#!/bin/bash
##############################################################################
#                    Web server installer on CentOS 7                        #
##############################################################################
#           This program is distributed under the "GPLv3" License            #
#           			TODO: add dialog for minimal GUI  			         #
##############################################################################

header()
{
    echo "Web server installer version 1.0"
	echo "Installer for web server with Apache and Tomcat"
    echo "GPLv3"
    echo
}

showhelp()
{
    header
    echo 'Usage: ./web_server_installer [OPTIONS]'
    echo
    echo 'OPTIONS:'
    echo '-h   | --help: Show this help screen. Install java before apache.'
    echo '-j   | --java <url>: Java url to be downloaded. Base url is ' \
        'https://download.oracle.com/otn-pub/java/jdk/  -- append the ' \
        'remaining part of the url.'
    echo '-t   | --tomcat <tomcat-version> <java-version>: Add the apache ' \
        'tomcat version (e.g. "9.0.31") and add the java version as well ' \
        '(e.g. 11.0.6).'
    echo '-a   | --apache <host> <port>: install apache with the config for ' \
        'the host provided'
    echo '-c   | --certificate <host> <port>: install letsencrypt for apache ' \
        'the host provided'
}

java_setup()
{
    # Extract java version
    version=`echo "$1" | cut -d'_' -f 1 | rev | cut -d"/" -f 1 | rev`

    # Download Java from the Oracle repository
    # stanrdard url works as https://download.oracle.com/otn-pub/java/jdk/
    # in java11 is https://download.oracle.com/otn-pub/java/jdk/11.0.6+8/90eb79fb590d45c8971362673c5ab495/jdk-11.0.6_linux-x64_bin.rpm
    # for java 13 wget --no-cookies --no-check-certificate --header "Cookie: oraclelicense=accept-securebackup-cookie" https://download.oracle.com/otn-pub/java/jdk/13.0.2+8/d4173c853231432d94f001e99d882ca7/jdk-13.0.2_linux-x64_bin.rpm
    wget --no-cookies --no-check-certificate --header "Cookie: oraclelicense=accept-securebackup-cookie" $1

    # Install java
    sudo rpm -Uvh /tmp/${version}_linux-x64_bin.rpm 
	
	# File cleanup
	sudo rm /tmp/${version}_linux-x64_bin.rpm 
}

tomcat_setup()
{
    # Check if java has already been installed
    if type -p java; then
        echo found java executable in PATH
        _java=java
    elif [[ -n "$JAVA_HOME" ]] && [[ -x "$JAVA_HOME/bin/java" ]];  then
        echo found java executable in JAVA_HOME     
        _java="$JAVA_HOME/bin/java"
    else
        echo "Java must be installed for tomcat to be installed and setup"
        exit
    fi

    # Variable for the latest Tomcat version. Change this varible for
    # newer versions
    tommy="apache-tomcat-"$1
    ver=`echo "$1" | cut -d'.' -f 1`
    # version=`echo "$tommy" | rev | cut -d'-' -f 1 | rev`
    ext=".tar.gz"
    url="http://mirror.nohup.it/apache/tomcat/tomcat-"$ver"/v"$1"/bin/"

    # Add the Tomcat user and group to which our application will attach to
    # note that the -s is done to avoid the chance of logging in as tomcat
    sudo useradd -m -U -d /opt/tomcat -s /bin/false tomcat

    # Download the latest Tomcat Version
    wget $url$tommy$ext

    # Unzip the tar file into the /tmp folder
    tar -xf $tommy$ext

    # Move the folder into its folder
    sudo mv $tommy /opt/tomcat/

    # Create a soft link for the tomcat folder as latest
    sudo ln -s /opt/tomcat/$tommy /opt/tomcat/latest

    # Set the owner of the tomcat folder to the tomcat user
    sudo chown -R tomcat: /opt/tomcat

    # We need to make the shell script executable to make sure we can invoke them
    # into a service for startup and shutdown of the tomcat platform
    sudo sh -c 'chmod +x /opt/tomcat/latest/bin/*.sh'

    # Create the service file. We configure it so that by enabling it we will
    # be able to make our tomcat starting up on boot by enabling the service
    echo '
    [Unit]
    Description=Tomcat 9 servlet container
    After=network.target

    [Service]
    Type=forking

    User=tomcat
    Group=tomcat

    Environment="JAVA_HOME=/usr/java/jdk-'$2'"
    Environment="JAVA_OPTS=-Djava.security.egd=file:///dev/urandom"

    Environment="CATALINA_BASE=/opt/tomcat/latest"
    Environment="CATALINA_HOME=/opt/tomcat/latest"
    Environment="CATALINA_PID=/opt/tomcat/latest/temp/tomcat.pid"
    Environment="CATALINA_OPTS=-Xms512M -Xmx1024M -server -XX:+UseParallelGC"

    ExecStart=/opt/tomcat/latest/bin/startup.sh
    ExecStop=/opt/tomcat/latest/bin/shutdown.sh

