#!/usr/bin/env bash

script_name="$(basename $(realpath $0))"
working_dir="$(dirname $(realpath $0))"

#conf_file="${working_dir}/conf/${script_name%%.*}.conf"
conf_file="${working_dir}/conf/keycloak.conf"

LOCK_DIR="/tmp/$(basename $0).$$.LOCK"
log_file="${LOCK_DIR}/${script_name%%.*}.log"

backup_date="$(date +%Y-%m-%d-%H%M)"

crontab_backup_file="${working_dir}/crontab-root-${backup_date}"


# ----------
# Base Function(s)
# ----------

clean_up() {

   # Perform program exit housekeeping
   rm -rf "$LOCK_DIR"
   blank_line
   exit $1
}

echononl(){
   if $terminal ; then
      echo X\\c > /tmp/shprompt$$
      if [ `wc -c /tmp/shprompt$$ | awk '{print $1}'` -eq 1 ]; then
         echo -e -n "   $*\\c" 1>&2
      else
         echo -e -n "   $*" 1>&2
      fi
      rm /tmp/shprompt$$
   fi
}

fatal(){
   if $terminal ; then
      echo ""
      echo -e "   [ \033[31m\033[1mFatal\033[m ] $*"
      echo ""
      echo -e "             \033[1mScript is canceled\033[m.."
      echo ""
   else
      echo ""
      echo -e "   [ Fatal ] $*"
      echo ""
      echo -e "             Script is canceled.."
      echo ""
   fi
   if [[ -f "${crontab_backup_file}" ]]; then
      echononl "Reenable previously saved crontab from '$(basename "${crontab_backup_file}")'.."
      crontab ${crontab_backup_file} > /dev/null  2>&1
      if [[ $? -eq 0 ]]; then
         echo_ok
         rm -f ${crontab_backup_file} > /dev/null  2>&11
      else
         echo_failed
         error "$(cat $log_file)"
      fi
   fi

   rm -rf $LOCK_DIR
   exit 1
}

error (){
   echo ""
   if $terminal ; then
      echo -e "   [ \033[31m\033[1mError\033[m ] $*"
   else
      echo "   [ Error ] $*"
   fi
   echo ""
}

warn (){
   echo ""
   if $terminal ; then
      echo -e "   [ \033[33m\033[1mWarning\033[m ] $*"
   else
      echo "   [ Error ] $*"
   fi
   echo ""
}

info (){
   if $terminal ; then
      echo ""
      if $terminal ; then
         echo -e "   [ \033[32m\033[1mInfo\033[m ]  $*"
      else
         echo "   [ Info ]  $*"
      fi
      echo ""
   fi
}


echo_ok() {
   if $terminal ; then
      echo -e "\033[85G[ \033[32mok\033[m ]"
   fi
}
echo_failed(){
   if $terminal ; then
      echo -e "\033[85G[ \033[1;31mfailed\033[m ]"
   fi
}
echo_skipped() {
   if $terminal ; then
      echo -e "\033[85G[ \033[33m\033[1mskipped\033[m ]"
   fi
}
echo_wait(){
   if $terminal ; then
      echo -en "\033[85G[ \033[5m\033[1m..\033[m ]"
   fi
}

trim() {
    local var="$*"
    var="${var#"${var%%[![:space:]]*}"}"   # remove leading whitespace characters
    var="${var%"${var##*[![:space:]]}"}"   # remove trailing whitespace characters
    echo -n "$var"
}

blank_line() {
   if $terminal ; then
      echo ""
   fi
}

detect_os () {

   if $(which lsb_release > /dev/null 2>&1) ; then

      DIST="$(lsb_release -i | awk '{print tolower($3)}')"
      DIST_VERSION="$(lsb_release -r | awk '{print tolower($2)}')"
      DIST_CODENAME="$(lsb_release -c | awk '{print tolower($2)}')"

      if [[ "$DIST" = "debian" ]]; then
         if $(echo "$DIST_VERSION" | grep -q '\.') ; then
            DIST_VERSION=$(echo "$DIST_VERSION" | cut --delimiter='.' -f1)
         fi
      fi

   elif [[ -e "/etc/os-release" ]]; then

      . /etc/os-release

      DIST=$ID
      DIST_VERSION=${VERSION_ID}

   fi

   # remove whitespace from DIST and DIST_VERSION
   DIST="${DIST// /}"
   DIST_VERSION="${DIST_VERSION// /}"

}

# Funktion zur Generierung eines zufälligen Zeichens aus einer gegebenen Zeichenmenge
random_char() {
    local chars="$1"
    echo -n "${chars:RANDOM%${#chars}:1}"
}

# Funktion zur Generierung eines zufälligen Strings mit den angegebenen Anforderungen
generate_random_string() {
    local length="$1"

    # Überprüfen, ob die Länge größer als 8 ist
    if [[ "$length" -le 8 ]]; then
        echo "Fehler: Die Länge muss größer als 8 Zeichen sein."
        return 1
    fi

    # Zeichenmengen
    local lower="abcdefghijklmnopqrstuvwxyz"
    local upper="ABCDEFGHIJKLMNOPQRSTUVWXYZ"
    local digits="0123456789"
    #local special="!@#$%^&*()_+-=[]{}|;:,.<>?/"
    local special="_+--//...."

