#
# Cookbook:: irrigate-orchard_base
# Recipe:: infoblox_backup
#
# Copyright: The Orchard
#
if platform_family?('debian')

  include_recipe 'firewall'

  # Required packages
  packages = %w(
      openssl
      ruby-shadow
    )

  # Install packages
  packages.each do |name|
    package name
  end

  service_user = node['infoblox']['service_user']
  home_directory = node['infoblox']['service_user_home_directory']

  # Password rotations should be performed as follows (on Linux host):
  # python3 -c 'import crypt; print(crypt.crypt("newpassword123", crypt.mksalt(crypt.METHOD_SHA512)))'
  # This will generate the password hash for use in this user resource

  data_bag_name = node['infoblox']['backup_data_bag_name']
  infoblox_credentials = data_bag_item('secrets', data_bag_name)
  password_hash = infoblox_credentials['password_hash'].chomp

  user service_user do
    comment 'Infoblox service user'
    home home_directory
    manage_home true
    shell '/bin/bash'
    password password_hash
  end

  openssh_server node['sshd']['config_file'] do
    PasswordAuthentication 'yes'
  end

  python_packages = %w(
    boto3
  )

  python_packages.each do |name|
    execute 'install_package' do
      command "/usr/bin/pip3 install -U --break-system-packages pip && /usr/bin/pip3 install --break-system-packages #{name}"
      not_if "/usr/bin/pip3 list | grep -i #{name}"
    end
  end

  infoblox_backup_aws_credentials = data_bag_item('secrets', node['infoblox']['aws_credentials_data_bag_name'])

  # Create and populate backup script config file from template.
  node.default['infoblox']['backup']['kms_key_id'] = infoblox_backup_aws_credentials['kms_key_id'].chomp
  node.default['infoblox']['backup']['s3_bucket'] = infoblox_backup_aws_credentials['s3_bucket'].chomp
  node.default['infoblox']['backup']['s3_key'] = infoblox_backup_aws_credentials['s3_key'].chomp

  backup_script_directory = '/usr/local/bin'
  template "#{backup_script_directory}/backup_config.py" do
    source 'infoblox_backup_config.py.erb'
    mode '0640'
    owner service_user
  end

  # Add backup script
  backup_script_file = "#{backup_script_directory}/infoblox_backup.py"
  cookbook_file backup_script_file do
    source 'infoblox_backup.py'
    owner service_user
    mode '0640'
    action :create
  end

  ruby_block 'allow service_user to use crontab' do
    block do
      cron_allow_file = '/etc/cron.allow'
      if File.exist?(cron_allow_file)
        File.open(cron_allow_file, 'a') do |file|
          file.puts(service_user) unless File.readlines(cron_allow_file).grep(/^#{service_user}$/).any?
        end
      else
        File.write(cron_allow_file, "#{service_user}\n")
      end
    end
    not_if "grep -q '^#{service_user}$' /etc/cron.allow"
    action :run
  end

  # Run backup script on a cron
  cron 'infoblox_backup' do
    hour '7'
    minute '0'
    user service_user
    command "/usr/bin/python3 #{backup_script_file}"
  end

  # Keep configurable number of local backups
  backup_retention_days = node['infoblox']['backup']['retention_days']
  cron 'cleanup_old_backups' do
    hour '6'
    minute '0'
    user service_user
    command "find #{home_directory} -type f -name '*.gz' -mtime +#{backup_retention_days} -exec rm -rf {} \\;"
  end

end