#
# Cookbook:: irrigate-haproxy
# Recipe:: enterprise
#

# Set license key
if node['haproxy']['enterprise']['license_key_data_bag_name'] && !node['haproxy']['enterprise']['license_key_data_bag_name'].empty?
  license_key = data_bag_item('secrets', node['haproxy']['enterprise']['license_key_data_bag_name'])
  node.default['haproxy']['enterprise']['license_key'] = license_key['license_key'].chomp
end

if platform_family?('rhel')
  if node['platform_version'].start_with?('7')
    yum_repository 'hapee-base' do
      description 'HAProxy Enterprise Base'
      baseurl "https://www.haproxy.com/download/hapee/key/#{node['haproxy']['enterprise']['license_key']}-common/#{node['haproxy']['enterprise']['version']}/rhel-7/x86_64/bin/"
      gpgcheck true
      gpgkey "https://www.haproxy.com/download/hapee/key/#{node['haproxy']['enterprise']['license_key']}-common/HAPEE-key-#{node['haproxy']['enterprise']['version']}.asc"
      action :create
    end

    yum_repository 'hapee-plus' do
      description 'HAProxy Enterprise Plus'
      baseurl "https://www.haproxy.com/download/hapee/key/#{node['haproxy']['enterprise']['license_key']}-plus/#{node['haproxy']['enterprise']['version']}/rhel-7/x86_64/bin/"
      gpgcheck true
      gpgkey "https://www.haproxy.com/download/hapee/key/#{node['haproxy']['enterprise']['license_key']}-common/HAPEE-key-#{node['haproxy']['enterprise']['version']}.asc"
      action :create
    end

    yum_repository 'hapee-plus-extras' do
      description 'HAProxy Enterprise Extras'
      baseurl "https://www.haproxy.com/download/hapee/key/#{node['haproxy']['enterprise']['license_key']}-plus/extras/rhel-7/x86_64/bin/"
      gpgcheck true
      gpgkey "https://www.haproxy.com/download/hapee/key/#{node['haproxy']['enterprise']['license_key']}-common/HAPEE-key-#{node['haproxy']['enterprise']['version']}.asc"
      action :create
    end
  end

  packages = [
    "hapee-#{node['haproxy']['enterprise']['version']}-base",
    "hapee-#{node['haproxy']['enterprise']['version']}-lb",
  ]

  packages.each do |name|
    package name
  end

  file '/etc/sysctl.d/99-override.conf' do
    action :create
    content [
      'net.ipv4.ip_nonlocal_bind=1',
      'net.ipv4.conf.all.accept_redirects=1',
      'net.ipv4.conf.all.send_redirects=1',
    ].join("\n")
    mode '644'
  end

end

# Make sure the firewall is installed and enabled
firewall 'default' do
  action :install
end

firewall_rule 'http' do
  port 80
  protocol :tcp
  position 1
  command :allow
end

firewall_rule 'https' do
  port 443
  protocol :tcp
  position 2
  command :allow
end

firewall_rule 'ssh' do
  port 22
  protocol :tcp
  position 3
  command :allow
end

firewall_rule 'web_8080' do
  port 8080
  protocol :tcp
  position 4
  command :allow
end

# Stub out the config directory since we're not installing the haproxy package
directory '/etc/haproxy'

haproxy_config 'create_haproxy_config' do
  action :create
  notifies :reload, 'service[hapee-2.0-lb]', :delayed
end

node['ssl_cert'].each do |_cert_number, cert_item|
  cert_data_bag = data_bag_item('secrets', cert_item['cert_data_bag'])
  my_cert = cert_data_bag['cert'].chomp
  template cert_item['cert_file_location'] do
    source 'ssl_cert.erb'
    owner 'root'
    mode '600'
    notifies :reload, 'service[hapee-2.0-lb]', :immediately
    variables ({
      cert_content: my_cert,
    })
  end
end

# Leave the config file in its default/old location and simply symlink to it
link '/etc/hapee-2.0/hapee-lb.cfg' do
  to '/etc/haproxy/haproxy.cfg'
end

service 'hapee-2.0-lb' do
  supports restart: true, status: true, reload: true
  action [:enable, :start]
end