    # Generiere mindestens ein Zeichen aus jeder Kategorie
    local random_string=$(random_char "$lower")
    random_string+=$(random_char "$upper")
    random_string+=$(random_char "$digits")
    random_string+=$(random_char "$special")
    random_string+=$(random_char "$special")

    # Fülle den Rest der Zeichenkette mit zufälligen Zeichen aus allen Kategorien
    local all_chars="$lower$upper$digits$special"
    for (( i=${#random_string}; i<length; i++ )); do
        random_string+=$(random_char "$all_chars")
    done

    # Mische die Zeichenkette, um die Reihenfolge der Zeichen zufällig zu machen
    random_string=$(echo "$random_string" | fold -w1 | shuf | tr -d '\n')

    # Ausgabe des generierten Strings
    echo "$random_string"
}



# ----------
# - Jobhandling
# ----------

# - Run 'clean_up' for signals SIGHUP SIGINT SIGTERM
# -
trap clean_up SIGHUP SIGINT SIGTERM

# - Create lock directory '$LOCK_DIR"
#
mkdir "$LOCK_DIR"


# ----------
# - Some checks ..
# ----------

# - Running in a terminal?
# -
if [[ -t 1 ]] ; then
   terminal=true
else
   fatal "Script must run in a terminal."
fi


# ==========
# - Begin Main Script
# ==========

# ----------
# - Headline
# ----------

if $terminal ; then
   echo ""
   echo -e "\033[1m----------\033[m"
   echo -e "\033[32m\033[1mRunning script \033[m\033[1m$script_name\033[32m .. \033[m"
   echo -e "\033[1m----------\033[m"
fi


# ----------
#  Read Configurations from $conf_file
# ----------

# - Give your default values here
# -
DEFAULT_FQHN_HOSTNAME="$(hostname -f)"

DEFAULT_KEYCLOAK_USER="keycloak"

DEFAULT_DB_NAME="keycloak"
DEFAULT_DB_USER="keycloak"

DEFAULT_KEYCLOAK_BASE_INSTALL_PATH="/opt"

DEFAULT_DB_TYPE="pgsql"

DEFAULT_MYSQL_CREDENTIAL_ARGS="-u root -S /run/mysqld/mysqld.sock"

# generate random password
regexp_digit="([23456789].*){2}"
regexp_special_char="([-_%+].*){2}"
regexp_not_alowed="([0ODl18B])"
LENGTH=16

while [ 1 ] ; do

   DEFAULT_DB_PASS="$(head -c 300 /dev/urandom | tr -cd 'a-zA-Z1-9\-_%' | head -c ${LENGTH})"

   # - Check Password
   # -
   if [[ "$DEFAULT_DB_PASS" =~ $regexp_not_alowed ]] ; then
      continue
   fi
   if [[ ! "$DEFAULT_DB_PASS" =~ $regexp_special_char ]] ; then
      continue
   fi
   if [[ ! "$DEFAULT_DB_PASS" =~ $regexp_digit ]] ; then
      continue
   fi

   break

done

blank_line
echononl "Read configuration '$(basename "${conf_file}")' .."
if [[ -f "$conf_file" ]]; then
   source "$conf_file" > ${log_file} 2>&1
   if [[ $? -ne 0 ]]; then
      echo_failed
      error "$(cat "$log_file")"
   else
      echo_ok
   fi
else
   echo_skipped
   warn "No configuration file '$conf_file' present.\n
               Loading default values.."
fi

[[ -n "${FQHN_HOSTNAME}" ]] && DEFAULT_FQHN_HOSTNAME="${FQHN_HOSTNAME}"

if [[ -n "$DB_TYPE" ]] ; then
   if [[ "${DB_TYPE,,}" = "postgres" ]] || [[ "${DB_TYPE,,}" = "postgresql" ]] || [[ "${DB_TYPE,,}" = "pgsql" ]] || [[ "${DB_TYPE,,}" = "psql" ]] ; then

      DEFAULT_DB_TYPE=pgsql

   elif [[ "${DB_TYPE,,}" = "mysql" ]] ; then

      DEFAULT_DB_TYPE=mysql

   else
      fatal "Wrong or empty Database Type (DB_TYPE) - must be 'mysql' or 'pgsql'."
   fi
fi

[[ -n "${DB_NAME}" ]] && DEFAULT_DB_NAME="${DB_NAME}"
[[ -n "${DB_USER}" ]] && DEFAULT_DB_NAME="${DB_USER}"
[[ -n "${DB_PASS}" ]] &&  DEFAULT_DB_PASS="${DB_PASS}"

