#!/bin/bash

if [ -f "include/startup.sh" ]; then
    . include/startup.sh
elif [ -f "../include/startup.sh" ]; then
    . ../include/startup.sh
fi

checkTagExist nginx.success

rootDir=$(rootDir)
erlangVersion=25.x
rabbitmqVersion=3.12.\*


#rabbitmqDomain="${CWM_SERVERIP//./-}.cloud-xip.io"
rabbitmqDomain="${CWM_SERVERIP//./-}.cloud-xip.com"

echo "Adding RabbitMQ repository" | log
apt-key adv --keyserver "hkps://keys.openpgp.org" --recv-keys "0x0A9AF2115F4687BD29803A206B73A36E6026DFCA"
echo "deb https://dl.bintray.com/rabbitmq-erlang/debian bionic erlang-${erlangVersion}" | tee /etc/apt/sources.list.d/bintray.rabbitmq.list
echo "deb https://dl.bintray.com/rabbitmq/debian bionic main" >> /etc/apt/sources.list.d/bintray.rabbitmq.list
apt update

echo "Installing Erlang & Rabbitmq" | log
packages=(erlang-base erlang-asn1 erlang-crypto erlang-eldap erlang-ftp erlang-inets erlang-mnesia erlang-os-mon erlang-parsetools erlang-public-key erlang-runtime-tools erlang-snmp erlang-ssl erlang-syntax-tools erlang-tftp erlang-tools erlang-xmerl)
installPackage "${packages[@]}"
waitOrStop 0 "Failed apt install: ${packages[@]}"
# install main package
installPackage rabbitmq-server=$rabbitmqVersion
waitOrStop 0 "Failed apt install: rabbitmq-server"
# enable web ui plugin
rabbitmq-plugins enable rabbitmq_management

echo "Adding admin user" | log
rabbitmqctl add_user admin ${ADMINPASSWORD}
rabbitmqctl set_user_tags admin administrator
rabbitmqctl set_permissions -p / admin ".*" ".*" ".*"
rabbitmqctl delete_user guest

echo "Opening web UI to remote access" | log
# Enabling certbot for rabbitmq
mkdir -p /var/lib/letsencrypt/.well-known
chgrp www-data /var/lib/letsencrypt
chmod g+s /var/lib/letsencrypt
# remove default vhosts
unlink /etc/nginx/sites-enabled/default
unlink /etc/nginx/sites-enabled/default-ssl
# copy configs to nginx folders
cp $rootDir/tweaks/extras/rabbitmq-nginx/letsencrypt.conf /etc/nginx/snippets/
cp $rootDir/tweaks/extras/rabbitmq-nginx/register.conf /etc/nginx/sites-available/
ln -s /etc/nginx/sites-available/register.conf /etc/nginx/sites-enabled/

# creating certbot
execSpecial 3 '(fail|error)' certbot certonly --agree-tos -n --email ${ADMINEMAIL} --webroot -w /var/lib/letsencrypt/ -d ${rabbitmqDomain} ${CWM_DEBUG:+"--test-cert"}

if [[ $? == 1 ]]
then
export certbot_failed=1
echo "Generating self-signed certificate" | log
mkdir /etc/letsencrypt/live
mkdir /etc/letsencrypt/live/${CWM_DOMAIN}
openssl req -x509 -sha256 -newkey rsa:2048 -keyout /etc/letsencrypt/live/${rabbitmqDomain}/privkey.pem -out /etc/letsencrypt/live/${rabbitmqDomain}/fullchain.pem -days 1024 -nodes -subj '/CN=localhost'
waitOrStop 0 "Certificate creation failed"

else

export certbot_failed=0
#waitOrStop 0 "Failed certbot certificate generation"
fi

unlink /etc/nginx/sites-enabled/register.conf
cp $rootDir/tweaks/extras/rabbitmq-nginx/rabbitmq.conf /etc/nginx/sites-available/
# add keys to ssl configs
sed -i "s|/path/to/your.key|/etc/letsencrypt/live/${rabbitmqDomain}/privkey.pem|" /etc/nginx/sites-available/rabbitmq.conf
sed -i "s|/path/to/your.crt|/etc/letsencrypt/live/${rabbitmqDomain}/fullchain.pem|" /etc/nginx/sites-available/rabbitmq.conf

if [[ -f /etc/letsencrypt/live/${rabbitmqDomain}/chain.pem ]]; then 
      	sed -i "s|/path/to/your.chain|/etc/letsencrypt/live/${rabbitmqDomain}/chain.pem|" /etc/nginx/sites-available/rab
	at << EOF > /etc/rabbitmq/rabbitmq.conf

listeners.ssl.default = 5671
management.ssl.port   = 15671

ssl_options.cacertfile = /etc/letsencrypt/live/${rabbitmqDomain}/chain.pem
ssl_options.certfile   = /etc/letsencrypt/live/${rabbitmqDomain}/fullchain.pem
ssl_options.keyfile    = /etc/letsencrypt/live/${rabbitmqDomain}/privkey.pem
ssl_options.verify     = verify_peer
ssl_options.fail_if_no_peer_cert = true

management.ssl.cacertfile = /etc/letsencrypt/live/${rabbitmqDomain}/chain.pem
management.ssl.certfile   = /etc/letsencrypt/live/${rabbitmqDomain}/fullchain.pem
management.ssl.keyfile    = /etc/letsencrypt/live/${rabbitmqDomain}/privkey.pem
EOF

else
	sed -i '/ssl_trusted_certificate \/path\/to\/your.chain;/d' /etc/nginx/sites-available/rabbitmq.conf
	cat << EOF > /etc/rabbitmq/rabbitmq.conf

listeners.ssl.default = 5671
management.ssl.port   = 15671

ssl_options.certfile   = /etc/letsencrypt/live/${rabbitmqDomain}/fullchain.pem
ssl_options.keyfile    = /etc/letsencrypt/live/${rabbitmqDomain}/privkey.pem
ssl_options.verify     = verify_peer
ssl_options.fail_if_no_peer_cert = true

management.ssl.certfile   = /etc/letsencrypt/live/${rabbitmqDomain}/fullchain.pem
management.ssl.keyfile    = /etc/letsencrypt/live/${rabbitmqDomain}/privkey.pem
EOF

fi

chmod 771 /etc/letsencrypt/live
chmod -R 775 /etc/letsencrypt/live/${rabbitmqDomain}
chmod 771 /etc/letsencrypt/archive
chmod -R 775 /etc/letsencrypt/archive/${rabbitmqDomain}

ln -s /etc/nginx/sites-available/rabbitmq.conf /etc/nginx/sites-enabled/
systemctl restart nginx
sleep 5
waitOrStop 0 "Restarting nginx service failed"

echo "Starting Rabbitmq service" | log
systemctl enable rabbitmq-server
systemctl start rabbitmq-server
systemctl restart rabbitmq-server
waitOrStop 0 "Starting rabbitmq service failed"

echo "Adding descriptions" | log
descriptionAppend "RabbitMQ Web UI: https://${rabbitmqDomain}"
descriptionAppend "RabbitMQ Username: admin"
descriptionAppend "RabbitMQ Password: ${ADMINPASSWORD}"
descriptionAppend " "
descriptionAppend "RabbitMQ config files location: /etc/rabbitmq/"
descriptionAppend " "

tagScript success

exit 0