#!/bin/sh
# This script will generate a general traefik config and launch traefik

DSPAPI_APPKEY="${DSPAPI_APPKEY:-test}"
VENDORAPI_APPKEY="${VENDORAPI_APPKEY:-test}"
AUTH_API_KEY="${AUTH_API_KEY:-test}"
SDLC_ENV_NAME="${SDLC_ENV_NAME:-dev}"

AUTH_SERVICE_URL="${AUTH_SERVICE_URL:-https://dev-auth-api.apollo.stream/authorize}"

DELPHI_API_URL="${DELPHI_API_URL:-https://qa-delphi-api-ext.delphiplatform.io}"
DELPHI_API_HOST_RULE="${DELPHI_API_HOST_RULE:-delphi-api.apollo.stream}"

CONSUMER_ANALYTICS_API_URL="${CONSUMER_ANALYTICS_API_URL:-https://dev-consumer-analytics-api.filtr.com}"
CONSUMER_ANALYTICS_API_HOST_RULE="${CONSUMER_ANALYTICS_API_HOST_RULE:-ca-api.localhost}"

APPLE_MUSICKIT_BASE_ORIGINAL_URL="${APPLE_MUSICKIT_BASE_ORIGINAL_URL:-https://api.music.apple.com}"
APPLE_MUSICKIT_BASE_HOST_RULE="${APPLE_MUSICKIT_BASE_HOST_RULE:-dev-apple-api.apollo.stream}"

SPOTIFY_CLIENT_BASE_ORIGINAL_URL="${SPOTIFY_CLIENT_BASE_ORIGINAL_URL:-https://api.spotify.com}"
SPOTIFY_CLIENT_BASE_HOST_RULE="${SPOTIFY_CLIENT_BASE_HOST_RULE:-dev-spotify-api.apollo.stream}"

SPOTIFY_CLIENT_TOKEN_ORIGINAL_URL="${SPOTIFY_CLIENT_TOKEN_ORIGINAL_URL:-https://accounts.spotify.com}"
SPOTIFY_CLIENT_TOKEN_HOST_RULE="${SPOTIFY_CLIENT_TOKEN_HOST_RULE:-dev-spotify-token.apollo.stream}"
APOLLO_UI_URL="${APOLLO_UI_URL:-dev-new.apollo.stream}"

AWS_ECS_CLUSTER_NAME="${AWS_ECS_CLUSTER_NAME:-dev-apollo-clu}"
AWS_REGION="${AWS_REGION:-us-east-1}"

TRAEFIK_DD_METRICS="${TRAEFIK_DD_METRICS:-false}"
DD_ADDR="${DD_ADDR:-localhost:8125}"
TRAEFIK_PROXY_URL="${TRAEFIK_PROXY_URL:-dev-proxy.apollo.stream}"
TRAEFIK_LOG_LEVEL="${TRAEFIK_LOG_LEVEL:-INFO}"
TRAEFIK_CONFIG_FOLDER="${TRAEFIK_CONFIG_FOLDER:-/etc/traefik}"
TRAEFIK_DASHBOARD_USERS_FILE="${TRAEFIK_DASHBOARD_USERS_FILE:-dashboard.htpasswd}"

HTTP_ADM_USERNAME=${HTTP_ADM_USERNAME:-devops}
HTTP_ADM_PASSWORD=${HTTP_ADM_PASSWORD:-rBmzXE977EYjnchRwK}

ACCESS_LOG_FOLDER="${ACCESS_LOG_FOLDER:-/var/log/traefik}"
TRAEFIK_ACCESS_LOG=${TRAEFIK_ACCESS_LOG:-false}

mkdir -p "${TRAEFIK_CONFIG_FOLDER}"

echo ${HTTP_ADM_USERNAME}:$(echo $HTTP_ADM_PASSWORD | openssl passwd -apr1 -stdin) > ${TRAEFIK_CONFIG_FOLDER}/${TRAEFIK_DASHBOARD_USERS_FILE}