[[ -n "${KEYCLOAK_USER}" ]] && DEFAULT_KEYCLOAK_USER="${KEYCLOAK_USER}"
if [[ -n "${KEYCLOAK_GROUP}" ]]; then
   DEFAULT_KEYCLOAK_GROUP="${KEYCLOAK_GROUP}"
else
   DEFAULT_KEYCLOAK_GROUP="$DEFAULT_KEYCLOAK_USER"
fi

[[ -n "${KEYCLOAK_BASE_INSTALL_PATH}" ]] && DEFAULT_KEYCLOAK_BASE_INSTALL_PATH="${KEYCLOAK_BASE_INSTALL_PATH}"

echo -e "\033[32m--\033[m"
echo ""
echo "Version Number of Keycloak Server to install"
echo ""
echo "   see: https://keycloak.org/downloads"
echo ""
echo ""
KEYCLOAK_VERSION=
while [ "X$KEYCLOAK_VERSION" = "X" ]
do
   echononl "KEYCLOAK Server Version: "
   read KEYCLOAK_VERSION
   if [ "X$KEYCLOAK_VERSION" = "X" ]; then
      echo -e "\n\t\033[33m\033[1mA Version number is required!\033[m\n"
   fi
done
DOWNLOAD_ARCHIVE="keycloak-${KEYCLOAK_VERSION}.tar.gz"
DOWNLOAD_URL="https://github.com/keycloak/keycloak/releases/download/${KEYCLOAK_VERSION}/${DOWNLOAD_ARCHIVE}"


KEYCLOAK_BASE_INSTALL_PATH=
echo ""
echo -e "\033[32m--\033[m"
echo ""
echo "Specify the base directory in which keycloak is to be installed."
echo ""
while [[ "X${KEYCLOAK_BASE_INSTALL_PATH}" = "X" ]]; do
   echononl "Base directory for keycloak installation [${DEFAULT_KEYCLOAK_BASE_INSTALL_PATH}]: "
   read KEYCLOAK_BASE_INSTALL_PATH
   if [[ "X${KEYCLOAK_BASE_INSTALL_PATH}" = "X" ]]; then
      KEYCLOAK_BASE_INSTALL_PATH="${DEFAULT_KEYCLOAK_BASE_INSTALL_PATH}"
   fi
   if [[ ! -d "${KEYCLOAK_BASE_INSTALL_PATH}" ]] ; then
      echo -e "\n\tGiven directory \033[33m\033[1m${KEYCLOAK_BASE_INSTALL_PATH}\033[m does not exist!.\n"
      KEYCLOAK_BASE_INSTALL_PATH=""
   fi
done
KEYCLOAK_INSTALL_DIR="${KEYCLOAK_BASE_INSTALL_PATH}/keycloak-${KEYCLOAK_VERSION}"

if [[ -h "${KEYCLOAK_BASE_INSTALL_PATH}/keycloak" ]] ; then
   OLD_INSTALL_DIR="$(realpath "${KEYCLOAK_BASE_INSTALL_PATH}/keycloak")"
   OLD_VERSION="$(basename "${OLD_INSTALL_DIR}" | sed "s/^keycloak-//")"
fi

echo ""
echo "--"
echo ""
echo "Enter user and group for Keycloak Service."
echo ""
KEYCLOAK_USER=
while [ "X${KEYCLOAK_USER}" = "X" ]
do
   echononl "KEYCLOAK user [${DEFAULT_KEYCLOAK_USER}]: "
   read KEYCLOAK_USER
   if [ "X${KEYCLOAK_USER}" = "X" ]; then
      KEYCLOAK_USER=$DEFAULT_KEYCLOAK_USER
   fi
done
KEYCLOAK_GROUP=
while [ "X${KEYCLOAK_GROUP}" = "X" ]
do
   echononl "KEYCLOAK group [$DEFAULT_KEYCLOAK_GROUP]: "
   read KEYCLOAK_GROUP
   if [ "X${KEYCLOAK_GROUP}" = "X" ]; then
      KEYCLOAK_GROUP=$DEFAULT_KEYCLOAK_GROUP
   fi
done


