#
# Cookbook Name:: irrigate-backup
# Recipe:: default
#
# Copyright (C) 2018 The Orchard
#

include_recipe 'firewall'

case node['os']
when 'linux'

  if node['platform_version'] > '7'

    # Firewall rule for SSH
    firewall_rule 'ssh' do
      port 22
      protocol :tcp
      position 50
      command :allow
    end

    package 'epel-release' if node['platform_family'] == 'rhel'

    # Required packages
    packages = %w(
      git
      openssl
      ruby-shadow
    )

    # Install packages
    packages.each do |name|
      package name
    end

    backup_user = node['backup']['backup_user']
    home_directory = node['backup']['backup_user_home_directory']

    # Password rotations should be performed as follows (on Linux host):
    # python3 -c 'import crypt; print(crypt.crypt("newpassword123", crypt.mksalt(crypt.METHOD_SHA512)))'
    # This will generate the password hash for use in this user resource

    # Get data bag with password credentials, specifying configurable encryption secret
    secret               = node['backup']['backup_user_data_bag_secret_file_path']
    data_bag_name        = node['backup']['backup_user_data_bag_name']
    backup_credentials   = data_bag_item('secrets', data_bag_name, IO.read(secret).chomp)
    password_hash        = backup_credentials['password_hash'].chomp

    user backup_user do
      comment 'Default backup user'
      home home_directory
      manage_home true
      shell '/bin/bash'
      uid node['backup']['uid']
      password password_hash
    end

    # Set normal-precedence attribute to enable password auth
    node.normal['sshd']['sshd_config']['PasswordAuthentication'] = 'yes'

    # Create ".aws" directory for backup user
    directory "#{home_directory}/.aws" do
      owner backup_user
      mode '0755'
      recursive true
    end

    # Get data bag with aws credentials, specifying configurable encryption secret
    aws_secret                      = node['backup']['aws_credentials_data_bag_secret_file_path']
    aws_data_bag_name               = node['backup']['aws_credentials_data_bag_name']
    backup_user_aws_credentials     = data_bag_item('secrets', aws_data_bag_name, IO.read(aws_secret).chomp)
    aws_access_key_id               = backup_user_aws_credentials['access_key_id'].chomp
    aws_secret_access_key           = backup_user_aws_credentials['secret_access_key'].chomp

    template "#{home_directory}/.aws/credentials" do
      source 'aws_credentials.erb'
      owner backup_user
      mode '0640'
      variables(
        aws_access_key_id: aws_access_key_id,
        aws_secret_access_key: aws_secret_access_key
      )
      sensitive true
    end

    # Keep configurable number of backups. Cleanup home directory by default.
    backup_retention_days = node['backup']['retention_days']
    cron 'cleanup_old_backups' do
      hour '0'
      minute '0'
      user backup_user
      command "find #{home_directory} -type f -name '*.tar.gz' -mtime +#{backup_retention_days} -exec rm -rf {} \\;"
    end
  end
end