#!/bin/bash

#########################################################################################
#
#  Copyright (c) 2015 arakasi72 (https://github.com/arakasi72)
#
#  --> Licensed under the MIT license: http://www.opensource.org/licenses/mit-license.php
#
#########################################################################################


serverip=$(ip route get 8.8.8.8 | awk 'NR==1 {print $NF}')
serverdn=$(perl -MSocket -le "print((gethostbyaddr(inet_aton('$serverip'), AF_INET))[0])")

# function to ask user for y/n response
ask_user(){
local answer
while true
  do
    read answer
    case $answer in [Yy]* ) return 0 ;;
                    [Nn]* ) return 1 ;;
                        * ) echo "Enter y or n";;
    esac
  done
}

# function to generate the ssl certificates
generate_certificate() {
echo "Generateing https/ssl certificates - $serverip - $serverdn"
openssl req -x509 -nodes -days 3650 -subj /CN=$serverip -config /etc/ssl/ruweb.cnf -newkey rsa:2048 -keyout /etc/ssl/private/ruweb.key -out /etc/ssl/ruweb.crt > /dev/null 2>&1

sed -i '/^\(\s\|#\)*rsa_private_key_file/ c\rsa_private_key_file=\/etc\/ssl\/private\/ruweb\.key' /etc/vsftpd.conf
sed -i '/^\(\s\|#\)*rsa_cert_file/ c\rsa_cert_file=\/etc\/ssl\/ruweb\.crt' /etc/vsftpd.conf
service vsftpd restart

sed -i '/ssl_certificate / c\        ssl_certificate \/etc\/ssl\/ruweb\.crt;' /etc/nginx/sites-available/default
sed -i '/ssl_certificate_key/ c\        ssl_certificate_key \/etc\/ssl\/private\/ruweb\.key;' /etc/nginx/sites-available/default
service nginx restart

echo "Done"
}

#check it is being run as root
if [ "$(id -u)" != "0" ]; then
  echo "Must be run from root or using sudo" && exit 1
fi

echo "IP: $serverip"
echo "DN: $serverdn"
echo -n "Continue y/n? "

if ! ask_user; then
  exit
fi

if [ -z "$(grep -s $serverip$ /etc/ssl/ruweb.cnf)" ]; then
  cp /etc/ssl/openssl.cnf /etc/ssl/ruweb.cnf
  echo >> /etc/ssl/ruweb.cnf
  echo "[ v3_ca ]" >> /etc/ssl/ruweb.cnf
  echo "subjectAltName = @alt_names" >> /etc/ssl/ruweb.cnf
  echo >> /etc/ssl/ruweb.cnf
  echo "[ alt_names ]" >> /etc/ssl/ruweb.cnf
  echo "IP.1 = $serverip" >> /etc/ssl/ruweb.cnf
  if [ ! -z "$serverdn" ]; then
    echo "DNS.1 = $serverdn" >> /etc/ssl/ruweb.cnf
  fi
  echo >> /etc/ssl/ruweb.cnf
  generate_certificate

elif [ ! -f /etc/ssl/ruweb.crt ] || [ ! -f /etc/ssl/private/ruweb.key ]; then
 generate_certificate

elif [ ! -z "$serverdn" ] && [ -z "$(grep -s $serverdn /etc/ssl/ruweb.cnf)" ]; then
  dnno=1
  until [ -z "$(grep "DNS.$dnno" /etc/ssl/ruweb.cnf)" ]
    do
      dnno=$(( $dnno + 1 ))
    done
  if [ $dnno = 1 ]; then
    sed -i "/\[ alt_names \]/ aDNS.$dnno = $serverdn" /etc/ssl/ruweb.cnf
  else
     sed  -i "/DNS.$(( $dnno - 1 ))/ aDNS.$dnno = $serverdn" /etc/ssl/ruweb.cnf
  fi
  generate_certificate

elif ! openssl x509 -checkend 31536000 -noout -in /etc/ssl/ruweb.crt; then
  generate_certificate

else
  echo -n "Certificates look ok, sure you want to generate new ones y/n? "
  if ask_user ; then
    generate_certificate
  fi
fi