DB_TYPE=""
echo ""
echo -e "\033[32m--\033[m"
echo ""
echo "Choose Database Type"
echo ""
if [[ "$DEFAULT_DB_TYPE" = "mysql" ]]; then
   echo -e "\033[3G\033[37m\033[1m[1] MySQL\033[m"
else
   echo -e "\033[3G[1] MySQL"
fi
if [[ "$DEFAULT_DB_TYPE" = "pgsql" ]] ; then
   echo -e "\033[3G[2] \033[37m\033[1mPostgeSQL\033[m"
else
   echo -e "\033[3G[2] PostgeSQL"
fi
echo ""
echo "Type a number or press <RETURN> to choose highlighted value"
echo ""
echononl "Eingabe: "
while [ "$DB_TYPE" != "mysql" -a "$DB_TYPE" != "pgsql" ]; do
   read OPTION
   case $OPTION in
      1)
         DB_TYPE="mysql"
         ;;
      2)
         DB_TYPE="pgsql"
         ;;
     '') DB_TYPE=$DEFAULT_DB_TYPE
         ;;
      *)
         echo ""
         echo -e "\033[3GFalsche Eingabe ! [ 1 = MySQL ; 2 = PostgreSQL ] or type <RETURN>"
         echo ""
         echononl "Eingabe: "
         ;;
   esac
done


DB_NAME=
echo ""
echo -e "\033[32m--\033[m"
echo ""
echo "Enter Database Name used by Keycloak Service"
echo ""
if [[ -n "$DEFAULT_DB_NAME" ]]; then
   while [[ "X${DB_NAME}" = "X" ]]; do
      echononl "Database Name [${DEFAULT_DB_NAME}]: "
      read DB_NAME
      if [[ "X${DB_NAME}" = "X" ]]; then
         DB_NAME=$DEFAULT_DB_NAME
      fi
   done
else
   while [[ "X${DB_NAME}" = "X" ]]; do
      echononl "Database Name: "
      read DB_NAME
      if [[ "X${DB_NAME}" = "X" ]]; then
         echo -e "\n\t\033[33m\033[1m Database Name is reqired\033[m\n"
      fi
   done
fi

DB_USER=
echo ""
echo -e "\033[32m--\033[m"
echo ""
echo "Enter Database User used by Keycloak Service"
echo ""
if [[ -n "$DEFAULT_DB_USER" ]]; then
   while [[ "X${DB_USER}" = "X" ]]; do
      echononl "Database User [${DEFAULT_DB_USER}]: "
      read DB_USER
      if [[ "X${DB_USER}" = "X" ]]; then
         DB_USER=$DEFAULT_DB_USER
      fi
   done
else
   while [[ "X${DB_USER}" = "X" ]]; do
      echononl "Database User: "
      read DB_USER
      if [[ "X${DB_USER}" = "X" ]]; then
         echo -e "\n\t\033[33m\033[1m Database User is reqired\033[m\n"
      fi
   done
fi

DB_PASS=
echo ""
echo -e "\033[32m--\033[m"
echo ""
echo "Enter Database Password used by Keycloak Service"
echo ""
if [[ -n "$DEFAULT_DB_PASS" ]]; then
   while [[ "X${DB_PASS}" = "X" ]]; do
      echononl "Database Password [${DEFAULT_DB_PASS}]: "
      read DB_PASS
      if [[ "X${DB_PASS}" = "X" ]]; then
         DB_PASS=$DEFAULT_DB_PASS
      fi
   done
else
   while [[ "X${DB_PASS}" = "X" ]]; do
      echononl "Database Password: "
      read DB_PASS
      if [[ "X${DB_PASS}" = "X" ]]; then
         echo -e "\n\t\033[33m\033[1m Database Password is reqired\033[m\n"
      fi
   done
fi


if [[ "$DB_TYPE" = "mysql" ]] ; then

   [[ -n "${MYSQL_CREDENTIAL_ARGS}" ]] && DEFAULT_MYSQL_CREDENTIAL_ARGS="${MYSQL_CREDENTIAL_ARGS}"

   # Test database connection
   #
   if ! $(mysql ${DEFAULT_MYSQL_CREDENTIAL_ARGS} -N -s -e 'quit' > /dev/null 2>&1) ; then

      echo ""
      echo -e "\033[32m--\033[m"
      echo ""
      echo "Insert Database Credentials.."
      echo ""
   
      echo -e "   A string containing credentials to establish a database connection. This character string 
   can consist of username and password, but also of login information stored in the file system 
   or the database itself.
         
   Example: 
            
      \033[33m-u root -p'<password>'\033[m
      \033[33m--login-path=local\033[m
      \033[33m--login-path=mysql-5.7\033[m
      \033[33m--defaults-file=/usr/local/mysql/sys-maint.cnf\033[m
      \033[33m-u root -S /run/mysqld/mysqld.sock\033[m"

      echo ""

      echononl "Database Credentials: "
      read MYSQL_CREDENTIAL_ARGS
      while [ "X${MYSQL_CREDENTIAL_ARGS}" = "X" ] ; do
         echo -e "\n\t\033[33m\033[1mEingabe erforderlich.\033[m\n"
         echononl "Database Credentials: "
         read MYSQL_CREDENTIAL_ARGS
      done

   else

      MYSQL_CREDENTIAL_ARGS="${DEFAULT_MYSQL_CREDENTIAL_ARGS}"

