# Add directories and certificates for every configured SSL policy
unless node['neo4j']['config']['ssl_policy']['policies'].empty?
  node['neo4j']['config']['ssl_policy']['policies'].each do |_policy, policy_settings|
    policy_directories = [
      policy_settings['base_directory'],
      policy_settings['base_directory'] + '/trusted',
      policy_settings['base_directory'] + '/revoked',
    ]
    policy_directories.each do |policy_subdirectory|
      directory policy_subdirectory do
        owner node['neo4j']['user']
        group node['neo4j']['user']
        mode '0750'
        action :create
      end
    end

    # If data_bag_name is specified, read certificate from encrypted data bag
    next unless policy_settings['data_bag_name'] && !policy_settings['data_bag_name'].empty?
    certificate_data_bag       = data_bag_item('secrets', policy_settings['data_bag_name'])
    private_key                = certificate_data_bag['private_key'].chomp
    public_certificate         = certificate_data_bag['public_certificate'].chomp
    trusted_certificates_chain_files = [
        'AWS_certificate_chain.crt',
        'DigiCert_certificate_chain.crt',
    ]

    file "#{policy_settings['base_directory']}/private.key" do
      owner node['neo4j']['user']
      mode '0600'
      content private_key
      sensitive true
    end

    trusted_certificates_chain_files.each do |trusted_certificate|
      cookbook_file "#{policy_settings['base_directory']}/trusted/#{trusted_certificate}" do
        owner node['neo4j']['user']
        mode '0640'
        source trusted_certificate
      end
    end

    # Neo4j note: the public certificate must be duplicated.
    # One copy is to be placed into the base_directory, and the other copy is to be placed into the trusted_dir
    public_certificate_files = [
      "#{policy_settings['base_directory']}/public.crt",
      "#{policy_settings['base_directory']}/trusted/public.crt",
    ]

    public_certificate_files.each do |certificate_file|
      file certificate_file do
        owner node['neo4j']['user']
        mode '0640'
        content public_certificate
        sensitive true
      end
    end
  end
end