#
# Cookbook:: irrigate-ciscat
# Recipe:: default
#
# Copyright:: 2018, The Orchard, All Rights Reserved.

# Enable selinux
include_recipe 'selinux'

if node['platform_family'].include?('rhel')

  package 'checkpolicy'

  # selinux policy
  semodule_filename_base = 'firewalld_cloudinit'
  semodule_filepath_base = "#{Chef::Config[:file_cache_path]}/#{semodule_filename_base}"
  semodule_filepath = "#{semodule_filepath_base}.te"
  cookbook_file semodule_filepath do
    source "#{semodule_filename_base}.te"
    owner 'root'
    group 'root'
    mode '0600'
    notifies :run, "execute[semodule-install-#{semodule_filename_base}]", :immediately
  end

  execute "semodule-install-#{semodule_filename_base}" do
    command "/usr/bin/checkmodule -M -m #{semodule_filepath_base}.te -o #{semodule_filepath_base}.mod && /usr/bin/semodule_package -o #{semodule_filepath_base}.pp -m #{semodule_filepath_base}.mod && /usr/sbin/semodule -i #{semodule_filepath_base}.pp"
    action :nothing
  end
end

packages = %w(
  java-1.8.0-openjdk
  java-1.8.0-openjdk-devel
)

packages.each do |name|
  package name
end

user 'ciscat'

# put ciscat user in the group so we can make sure we don't remove it by managing tomcat
group 'tomcat' do
  members 'ciscat'
  action :create
end

tomcat_tarball = []
node['ciscat']['tomcat_mirrors'].each do |mirror|
  tarball_url = "#{mirror}/v#{node['ciscat']['tomcat_version']}/bin/apache-tomcat-#{node['ciscat']['tomcat_version']}.tar.gz"
  tomcat_tarball.push tarball_url
end

remote_file "#{Chef::Config[:file_cache_path]}/apache-tomcat.tar.gz" do
  source tomcat_tarball
  owner 'ciscat'
  group 'tomcat'
  mode '0755'
  action :create
end

# Install Tomcat to the default location
tomcat_install 'ciscat' do
  tarball_path '/tmp/apache-tomcat.tar.gz'
  version node['ciscat']['tomcat_version']
  tomcat_user 'tomcat'
  tomcat_group 'tomcat'
  exclude_manager true
  exclude_hostmanager true
  verify_checksum true
end

tomcat_root = node['ciscat']['tomcat_root']
mysql_credentials = data_bag_item('secrets', node['ciscat']['mysql_credentials_data_bag'])
mysql_user = mysql_credentials['mysql_user'].chomp
mysql_password = mysql_credentials['mysql_password'].chomp
mysql_host = mysql_credentials['mysql_host'].chomp

ldap_credentials = data_bag_item('secrets', node['ciscat']['ldap_credentials_data_bag'])
ldap_user = ldap_credentials['ldap_user'].chomp
ldap_password = ldap_credentials['ldap_password'].chomp
ldap_host = ldap_credentials['ldap_host'].chomp
ldap_group_base = ldap_credentials['ldap_group_base'].chomp
ldap_user_base = ldap_credentials['ldap_user_base'].chomp

catalina_opts = node['ciscat']['catalina_opts']

# Drop off our own server.xml
template "#{tomcat_root}/conf/server.xml" do
  source 'ciscat_server.erb'
  owner 'root'
  group 'root'
  mode '0644'
  notifies :restart, 'tomcat_service[ciscat]'
end

template "#{tomcat_root}/ccpd-config.yml" do
  source 'ccpd-config.erb'
  owner 'tomcat'
  group 'tomcat'
  mode '0644'
  variables(
    'mysql_host' => mysql_host,
    'mysql_user' => mysql_user,
    'mysql_password' => mysql_password,
    'ldap_host' => ldap_host,
    'ldap_user' => ldap_user,
    'ldap_password' => ldap_password,
    'ldap_group_base' => ldap_group_base,
    'ldap_user_base' => ldap_user_base
  )
  notifies :restart, 'tomcat_service[ciscat]'
end

# create import directories
%w( legacy legacy/source legacy/processed legacy/error ).each do |path|
  directory "#{tomcat_root}/#{path}" do
    owner 'tomcat'
    group 'tomcat'
    mode '0755'
  end
end

# create package directories
%w( downloads downloads/ciscat downloads/ciscat/cis-cat-dissolvable downloads/ciscat/cis-cat-dissolvable/MAC downloads/ciscat/cis-cat-dissolvable/Linux downloads/ciscat/cis-cat-dissolvable/Windows ).each do |path|
  directory "/var/www/#{path}" do
    owner 'root'
    group 'root'
    mode '0755'
    recursive true
  end
end

aws_s3_file "#{tomcat_root}/webapps/CCPD.war" do
  bucket node['ciscat']['s3_bucket_name']
  remote_path node['ciscat']['s3_file_path']
  owner 'tomcat'
  group 'tomcat'
  mode '0644'
  action :create
end

node['ciscat']['s3_tool_download_path'].each do |tool|
  aws_s3_file "/var/www/downloads/#{tool}" do
    bucket node['ciscat']['s3_bucket_name']
    remote_path tool
    owner 'tomcat'
    group 'tomcat'
    mode '0644'
    action :create
  end
end

# start the tomcat service
tomcat_service 'ciscat' do
  action [:start, :enable]
  env_vars [{ 'CATALINA_BASE' => tomcat_root }, { 'CATALINA_PID' => "#{tomcat_root}/temp/tomcat.pid" }, { 'CCPD_CONFIG_FILE' => "#{tomcat_root}/ccpd-config.yml" }, { 'CCPD_LOG_DIR' => "#{tomcat_root}/logs" }, { 'JAVA_OPTS' => '-Djava.net.preferIPv4Stack=true -Djava.net.preferIPv4Addresses=true' }, { 'CATALINA_OPTS' => catalina_opts }]
  sensitive true
  tomcat_user 'tomcat'
  tomcat_group 'tomcat'
end

# Make sure the firewall is installed and enabled
firewall 'default' do
  log_level :high
  action :install
end

firewall_rule 'established' do
  stateful %w(related established)
  protocol :none
  position 1
  command :allow
end

firewall_rule 'ssh' do
  port 22
  protocol :tcp
  position 2
  command :allow
end

firewall_rule 'nginx' do
  port 80
  protocol :tcp
  position 3
  command :allow
end