   fi

   if ! $(mysql ${MYSQL_CREDENTIAL_ARGS} -N -s -e 'quit' > /dev/null 2>&1) ; then
      fatal "Connection to MySQL Service failed.!"
   fi

fi


FQHN_HOSTNAME=
echo ""
echo -e "\033[32m--\033[m"
echo ""
echo "Insert full qualified hostname for Keycloak Service"
echo ""
if [[ -n "${DEFAULT_FQHN_HOSTNAME}" ]]; then
   while [[ "X${FQHN_HOSTNAME}" = "X" ]]; do
      echononl "Full qualified hostname [${DEFAULT_FQHN_HOSTNAME}]: "
      read FQHN_HOSTNAME
      if [[ "X${FQHN_HOSTNAME}" = "X" ]]; then
         FQHN_HOSTNAME=$DEFAULT_FQHN_HOSTNAME
      fi
      if [[ ! ${FQHN_HOSTNAME} =~ \. ]]; then
         echo -e "\n\tGiven Host \033[33m\033[1m${FQHN_HOSTNAME}\033[m seems not to be a full qualified hostname.\n"
         FQHN_HOSTNAME=""
      fi
   done
else
   while [[ "X${FQHN_HOSTNAME}" = "X" ]]; do
      echononl "Full qualified hostname: "
      read FQHN_HOSTNAME
      if [[ "X${FQHN_HOSTNAME}" = "X" ]]; then
         echo -e "\n\t\033[33m\033[1mFull qualified hostname is reqired\033[m\n"
      fi
      if [[ ! ${FQHN_HOSTNAME} =~ \. ]]; then
         echo -e "\n\tGiven Host \033[33m\033[1m${FQHN_HOSTNAME}\033[m seems not to be a full qualified hostname.\n"
         FQHN_HOSTNAME=""
      fi
   done
fi
HOSTNAME="${FQHN_HOSTNAME%%.*}"


echo ""
echo ""
echo -e "\t\033[32mStart install script for Keycloak Service with the following parameters\033[m"
echo ""
echo -e "\t(New) Keycloak Server Version...: \033[33m\033[1m${KEYCLOAK_VERSION}\033[m"
echo ""
if [[ -n "${OLD_VERSION}" ]] ; then
   echo -e "\tCurrent (old) Keycloak Version..: ${OLD_VERSION}"
else
   echo -e "\tCurrent (old) Keycloak Version..: \033[33mkeycloak is currently NOT installed\033[m"
fi
echo ""
echo -e "\tFull qualified Hostname.........: ${FQHN_HOSTNAME}"
echo -e "\tHostname........................: ${HOSTNAME}"
echo ""
echo -e "\tKeycloak user...................: ${KEYCLOAK_USER}"
echo -e "\tKeycloak group..................: ${KEYCLOAK_GROUP}"
echo ""
echo -e "\tKeycloak base install dir.......: ${KEYCLOAK_BASE_INSTALL_PATH}"
echo -e "\tKeycloak install dir............: ${KEYCLOAK_INSTALL_DIR}"
echo ""
echo -e "\tDownload archive................: ${DOWNLOAD_ARCHIVE}"
echo -e "\tDownload URL....................: ${DOWNLOAD_URL}"
echo ""
if [[ "${DB_TYPE}" = "pgsql" ]] ; then
   echo -e "\tDatabase Type...................: PostgreSQL"
else
   echo -e "\tDatabase Type...................: MySQL"
fi
echo ""
if [[ "${DB_TYPE}" = "mysql" ]]; then
   echo -e "\tMYSQL_CREDENTIAL_ARGS...........: ${MYSQL_CREDENTIAL_ARGS}"
   echo ""
fi
echo -e "\tDatabase Name...................: ${DB_NAME}"
echo -e "\tDatabase User...................: ${DB_USER}"
echo -e "\tDatabase Password...............: ${DB_PASS}"
echo ""
echononl "einverstanden (yes/no): "
read OK
OK=${OK,,}
while [ "X$OK" != "Xyes" -a "X$OK" != "Xno" ]; do
   echononl "Wrong entry! [yes/no]: "
   read OK
   OK=${OK,,}
done
[ $OK = "yes" ] || fatal Repeat with other settings..

cat <<EOF > $conf_file
#--------------------------------------
# Settings for Keycloak Install scripts
#--------------------------------------

# FQHN_HOSTNAME
#
# The full qualified histname under which bbb service
# is available
#
# Defaults to full qualified hostname of the system
#
FQHN_HOSTNAME="${FQHN_HOSTNAME}"


# KEYCLOAK_USER
#
# The user under which Keycloak service is running.
#
# Defaults to: KEYCLOAK_USER="keycloak"
#
#KEYCLOAK_USER=""
KEYCLOAK_USER="${KEYCLOAK_USER}"


