#
# Cookbook Name:: irrigate-sftp
# Recipe:: default
#
# Copyright (C) 2018 The Orchard
#
# All rights reserved - Do Not Redistribute
#

packages = %w(
  epel-release
  s3fs-fuse
  git
  unzip
  zip
)

# Installs git, unzip, zip, sf3s-fuse, and epel-release. epel-release is needed to install s3fs-fuse
packages.each do |name|
  package name
end

sftp_aws_credentials  = data_bag_item('secrets', node['sftp']['aws_credentials_data_bag_name'])
aws_access_key_id     = sftp_aws_credentials['aws_access_key_id'].chomp
aws_secret_access_key = sftp_aws_credentials['aws_secret_access_key'].chomp

# Create password file with AWS access & secret key for s3fs
template '/etc/passwd-s3fs' do
  source 'aws_credentials.erb'
  owner 'root'
  mode '0600'
  variables(
    aws_access_key_id: aws_access_key_id,
    aws_secret_access_key: aws_secret_access_key
  )
  sensitive true
end

sftp_root_directory = node['sftp']['sftp_root_directory']
sftp_device_mount   = node['sftp']['device_mount']
sftp_mount_options  = node['sftp']['mount_options']
sftp_user_group     = node['sftp']['sftp_user_group']
sftp_user_group_id  = node['sftp']['sftp_user_group_id']

# Create sftp user group
group sftp_user_group do
  group_name sftp_user_group
  gid sftp_user_group_id
end

# Check if mount directory exists, if not, then create one and mount it via fstab
unless Dir.exist? sftp_root_directory
  directory sftp_root_directory do
    mode '750'
    owner 'root'
    group sftp_user_group
    recursive true
  end

  mount sftp_root_directory do
    device sftp_device_mount
    fstype 'fuse'
    options sftp_mount_options
    action [:mount, :enable]
  end
end

sftp_users_data_bag_name = node['sftp']['user_credentials_data_bag_name']
sftp_credentials         = data_bag_item('secrets', sftp_users_data_bag_name)

# Create sftp users, user directory and a nested user directory
sftp_credentials['users'].each do |user|
  user user['id'].to_s do
    home "#{sftp_root_directory}/#{user['id']}"
    gid sftp_user_group
    password user['password'].to_s
    shell '/sbin/nologin'
    manage_home true
  end

  directory "#{sftp_root_directory}/#{user['id']}" do
    mode '750'
    owner 'root'
    group sftp_user_group
  end

  directory "#{sftp_root_directory}/#{user['id']}/#{user['id']}" do
    mode '0770'
    owner user['id'].to_s
    group sftp_user_group
  end

  # Since passwords expire, this resets them to a random one for all users.
  cron "reset_user_password_#{user['id']}" do
    day '1'
    hour '0'
    minute '0'
    month '1,3,5,7,9,11'
    command "< /dev/urandom tr -dc _A-Z-a-z-0-9 | head -c24 | passwd --stdin #{user['id']}"
  end
end

sftp_ssh_host_keys           = data_bag_item('secrets', node['sftp']['ssh_host_keys_data_bag_name'])
ssh_host_ecdsa_key_public    = sftp_ssh_host_keys['ssh_host_ecdsa_key_public'].chomp
ssh_host_ecdsa_key_private   = sftp_ssh_host_keys['ssh_host_ecdsa_key_private'].chomp
ssh_host_ed25519_key_public  = sftp_ssh_host_keys['ssh_host_ed25519_key_public'].chomp
ssh_host_ed25519_key_private = sftp_ssh_host_keys['ssh_host_ed25519_key_private'].chomp
ssh_host_rsa_key_public      = sftp_ssh_host_keys['ssh_host_rsa_key_public'].chomp
ssh_host_rsa_key_private     = sftp_ssh_host_keys['ssh_host_rsa_key_private'].chomp

ssh_public_key_hash = Hash[
  'ssh_host_ecdsa_key.pub' => ssh_host_ecdsa_key_public,
  'ssh_host_ed25519_key.pub' => ssh_host_ed25519_key_public,
  'ssh_host_rsa_key.pub' => ssh_host_rsa_key_public
]

ssh_private_key_hash = Hash[
  'ssh_host_ecdsa_key' => ssh_host_ecdsa_key_private,
  'ssh_host_ed25519_key' => ssh_host_ed25519_key_private,
  'ssh_host_rsa_key' => ssh_host_rsa_key_private
]

ssh_key_files_location = '/etc/ssh'
ssh_public_key_hash.each do |key, value|
  file "#{ssh_key_files_location}/#{key}" do
    mode '644'
    owner 'root'
    group 'root'
    content value.to_s
  end
end

ssh_private_key_hash.each do |key, value|
  file "#{ssh_key_files_location}/#{key}" do
    mode '640'
    owner 'root'
    group 'ssh_keys'
    content value.to_s
  end
end

sftp_rsbookpub_user            = node['sftp']['sftp_rsbookpub_user']
sftp_dtmvadmin_user            = node['sftp']['sftp_dtmvadmin_user']
sftp_bookpub_archive_directory = node['sftp']['sftp_bookpub_archive_directory']

directory "#{sftp_root_directory}/#{sftp_bookpub_archive_directory}" do
  mode '750'
  owner 'root'
  group sftp_user_group
end

directory "#{sftp_root_directory}/#{sftp_bookpub_archive_directory}/#{sftp_bookpub_archive_directory}" do
  mode '770'
  owner sftp_rsbookpub_user
  group sftp_user_group
end

## Edit sshd config to allow password authentication and setup user logins to direct them to their directory
node.override['sshd']['sshd_config']['PermitRootLogin']        = 'no'
node.override['sshd']['sshd_config']['PasswordAuthentication'] = 'yes'
node.override['sshd']['sshd_config']['Match'] = {
  "Group #{sftp_user_group} User *,!#{sftp_rsbookpub_user},!#{sftp_dtmvadmin_user}" => {
    'ChrootDirectory' => "#{sftp_root_directory}/%u",
    'ForceCommand' => 'internal-sftp -u 002 -d /%u',
    'AllowTcpForwarding' => 'no',
    'X11Forwarding' => 'no',
  },
  "User #{sftp_rsbookpub_user}" => {
    'ChrootDirectory' => sftp_root_directory,
    'ForceCommand' => 'internal-sftp -u 002',
    'AllowTcpForwarding' => 'no',
    'X11Forwarding' => 'no',
  },
  "User #{sftp_dtmvadmin_user}" => {
    'ChrootDirectory' => sftp_root_directory,
    'ForceCommand' => 'internal-sftp -u 002',
    'AllowTcpForwarding' => 'no',
    'X11Forwarding' => 'no',
  },
}

include_recipe 'sshd::default'