cat > ${TRAEFIK_CONFIG_FOLDER}/main.yaml << EOF
---
global:
  sendAnonymousUsage: false

providers:
  file:
    filename: ${TRAEFIK_CONFIG_FOLDER}/main.yaml
    watch: true
  ecs:
    autoDiscoverClusters: false
    clusters: ${AWS_ECS_CLUSTER_NAME}
    exposedByDefault: false
    region: ${AWS_REGION}

log:
  level: ${TRAEFIK_LOG_LEVEL}

entryPoints:

  web:
    address: ":80"
  ping:
    address: ":8000"
  traefik:
    address: ":8080"

api:
  dashboard: true
  insecure: false

ping:
  entryPoint: ping

http:
  routers:
    dashboard:
      middlewares:
      - dashboard-redirect@file
      - dashboard-auth@file
      - dashboard-stripprefix@file
      entryPoints:
      - traefik
      rule: PathPrefix("/")
      service: dashboard@internal

    api:
      middlewares:
      - dashboard-auth@file
      entryPoints:
      - traefik
      rule: PathPrefix("/api")
      service: api@internal

    dsp-api2delphi:
      entryPoints:
      - web
      service: delphi
      rule: Host("${DELPHI_API_HOST_RULE}")
    
    dsp-api2consumer-analytics:
      entryPoints:
      - web
      service: consumer-analytics
      rule: Host("${CONSUMER_ANALYTICS_API_HOST_RULE}")

    apple-api:
      entryPoints:
      - web
      service: apple-api
      rule: Host("${APPLE_MUSICKIT_BASE_HOST_RULE}")

    spotify-api:
      entryPoints:
      - web
      service: spotify-api
      rule: Host("${SPOTIFY_CLIENT_BASE_HOST_RULE}")

    spotify-token:
      entryPoints:
      - web
      service: spotify-token
      rule: Host("${SPOTIFY_CLIENT_TOKEN_HOST_RULE}")

  services:
    delphi:
      loadBalancer:
        servers:
        - url: ${DELPHI_API_URL}
        passHostHeader: false
        healthcheck:
          path: /health
          interval: "10s"
          timeout: "3s"

    consumer-analytics:
      loadBalancer:
        servers:
        - url: ${CONSUMER_ANALYTICS_API_URL}
        passHostHeader: false

    apple-api:
      loadBalancer:
        servers:
        - url: ${APPLE_MUSICKIT_BASE_ORIGINAL_URL}
        passHostHeader: false
        healthcheck:
          path: /
          interval: "60s"
          timeout: "3s"

    spotify-api:
      loadBalancer:
        servers:
        - url: ${SPOTIFY_CLIENT_BASE_ORIGINAL_URL}
        passHostHeader: false
        healthcheck:
          path: /
          interval: "60s"
          timeout: "3s"

    spotify-token:
      loadBalancer:
        servers:
        - url: ${SPOTIFY_CLIENT_TOKEN_ORIGINAL_URL}
        passHostHeader: false
        healthcheck:
          path: /
          interval: "60s"
          timeout: "3s"
  
  middlewares:
    rewrite_to_hello:
      replacepath:
        path: /hello

    rewrite_to_health:
      replacepath:
        path: /health

    options_method_hotfix_headers:
      headers:
        customresponseheaders:
          allow: POST, HEAD, GET
          Access-Control-Allow-Origin: https://${APOLLO_UI_URL}
          Access-Control-Allow-Origin-List: https://${APOLLO_UI_URL},https://${TRAEFIK_PROXY_URL}
          Access-Control-Max-Age: 100
          vary: Origin

    cors_allow_origin:
      headers:
        customResponseHeaders:
          Access-Control-Allow-Origin: https://${APOLLO_UI_URL}
          Access-Control-Allow-Origin-List: https://${APOLLO_UI_URL},https://${TRAEFIK_PROXY_URL}
          Access-Control-Max-Age: 100
          vary: Origin