# KEYCLOAK_GROUP
#
# The group of the keycloak user.
#
#
#KEYCLOAK_GROUP=""
KEYCLOAK_GROUP="${KEYCLOAK_GROUP}"


# KEYCLOAK_BASE_INSTALL_PATH
#
# Base directora in which the keycloak installation lives.
#
# Defaults to: KEYCLOAK_BASE_INSTALL_PATH="/opt"
#
#KEYCLOAK_BASE_INSTALL_PATH="/opt"
KEYCLOAK_BASE_INSTALL_PATH="${KEYCLOAK_BASE_INSTALL_PATH}"


# DB_TYPE
#
# Type of Keycloak database
#
# Possible values are 'pgsql' (PostgeSQL) or 'mysql' (MySQL)
#
# Defaults to POSTFIX_DB_TYPE="pgsql"
#
# DB_TYPE="pgsql"
DB_TYPE="${DB_TYPE}"


# MYSQL_CREDENTIAL_ARGS
#
# Giving password on command line is insecure an sind mysql 5.5
# you will get a warning doing so.
#
# Reading username/password fro file ist also possible, using MySQL/MariaDB
# commandline parameter '--defaults-file'.
#
# Since Version 5.6, that method is considered as insecure.
# To avoid giving the password on command line, we use an
# encrypted option file
#
#    Create (encrypted) option file:
#    $ mysql_config_editor set --login-path=local --socket=/var/run/mysqld/mysqld.sock  --user=backup --password
#    $ Password:
#
#    Use of option file:
#    $ mysql --login-path=local ...
#
# Example
#    MYSQL_CREDENTIAL_ARGS="--login-path=local"
#    MYSQL_CREDENTIAL_ARGS="--defaults-file=/etc/mysql/debian.cnf" (Debian default)
#    MYSQL_CREDENTIAL_ARGS="--defaults-file=/usr/local/mysql/sys-maint.cnf"
#
#    # MariaDB 10.4.x
#    MYSQL_CREDENTIAL_ARGS="-u root -S /tmp/mysql.sock"
#
# Defaults to MYSQL_CREDENTIAL_ARGS="-u root -S /tmp/mysql.sock"
#
#MYSQL_CREDENTIAL_ARGS="--login-path=local"
EOF
if [[ "${DB_TYPE}" = "mysql" ]]; then
   cat <<EOF >> ${conf_file}
MYSQL_CREDENTIAL_ARGS="${MYSQL_CREDENTIAL_ARGS}"
EOF
fi

cat <<EOF >> ${conf_file}


# DB_NAME
#
# Database Name of Mattemost's Database
#
# Defaults to: DB_NAME="keycloak"
#
#DB_NAME="keycloak"
DB_NAME="${DB_NAME}"

# DB_USER
#
# Database USER of Mattemost's Database
#
# Defaults to: DB_USER="keycloak"
#
#DB_USER="keycloak"
DB_USER="${DB_USER}"


# DB_PASS
#
# Database Password used for Mattemost's Database
#
# Defaults to a random created one.
#
#DB_PASS=""
DB_PASS="${DB_PASS}"

EOF


echo
echo -e "\033[37m\033[1mSome checks....\033[m"
echo

_failed=false
echononl "Check if Nginx Webservice is installed.."
if $(dpkg -s nginx-extras > "$log_file" 2>&1) ; then
   nginx_installed=true
elif $(dpkg -s nginx-full > "$log_file" 2>&1) ; then
   nginx_installed=true
else
   nginx_installed=false
fi
if $nginx_installed ; then
   echo -e "\033[85G[ \033[32mYES\033[m ]"
else
   echo -e "\033[85G[ \033[1;31mNOT installed\033[m ]"

   echo ""
   echononl "\033[1mcontinue anyway\033[m [yes/no]: "
   read OK
   while [[ "${OK,,}" != "yes" ]] && [[  "${OK,,}" != "no" ]] ; do
      echononl "Wrong entry! - repeat [yes/nno]: "
      read OK
   done
   [[ $OK = "yes" ]] || fatal "Abbruch durch User"
   blank_line
fi


_failed=false
echononl "Check if OpenJDK is installed.."
if $(dpkg -s default-jdk > "$log_file" 2>&1) ; then
   java_jdk_installed=true
elif $(dpkg -s default-jre > "$log_file" 2>&1) ; then
   java_installed=true
else
   java_installed=false
fi
if $java_installed ; then
   echo -e "\033[85G[ \033[32mYES\033[m ]"
else
   echo -e "\033[85G[ \033[1;31mNOT installed\033[m ]"

   echo ""
   echononl "\033[1mcontinue anyway\033[m [yes/no]: "
   read OK
   while [[ "${OK,,}" != "yes" ]] && [[  "${OK,,}" != "no" ]] ; do
      echononl "Wrong entry! - repeat [yes/nno]: "
      read OK
   done
   [[ $OK = "yes" ]] || fatal "Abbruch durch User"
   blank_line
fi


