#/usr/bin/env bash

# This script will only work on version 7+ of RHEL-based distros
# The Orchard's current distro of choice is CentOS 7.2

# TODO: make this good. 

export ENVIRONMENT='qa'
export SSHD_FILE='/etc/ssh/sshd_config'

# Remove any possible apache configs
systemctl stop httpd
systemctl disable httpd
userdel apache
rm -rf /etc/httpd

userdel deploy
groupdel webdev

# Update the host
yum -y update

useradd -u 1001 -d /home/deploy -M -N deploy
chown -R deploy:root /home/deploy

# Manage ssh permissions
chmod 700 /home/deploy/.ssh
chmod 600 /home/deploy/.ssh/authorized_keys

# Run ssh on non-standard port and remove any lingering apache rules
firewall-cmd --add-port 2020/tcp
firewall-cmd --add-port 2020/tcp --permanent
firewall-cmd --permanent --remove-port 80/tcp
firewall-cmd --permanent --remove-port 80/udp
firewall-cmd --permanent --remove-port 443/tcp
firewall-cmd --permanent --remove-port 443/udp
firewall-cmd --permanent --remove-port 22/tcp

# Harden ssh
sed -i 's/Port 22/Port 2020/g' ${SSHD_FILE}
sed -i 's/X11Forwarding yes/X11Forwarding no/g' ${SSHD_FILE}

cat <<EOF >> ${SSHD_FILE}
AllowUsers root deploy
Match Group users
        AllowTcpForwarding no
EOF

# SElinux change for ssh port
semanage port -a -t ssh_port_t -p tcp 2020

systemctl restart sshd

# Get rid iptables rules in this chain as well. 
iptables -D INPUT_direct -p tcp -m tcp -m multiport --dports 80 -m comment --comment http -j ACCEPT
iptables -D INPUT_direct -p tcp -m tcp -m multiport --dports 443 -m comment --comment https -j ACCEPT
iptables -D INPUT_direct -p tcp -m tcp -m multiport --dports 22 -m comment --comment ssh -j ACCEPT

# Create a keypair, and add the public key as an ssh key for the devdeploy-theorchard user. 
su deploy -c 'ssh-keygen -b 4096 -t rsa -C $(whoami)@$(hostname) -f /home/deploy/.ssh/id_rsa -N ""'

# Working hack to pull down github deploy token for composer
mkdir -p /home/deploy/.config/composer
chown -R deploy /home/deploy/.config/composer

cat <<EOF > /home/deploy/.config/composer/auth.json
{
      "github-oauth": {
          "github.com": "replace_me"
      }
}
EOF


if [ -f '/etc/chef/encrypted_data_bag_secret' ]; then
  ln -s /etc/chef/client.rb /etc/chef/knife.rb
  SECRET=$(knife data bag show secrets deploy_github_token --secret-file /etc/chef/encrypted_data_bag_secret  | grep -i token: | awk '{print $2}')
  sed -i "s/replace_me/${SECRET}/g" /home/deploy/.config/composer/auth.json
  rm -f /etc/chef/knife.rb
else
  echo "Chef encyrption secret required to fetch composer github token" && exit 1
fi

chown -R deploy /home/deploy/.config/composer/auth.json

# Now remove encryption secret
rm -f /etc/chef/encrypted_data_bag_secret