#
# Cookbook:: irrigate-orchard_base
# Recipe:: stmtdb_users_ssh
#
# Copyright: The Orchard
#
# This recipe manages service users, ssh keys, and ssh configuration for stmtdb
#

node['stmtdb']['ssh_users'].each do |user_attr|
  # Create the user
  user user_attr['username'] do
    comment     user_attr['comment']
    uid         user_attr['uid']
    home        user_attr['home']
    shell       user_attr['shell']
    manage_home true
    action      :create
  end

  # Create .ssh directory
  directory "#{user_attr['home']}/.ssh" do
    owner  user_attr['username']
    group  user_attr['username']
    mode   '0700'
    action :create
  end

  # Add SSH keys
  user_attr['ssh_keys'].each do |ssh_key|
    ssh_authorize_key "#{user_attr['username']}" do
      user      user_attr['username']
      key       ssh_key['key']
      keytype   ssh_key['type']
      action    :create
    end
  end

  # Rotate passwords
  cron 'ssh_user_password_rotation' do
    weekday 3
    hour 0
    minute 30
    command "echo #{user_attr['username']}:$(openssl rand -base64 24) | chpasswd"
  end
end

group 'service_users' do
  gid     1131
  members node['stmtdb']['ssh_users'].map { |u| u['username'] }
  action  :create
end

directories = %w(
  /mnt/data/extract-sales
  /mnt/data/extract-sales/outfile
)

directories.each do |dir|
  directory dir do
    owner  'root'
    group  'service_users'
    mode   '0770'
    action :create
  end
end