_failed=false
if [[ "${DB_TYPE}" = "mysql" ]]; then
   echononl "Check if MySQL Database Service is installed.."
   if $(dpkg -s mysql-server > "$log_file" 2>&1) ; then
      database_service_installed=true
   else
      database_service_installed=false
   fi
   if ${database_service_installed} ; then
      echo -e "\033[85G[ \033[32mYES\033[m ]"
   else
      echo -e "\033[85G[ \033[1;31mNOT installed\033[m ]"

      echo ""
      echononl "\033[1mcontinue anyway\033[m [yes/no]: "
      read OK
      while [[ "${OK,,}" != "yes" ]] && [[  "${OK,,}" != "no" ]] ; do
         echononl "Wrong entry! - repeat [yes/nno]: "
         read OK
      done
      [[ $OK = "yes" ]] || fatal "Abbruch durch User"
      blank_line
   fi
else
   echononl "Check if PostgreSQL Database Service is installed.."
   if $(dpkg -s postgresql > "$log_file" 2>&1) ; then
      database_service_installed=true
   else
      database_service_installed=false
   fi
   if ${database_service_installed} ; then
      echo -e "\033[85G[ \033[32mYES\033[m ]"
   else
      echo -e "\033[85G[ \033[1;31mNOT installed\033[m ]"

      echo ""
      echononl "\033[1mcontinue anyway\033[m [yes/no]: "
      read OK
      while [[ "${OK,,}" != "yes" ]] && [[  "${OK,,}" != "no" ]] ; do
         echononl "Wrong entry! - repeat [yes/nno]: "
         read OK
      done
      [[ $OK = "yes" ]] || fatal "Abbruch durch User"
      blank_line
   fi
fi



_failed=false
echononl "Check if certificate for '${FQHN_HOSTNAME}' is present.."
if [[ -d "/var/lib/dehydrated/certs/${FQHN_HOSTNAME}" ]] ; then
   if [[ -h "/var/lib/dehydrated/certs/${FQHN_HOSTNAME}/fullchain.pem" ]]; then
      cert_present=true
   else
      cert_present=false
   fi
else
   cert_present=false
fi
if $cert_present ; then
   echo -e "\033[85G[ \033[32mYES\033[m ]"
else
   echo -e "\033[85G[ \033[1;31mNOT present\033[m ]"
fi

if ! ${nginx_installed} || ! ${database_service_installed} || ! ${java_installed} ; then

   fatal "Prerequisites are a correct installation of the NGINX Web Service as well
             as a correct installation of the ${DB_TYPE} database service. Also Java
             is needed (recommended: OpenJDK 17 or 21)

             It's also highly recommended to have a valid certificate for your
             FQHN Hostname '${FQHN_HOSTNAME}'."

elif ! ${cert_present} ; then

   warn "It is highly recommended to have a valid certificate for your FQHN Hostname '${FQHN_HOSTNAME}'."

   echononl "\033[1mcontinue anyway\033[m [yes/no]: "
   read OK
   OK="$(echo "$OK" | tr '[:upper:]' '[:lower:]')"
   while [[ "$OK" != "yes" ]] && [[  "$OK" != "no" ]] ; do
      echononl "Wrong entry! - repeat [yes/nno]: "
      read OK
   done
   [[ $OK = "yes" ]] || fatal "Abbruch durch User"

fi


echo
echo -e "\033[37m\033[1mSome pre-installation stuff..\033[m"
echo

cron_root_is_empty=false
echononl "Backup crontab.."
if [[ $(crontab -u root -l 2> /dev/null | wc -c) -gt 0 ]] ; then
   crontab -u root -l > ${crontab_backup_file} 2> $log_file
   if [[ "$?" = "0" ]]; then
      echo_ok
   else
      echo_failed
      error "$(cat $log_file)"
   fi
else
   cron_root_is_empty=true
   echo_skipped
fi

echononl "Disable crontab for user root"
if ! ${cron_root_is_empty} ; then
   crontab -r -u root > ${log_file}  2>&1
   if [[ "$?" = "0" ]]; then
      echo_ok
   else
      echo_failed
      error "$(cat $log_file)"
   fi
else
   echo_skipped
fi

blank_line

echononl "Stop Keycloak Service.."
if $(systemctl is-active --quiet service keycloak.service) ; then
   systemctl stop keycloak.service > "$log_file" 2>&1
   if [[ $? -ne 0 ]]; then
      echo_failed
      error "$(cat "$log_file")"
   else
      echo_ok
   fi
else
   echo_skipped
fi

blank_line

if [[ "${DB_TYPE}" = "mysql" ]] ; then

   #echononl "Check if Database '${DB_NAME}' already exists.."
   #if $(mysql ${MYSQL_CREDENTIAL_ARGS} -e "use ${DB_NAME}" 2> /dev/null) ; then
   #   database_exists=true
   #else
   #   database_exists=false
   #fi

