#!/bin/bash

set -e

source /etc/lsb-release
BRANCH=noble-pro

SANDBOX=false
LOGIN=
PASSWORD=
URL=https://mfd-update.cert.orangecyberdefense.com/download/mfd-reposit

usage() {
    echo "Usage: $0 [--sandbox] [--branch=BRANCH] [--login=USER] [--password=PASSWORD] [--proxy=PROXY]"
    exit 1
}

while [ "$1" != "" ]; do
    case $1 in
        --sandbox)
            SANDBOX=true
            if [ "$DISTRIB_CODENAME" != "focal" ]; then
                echo "sandbox must be installed on focal host"
                exit -1
            fi
            ;;
        --branch=*)
            BRANCH="${1#*=}"
            ;;
        --login=*)
            LOGIN="${1#*=}"
            ;;
        --password=*)
            PASSWORD="${1#*=}"
            ;;
        --url=*)
            URL="${1#*=}"
            ;;
        --proxy=*)
            PROXY="${1#*=}"
            ;;
        *)
            usage
            ;;
    esac
    shift
done

if [ -n "$PROXY" ]; then
    http_proxy="$PROXY"
    https_proxy="$PROXY"
fi

if [ -z "$LOGIN" ] || [ -z "$PASSWORD" ]; then
  read -rp 'Login: ' LOGIN </dev/tty
  read -rsp 'Password: ' PASSWORD </dev/tty
fi

mkdir -p /tmp/mfd
cd /tmp/mfd

curl -o mfd-reposit.tar.gz.sig.new --user "$LOGIN:$PASSWORD" $URL/$BRANCH/mfd-reposit.tar.gz.sig

if ! cmp -s mfd-reposit.tar.gz.sig mfd-reposit.tar.gz.sig.new; then
    mv mfd-reposit.tar.gz.sig.new mfd-reposit.tar.gz.sig
    rm -f mfd-reposit.tar.gz
fi 

curl -C - -o mfd-reposit.tar.gz --user "$LOGIN:$PASSWORD" $URL/$BRANCH/mfd-reposit.tar.gz

set -x

tar -xpf mfd-reposit.tar.gz

echo "deb [trusted=yes] file:///tmp/mfd/deb/ $DISTRIB_CODENAME main" > /etc/apt/sources.list.d/mfd.list
apt update

if [ "$SANDBOX" = true ]; then

    SANDBOX=$BRANCH
    
    set +e
    lxc storage list | grep -q default
    R=$?
    set -e

    if [ "$R" -eq 1 ]; then
    cat <<EOF | lxd init --preseed
config: {}
networks:
- config:
    ipv4.address: auto
    ipv6.address: none
  description: ""
  name: lxdbr0
  type: ""
storage_pools:
- config: {}
  description: ""
  name: default
  driver: dir
profiles:
- config: {}
  description: ""
  devices:
    eth0:
      name: eth0
      network: lxdbr0
      type: nic
    root:
      path: /
      pool: default
      type: disk
  name: default
cluster: null
EOF
    if [ ! -z $http_proxy ]; then
        lxc config set core.proxy_http $http_proxy
    fi

    if [ ! -z $https_proxy ]; then
        lxc config set core.proxy_https $https_proxy
    fi
fi

    echo "GRUB_DEFAULT=\"Ubuntu, with Linux 5.8.18-p2a-kane\"" > /etc/default/grub.d/kernel.cfg
    apt install -y linux-image-5.8.18-p2a-kane mfd-nitro-hugetlbfs

    lxc launch ubuntu:24.04 $SANDBOX -c security.nesting=true -c security.privileged=true
    lxc config device add $SANDBOX kvm unix-char path=/dev/kvm
    lxc config device add $SANDBOX proxycache proxy listen=tcp:127.0.0.1:8080 connect=tcp:127.0.0.1:8080
    lxc config device add $SANDBOX hugetlbfs disk source=/var/lib/hugetlbfs/global/pagesize-2MB/ path=/var/lib/hugetlbfs/global/pagesize-2MB/
    lxc config device add $SANDBOX deb disk source=/tmp/mfd path=/tmp/mfd
    lxc config set $SANDBOX environment.http_proxy "$http_proxy"
    lxc config set $SANDBOX environment.https_proxy "$https_proxy"
    lxc config set $SANDBOX environment.no_proxy "$no_proxy"
    
    lxc exec $SANDBOX -- rm -f /etc/apt/sources.list
    lxc exec $SANDBOX -- bash -c "rm -f /etc/apt/sources.list.d/*"
    lxc exec $SANDBOX -- bash -c "echo \"deb [trusted=yes] file:///tmp/mfd/deb/ noble main\" > /etc/apt/sources.list.d/mfd.list"
    lxc exec $SANDBOX -- apt update
    lxc exec $SANDBOX -- apt install -y majorque mfd-keyring mfd-proxycache mfd mfd-nitro mfd-nitro-network mfd-vnc2mpg
    lxc exec $SANDBOX -- ln -sf /etc/mfd/nitro.json.sample /etc/mfd/mfd.json

    if [ ! -z $https_proxy ]; then
        lxc exec $SANDBOX -- bash -c "echo 'Define PROXYCACHE-PROXY \"$https_proxy\"' >> /etc/mfd/apache2.conf.d/env.conf"
    fi

    echo "deb http://127.0.0.1:8080/rdp/mfd-reposit/$BRANCH/deb/ focal main" > /etc/apt/sources.list.d/mfd.list

    lxc exec $SANDBOX -- bash -c "echo \"deb http://127.0.0.1:8080/rdp/mfd-reposit/$BRANCH/deb/ noble main\" > /etc/apt/sources.list.d/mfd.list"
    lxc config device remove $SANDBOX deb

    echo "reboot to finalyse install"
else
    ARANGODB_ROOT_PASSWORD=password
    echo arangodb3 arangodb3/password string ${ARANGODB_ROOT_PASSWORD} | debconf-set-selections
    echo arangodb3 arangodb3/password_again string ${ARANGODB_ROOT_PASSWORD} | debconf-set-selections
    echo arangodb3 arangodb3/upgrade boolean true | debconf-set-selections
    echo arangodb3 arangodb3/backup boolean false | debconf-set-selections

    apt install -y arangodb3 redis redis-sentinel majorque mfd-keyring mfd-doc mfd-proxycache mfd-web mfd openssh-server
    systemctl enable ssh

    a2dissite 000-default
    a2ensite mfd-web-auth-form
    htpasswd -c -B -b /var/www/passwd admin Orange1024
    chown mfd:www-data /var/www/passwd

    openssl rand -hex 16 > /var/www/secret
    cd /var/www/mfd-web && /opt/mfd/bin/mfd-web.sh --configure

    if [ ! -z $https_proxy ]; then
        echo "Define PROXYCACHE-PROXY \"$https_proxy\"" >> /etc/mfd/apache2.conf.d/env.conf
    fi

    rm -f /etc/apt/sources.list
    rm -f /etc/apt/sources.list.d/*
    echo "deb http://127.0.0.1:8080/rdp/mfd-reposit/$BRANCH/deb/ noble main" > /etc/apt/sources.list.d/mfd.list

    systemctl restart mfd mfd-web apache2
fi

rm -r /tmp/mfd