    [Install]
    WantedBy=multi-user.target' > /etc/systemd/system/tomcat.service

    # Reload the daemon since we created a new service
    sudo systemctl daemon-reload

    # Enable the Tomcat service and start it
    sudo systemctl enable tomcat
    sudo systemctl start tomcat
	
	# File cleanup
	sudo rm /tmp/$tommy$ext

    # Exclusion for firewall
    sudo firewall-cmd --permanent --add-port=8090/tcp

    # Restart the firewall
    sudo systemctl restart firewalld

    # Note that this files need to be configured
    # /opt/tomcat/latest/conf/server.xml to add ajp and port 8090 for http
    #       for the ajp the connector need to be decommendted and add
    #           secretRequired="false"
    #       for the 8090 port you just need to find the simple connector
    #           with port 8080 and change it
    #
    # /opt/tomcat/latest/conf/tomcat-users.xml to add roles and users
    #       add for example:
    #           <role rolename="manager"/>
    #           <role rolename="manager-gui"/>
    #           <role rolename="manager-script"/>
    #           <role rolename="admin"/>
    #              <user username="tommy-man" password="<password>" 
    #                   roles="manager,manager-gui,manager-script" />
    #               <user username="xelinion" password="<passwrd>" 
    #                   roles="admin" />
    #
    #
    # /opt/tomcat/latest/webapps/manager/META-INF/context.xml to add manager
    #   outside localhost
    #       add the ips, |192.168.1.\d+ (it may vary with your network)
}

apache_setup()
{
    # We do not want www
    if [ `echo "$1" | cut -d'.' -f 1` == 'www' ]
    then
        echo "Do not add www to the host pls"
        exit
    fi

    # Install httpd and add the exclusion to the firewall
    sudo yum install httpd -y

    # Add the http and https for the certification part and the 8443 for tomcat
    sudo firewall-cmd --permanent --add-service=http
    sudo firewall-cmd --permanent --add-service=https
    sudo firewall-cmd --permanent --add-port=8443/tcp

    # Restart the firewall
    sudo systemctl restart firewalld

    # Enable and start the service
    sudo systemctl enable httpd
    sudo systemctl start httpd

    # We'll get the first element of the domain as user, therefore, if we have
    # example.com our base user will be example.
    user=`echo "$1" | cut -d'.' -f 1`

    i=1

    # The first if shoul be enough, but never be too sure
    while [ $user == "www" ]
    do
        # If the user passed www we want to exclude it
        user=`echo "$1" | cut -d'.' -f "$i" | rev | cut -d'.' | rev`
        i=$i+1
    done

    # Add the Tomcat user and group to which our application will attach to
    # note that the -s is done to avoid the chance of logging in as tomcat
    sudo useradd -m -U -d /var/www/$1/ -s /bin/false $user

    # Create the base folder for the base url
    sudo mkdir -p /var/www/html/$1/ 
    sudo mkdir -p /var/www/$1/log

    # Change owner of the folder
    sudo chown -R $user:$user /var/www/html/$1

    # Change mod
    sudo chmod -R 755 /var/www/

    # Create the sites-available and sites-enabled folder for apache
    sudo mkdir /etc/httpd/sites-available /etc/httpd/sites-enabled

    # We also add the configuration for tomcat (we will need to make it
    # available from the server tomcat file as well)
    echo '
Listen '$2'
IncludeOptional sites-enabled/*.conf
LoadModule proxy_module modules/mod_proxy.so
LoadModule proxy_ajp_module modules/mod_proxy_ajp.so' >> /etc/httpd/conf/httpd.conf

    echo '
<VirtualHost *:80>
    ServerName www.'$1'
    ServerAlias '$1'
    DocumentRoot /var/www/html/'$1'/
    ErrorLog /var/www/'$1'/log/error.log
    CustomLog /var/www/'$1'/log/requests.log combined
    ProxyRequests Off
    ProxyPreserveHost On

    <Proxy *>
        Order deny,allow
        Allow from all
    </Proxy>

    ProxyPass / ajp://localhost:8009/
</VirtualHost>
    ' > /etc/httpd/sites-available/$1.conf
    
    # Create the softlink
    sudo ln -s /etc/httpd/sites-available/$1.conf /etc/httpd/sites-enabled/$1.conf

    # Adjust the SELinux policy for Apache globally
    sudo setsebool -P httpd_unified 1

    # Restart the service
    sudo systemctl restart httpd

    # Check the list of contents of thhe log folder to see whether or not
    # Apache created the files
    ls -lZ /var/www/$1/log
}

certification_setup()
{
    # We do not want www
    if [ `echo "$1" | cut -d'.' -f 1` == 'www' ]
    then
        echo "Do not add www to the host pls"
        exit
    fi
    
    # Install the epel release
    sudo yum install epel-release -y

    # Install certbot
    sudo yum install certbot python2-certbot-apache mod_ssl -y

    # Obtain the certificate: if you want the alias decomment it
    sudo certbot --apache -d $1 # -d www.$1
    
    # The next part is interactive and require the user to choose: it is better
    # to redirect to https

    # Renewal
    crontab -l | { cat; echo "0 0,12 * * * python -c 'import random; import time; time.sleep(random.random() * 3600)' && certbot renew"; } | crontab -

    # Change default listening port
    sudo sed -i 's/443/'$2'/g' /etc/httpd/sites-available/$1-le-ssl.conf

    # Restart the service
    sudo systemctl restart httpd

    # Add permanent zone to firewall
    firewall-cmd --zone=public --add-masquerade --permanent
    # Forward of the 8443 port to 443 port since letsencrypt works only on
    # that
    firewall-cmd --zone=public \
        --add-forward-port=port=8443:proto=tcp:toport=443 --permanent

    # Restart the firewall
    systemctl restart firewalld
}

# We need super user privileges to execute the script
user_id=$(id -u)

if [ "$user_id" != "0" ]; then
    echo "You need super user priviliges for this."
    exit
fi

# Download and execute the commands inside the tmp folder
cd /tmp

while [ "$1" ]; do
    case $1 in
        '-h' | '--help' | '?' )
            showhelp
            exit
            ;;
        '--java' | '-j' )
            java_setup "$2"
            exit
            ;;
        '--tomcat' | '-t' )
            tomcat_setup "$2" "$3"
            exit
            ;;
        '--apache' | '-a' )
            apache_setup "$2" "$3"
            exit
            ;;
        '--certificate' | '-c' )
            certification_setup "$2" "$3"
            exit
            ;;
    esac

    shift
done