins,readonly:1"
    fi

    # use first mail server
    imapserver="$(univention-ldapsearch -LLL univentionService=IMAP cn | grep "^cn: " | sed s/"^cn: "// | head -n1)"
    if [ "$imapserver" -a -n "$mail_hosteddomains" ]; then
        imapserver="$imapserver.$domainname"
        joinscript_run_in_container php /usr/share/tine20/setup.php --config=/etc/tine20/config.inc.php --setconfig -- \
            configkey=imap \
            configvalue="active:true,verifyPeer:0,backend:ldap_univention,host:$imapserver,port:143,ssl:tls,useSystemAccount:1,domain:$mail_hosteddomains"
        joinscript_run_in_container php /usr/share/tine20/setup.php --config=/etc/tine20/config.inc.php --setconfig -- \
            configkey=sieve \
            configvalue="active:true,verifyPeer:0,hostname:$imapserver,port:4190,ssl:tls"
        # use the same server as smtp
        joinscript_run_in_container php /usr/share/tine20/setup.php --config=/etc/tine20/config.inc.php --setconfig -- \
            configkey=smtp \
            configvalue="active:true,verifyPeer:0,backend:ldap_univention,hostname:$imapserver,port:587,ssl:tls,auth:login,primarydomain:$mail_hosteddomains"
    fi
fi

# always apply all pending updates
joinscript_run_in_container php /usr/share/tine20/setup.php --config=/etc/tine20/config.inc.php --update
    
joinscript_run_in_container chown www-data:www-data /var/log/tine20/tine20.log

ucs_addServiceToLocalhost "$SERVICE" "$@"

joinscript_save_current_version

exit 0