#
# Cookbook:: irrigate-jenkins
# Recipe:: main
#
# Copyright:: (C) 2023 The Orchard
#

include_recipe 'jenkins::master'

if node['jenkins']['ssh']['port'] != -1

  # Add jenkins user for cli with authentication
  cli_data_bag_name = node['jenkins']['cli_private_key_data_bag_name']
  cli_private_key_data = data_bag_item('secrets', cli_data_bag_name)
  cli_private_key = cli_private_key_data['key'].chomp

  key = OpenSSL::PKey::RSA.new(cli_private_key)
  cli_public_key = "#{key.ssh_type} #{[key.to_blob].pack('m0')}"

  jenkins_home = node['jenkins']['jenkins_home_dir']

  directory File.join(jenkins_home, 'init.groovy.d') do
    user node['jenkins']['user']
    group node['jenkins']['group']
  end

  template File.join(jenkins_home, 'init.groovy.d', 'init.groovy') do
    source 'init.groovy.erb'
    user node['jenkins']['main']['user']
    group node['jenkins']['main']['group']
    variables(
      'ssh_port' => node['jenkins']['ssh']['port'],
      'user_name' => node['jenkins']['cli']['user_name'],
      'user_full_name' => node['jenkins']['cli']['user_full_name'],
      'user_pub_key' => cli_public_key,
      'cli_remoting' => node['jenkins']['main']['cli_remoting']
    )
    notifies :restart, 'service[jenkins]', :immediately
  end

  # Set the private key on the Jenkins executor
  node.run_state[:jenkins_private_key] = cli_private_key

end

# These are prequisite plugins that needs to be installed first
node['jenkins']['prerequisite_plugins'].each do |plugin|
  jenkins_plugin plugin do
    action :install
    notifies :restart, 'service[jenkins]', :immediately
    install_deps true
  end
end

# Install latest version of these plugins
node['jenkins']['latest_plugins'].each do |plugin|
  jenkins_plugin plugin do
    action :install
    install_deps false
    notifies :restart, 'service[jenkins]'
  end
end

# Install specific versions of these plugins, and do so last
node['jenkins']['pinned_plugins'].each do |plugin|
  jenkins_plugin plugin do
    action :install
    install_deps false
    version node['jenkins']['main']['plugins'][plugin]
    notifies :restart, 'service[jenkins]'
  end
end

# Key for communication with agents
data_bag_name = node['jenkins']['agent_private_key_data_bag_name']
agent_private_key = data_bag_item('secrets', data_bag_name)
private_key = agent_private_key['key'].chomp
jenkins_private_key_credentials 'jenkins' do
  id 'agent-key'
  description 'SSH key for communication with agents'
  private_key private_key
end

service 'jenkins' do
  supports restart: true, status: true, reload: true
  action [:enable, :start]
end

# Make sure the firewall is installed and enabled
firewall 'default' do
  log_level :high
  action :install
end

firewall_rule 'established' do
  stateful [:related, :established]
  protocol :none
  position 2
  command :allow
end

firewall_rule 'ssh' do
  port 22
  protocol :tcp
  position 3
  command :allow
end

firewall_rule 'http-8080' do
  port 8080
  protocol :tcp
  position 4
  command :allow
end

# If you use random ssh port (-1) you should think about how to make it opened
if node['jenkins']['ssh']['port'] > 0
  firewall_rule 'ssh_cli' do
    port node['jenkins']['ssh']['port']
    protocol :tcp
    position 5
    command :allow
  end
end