    dashboard-redirect:
      redirectRegex:
        regex: ^(http://([[\w:.]+]|[\w\._-]+)(:\d+)?)/$
        replacement: \${1}/dashboard/

    dashboard-stripprefix:
      stripPrefix:
        prefixes:
        - /dashboard/
        - /dashboard

    dashboard-auth:
      basicAuth:
        realm: "Traefik on ${AWS_ECS_CLUSTER_NAME}"
        usersFile: ${TRAEFIK_CONFIG_FOLDER}/${TRAEFIK_DASHBOARD_USERS_FILE}

    dsp-api-appkey-header:
      headers:
        customrequestheaders:
          Authorization: ${DSPAPI_APPKEY}
    
    vendor-api-appkey-header:
      headers:
        customrequestheaders:
          Authorization: ${VENDORAPI_APPKEY}

    auth-api-key-header:
      headers:
        customrequestheaders:
          Authorization: ${AUTH_API_KEY}

    ipwhitelist-vpn:
      ipWhiteList:
        sourceRange:
        - "172.20.0.5"
    ipwhitelist-ecs:
      ipWhiteList:
        sourceRange:
        - "172.20.0.5"
    ipwhitelist-project:
      ipWhiteList:
        sourceRange:
        - "172.20.0.5"
    https-redirect:
      redirectScheme:
        scheme: https

    authorize-token:
      forwardAuth:
        address: ${AUTH_SERVICE_URL}
        trustForwardHeader: true
        authResponseHeaders:
        - x-user-id

    dsp-api-auth:
      chain:
        middlewares:
        - authorize-token
        - dsp-api-appkey-header
        
    vendor-api-auth:
      chain:
        middlewares:
        - authorize-token
        - vendor-api-appkey-header
        
    auth-api-auth:
      chain:
        middlewares:
        - authorize-token
        - auth-api-key-header

EOF

if [ $TRAEFIK_LOG_LEVEL == "DEBUG" ]; then
  cat ${TRAEFIK_CONFIG_YAML};
fi

if ${TRAEFIK_DD_METRICS}; then
  echo "INFO: ENABLING TRAEFIK_DD_METRICS"
  cat >> ${TRAEFIK_CONFIG_FOLDER}/main.yaml << EOF
metrics:
  datadog:
    address: ${DD_ADDR}
    addServicesLabels: true
EOF
fi

if ${TRAEFIK_ACCESS_LOG}; then
  echo "INFO: RUNNING TRAEFIK_ACCESS_LOG ${TRAEFIK_ACCESS_LOG}"
  mkdir -p ${ACCESS_LOG_FOLDER}
  # Use stdout
  ln -sf /proc/1/fd/1 ${ACCESS_LOG_FOLDER}/access.log
  cat >> ${TRAEFIK_CONFIG_FOLDER}/main.yaml << EOF
accessLog:
  filePath: ${ACCESS_LOG_FOLDER}/access.log
  bufferingSize: 100
EOF
fi

echo INFO: DASHBOARD USER ${HTTP_ADM_USERNAME} PASSWORD ${HTTP_ADM_PASSWORD}

# first arg is `-f` or `--some-option`
if [ "${1#-}" != "$1" ]; then
    echo "INFO: RUNNING TRAEFIK IGNORING CONFIGFILE" 
    set -- traefik "$@"
fi

if [ -n "${1}" ]; then
  # if our command is a valid Traefik subcommand, let's invoke it through Traefik instead
  # (this allows for "docker run traefik version", etc)
  if traefik "$1" --help >/dev/null 2>&1
  then
      set -- traefik "$@"
  else
      echo "= '$1' is not a Traefik command: assuming shell execution." 1>&2
  fi
else
  echo "INFO: RUNNING TRAEFIK WITH --configfile ${TRAEFIK_CONFIG_FOLDER}/main.yaml"
  set -- traefik --configfile ${TRAEFIK_CONFIG_FOLDER}/main.yaml
fi

exec "$@"