#!/usr/bin/env bash

OPENSSL_BINARY=$(/usr/bin/which openssl)
WGET_BINARY=$(/usr/bin/which wget)

CRL_BASE_DIR='/etc/haproxy'
CRL_BACKUP_DIR="${CRL_BASE_DIR}/crl_backup"
CRL_BACKUP_FILE="${CRL_BACKUP_DIR}/crl_backup_$(date +%Y-%m-%d_%H-%M-%S).tar.gz"
CRL_FILE='crl_file.pem'
INTERMEDIATE_CA_CRL_URL='<%= node['haproxy']['intermediate_ca_crl_url'] %>'
INTERMEDIATE_CA_CRL_DER_FILE='int_ca_crl_der.crt'
LOGFILE_NAME='/var/log/crl_update.log'
ROOT_CA_CRL_URL='<%= node['haproxy']['root_ca_crl_url'] %>'
ROOT_CA_CRL_DER_FILE='root_ca_crl_der.crt'

if [ -x ${OPENSSL_BINARY} ] && [ -x ${WGET_BINARY} ]; then
  printf '%s\n' "OpenSSL and wget found. Continuing..."
  printf '%s\n'
else
  printf '%s\n' "OpenSSL or wget not found or executable." && exit 1
fi

function logmessage {
  printf '%s\n' " $(date +%c): ${1}" >> "${LOGFILE_NAME}"
  printf '%s\n' >> "${LOGFILE_NAME}"
}

function make_crl_backup {
  if [ ! -d ${CRL_BACKUP_DIR} ]; then
    mkdir -p ${CRL_BACKUP_DIR}
  fi

  cd "${CRL_BASE_DIR}"
  if [ -f "${ROOT_CA_CRL_DER_FILE}" ] && [ -f "${INTERMEDIATE_CA_CRL_DER_FILE}" ] && [ -f "${CRL_FILE}" ]; then
    tar -zcvf "${CRL_BACKUP_FILE}" "${ROOT_CA_CRL_DER_FILE}" "${INTERMEDIATE_CA_CRL_DER_FILE}" "${CRL_FILE}"
    logmessage 'Successfully backed up crl files'
  else
    logmessage 'One of more crl files not found. Moving along...'
  fi
}

function update_crl {
  cd "${CRL_BASE_DIR}"
  if ${WGET_BINARY} -O "${ROOT_CA_CRL_DER_FILE}" "${ROOT_CA_CRL_URL}"; then
    logmessage 'Successfully downloaded crl file from root CA endpoint'
    if ${WGET_BINARY} -O "${INTERMEDIATE_CA_CRL_DER_FILE}" "${INTERMEDIATE_CA_CRL_URL}"; then
      logmessage 'Successfully downloaded crl file from intermediate CA endpoint'
      # Convert intermediate ca crl file to pem
      if ${OPENSSL_BINARY} crl -inform DER -outform PEM -in "${INTERMEDIATE_CA_CRL_DER_FILE}" -out "${INTERMEDIATE_CA_CRL_DER_FILE}.pem"; then
        logmessage 'Replaced temporary intermediate crl file.'
        # Convert root ca crl file to pem and append to existing file
        if ${OPENSSL_BINARY} crl -inform DER -outform PEM -in "${ROOT_CA_CRL_DER_FILE}" -out "${ROOT_CA_CRL_DER_FILE}.pem"; then
          logmessage 'Replaced temporary root crl to file.'
          cat "${INTERMEDIATE_CA_CRL_DER_FILE}.pem" > "${CRL_FILE}"
          cat "${ROOT_CA_CRL_DER_FILE}.pem" >> "${CRL_FILE}"
          logmessage 'Replaced crl file. Reloading haproxy...'
          systemctl reload haproxy
        else
          logmessage 'Conversion of root ca crl file failed'
        fi
      else
        logmessage 'Conversion of intermediate ca crl file failed'
      fi
    else
      logmessage 'Could not download crl file from intermediate ca endpoint'
    fi
  else
    logmessage 'Could not download crl file from root CA endpoint'
  fi
}

if make_crl_backup; then
  update_crl
fi