#
# Cookbook:: irrigate-ecs
# Recipe:: exec
#
# Copyright:: 2023, All Rights Reserved.

packages = %w(
  openssl
  which
)

packages.each do |package_name|
  package package_name
end

directory node['ecs']['exec']['ca_bundle_directory'] do
  recursive true
end

node['ecs']['exec']['ca_bundle_files'].each do |ca_bundle_file|
  next unless File.exist?(ca_bundle_file) && !File.exist?("#{node['ecs']['exec']['ca_bundle_directory']}/tls-ca-bundle.pem")
  execute 'verify_and_copy_ca_bundle_file' do
    command "openssl verify -x509_strict #{ca_bundle_file} && cp -aL #{ca_bundle_file} #{node['ecs']['exec']['ca_bundle_directory']}/tls-ca-bundle.pem && chmod 400 #{node['ecs']['exec']['ca_bundle_directory']}/tls-ca-bundle.pem"
    creates "#{node['ecs']['exec']['ca_bundle_directory']}/tls-ca-bundle.pem"
    user 'root'
  end
end

ssm_version = shell_out('amazon-ssm-agent -version | rev | cut -d " " -f 1 | rev').stdout
ssm_binaries_dir = "#{node['ecs']['exec']['binaries_dir_prefix']}/#{ssm_version.strip}"

directory ssm_binaries_dir do
  recursive true
end

node['ecs']['exec']['ssm_binaries'].each do |ssm_binary|
  # We only need one version of SSM binaries, so touch a cache file
  execute 'copy_ssm_binary' do
    command "cp -a $(which #{ssm_binary}) #{ssm_binaries_dir}/ && touch /var/cache/.#{ssm_binary}_created"
    creates "/var/cache/.#{ssm_binary}_created"
    user 'root'
  end
end