   echononl "Create MySQL Database User '${DB_USER}' with Password '${DB_PASS}'.."
   if [[ "$(mysql ${MYSQL_CREDENTIAL_ARGS}  -N -s -e \
            "SELECT EXISTS(SELECT 1 FROM mysql.user WHERE user = '${DB_USER}')" 2>/dev/null)" = 1 ]]; then
      echo_skipped
   else
      mysql ${MYSQL_CREDENTIAL_ARGS}  -N -s -e \
         "CREATE USER '${DB_USER}'@'localhost' IDENTIFIED BY '${DB_PASS}'" > "$log_file" 2>&1
      if [[ $? -ne 0 ]]; then
         echo_failed
         error "$(cat "$log_file")"
      else
         echo_ok
      fi
   fi

   echononl "Create MySQL Database '${DB_NAME}'.."
   if [[ "$(mysql ${MYSQL_CREDENTIAL_ARGS}  -N -s -e \
            "SHOW DATABASES LIKE '${DB_NAME}'" 2>/dev/null)" = "${DB_NAME}" ]]; then

      echo_skipped
   else
      mysql ${MYSQL_CREDENTIAL_ARGS}  -N -s -e "CREATE DATABASE ${DB_NAME}" > "$log_file" 2>&1
      if [[ $? -ne 0 ]]; then
         echo_failed
         error "$(cat "$log_file")"
      else
         echo_ok
      fi
   fi

   echononl "Grant access privileges to the user '${DB_USER}'’."
   mysql ${MYSQL_CREDENTIAL_ARGS}  -N -s -e \
      "GRANT ALL PRIVILEGES ON ${DB_NAME}.* to '${DB_USER}'@'localhost';" > "$log_file" 2>&1
   if [[ $? -ne 0 ]]; then
      echo_failed
      error "$(cat "$log_file")"
   else
      echo_ok
   fi

   echononl "FLUSH PRIVILEGES to dadabase engine .."
   mysql ${MYSQL_CREDENTIAL_ARGS}  -N -s -e \
      "FLUSH PRIVILEGES" > "$log_file" 2>&1
   if [[ $? -ne 0 ]]; then
      echo_failed
      error "$(cat "$log_file")"
   else
      echo_ok
   fi

else

   # Check if PostgreSQL database '$DB_NAME' exists ..
   #
   count=$(su - postgres -c "psql -q -A -t -l" | grep -c -e "^$DB_NAME")
   if [[ $count -eq 0 ]];then
      database_exists=false
   else
      database_exists=true
   fi

#   sudo -u postgres psql -c "CREATE DATABASE ${DB_NAME};" > $log_file 2>&1
#   sudo -u postgres psql -c "CREATE USER ${DB_USER} WITH PASSWORD '${DB_PASS}';" > $log_file 2>&1
#   sudo -u postgres psql -c "GRANT ALL PRIVILEGES ON DATABASE ${DB_NAME} to ${DB_USER};" > $log_file 2>&1
#   sudo -u postgres psql -c "ALTER DATABASE ${DB_NAME} OWNER TO ${DB_USER};" > $log_file 2>&1
#   sudo -u postgres psql -c "GRANT USAGE, CREATE ON SCHEMA PUBLIC TO ${DB_USER};" > $log_file 2>&1

   echononl "Create PostgreSQL database '${DB_NAME}'.."
   if ${database_exists} ; then
      echo_skipped


      echononl "Backup existing database '${DB_NAME}'"
      sudo -u postgres pg_dump -U postgres -d ${DB_NAME} \
         -f /tmp/${DB_NAME}-${OLD_VERSION}-${backup_date}.sql  > $log_file 2>&1
      if [[ $? -ne 0 ]] ; then
         echo_failed
         error "$(cat "$log_file")"

         echo ""
         echononl "\033[1mcontinue anyway\033[m [yes/no]: "
         read OK
         while [[ "${OK,,}" != "yes" ]] && [[  "${OK,,}" != "no" ]] ; do
            echononl "Wrong entry! - repeat [yes/nno]: "
            read OK
         done
         [[ $OK = "yes" ]] || fatal "Abbruch durch User"

      else
         echo_ok
      fi


      echononl "Move database backup file to folder '${KEYCLOAK_BASE_INSTALL_PATH}'.."
      mv "/tmp/${DB_NAME}-${OLD_VERSION}-${backup_date}.sql" "${KEYCLOAK_BASE_INSTALL_PATH}" > $log_file 2>&1
      if [[ $? -ne 0 ]] ; then
         echo_failed
         error "$(cat "$log_file")"

         echo ""
         echononl "\033[1mcontinue anyway\033[m [yes/no]: "
         read OK
         while [[ "${OK,,}" != "yes" ]] && [[  "${OK,,}" != "no" ]] ; do
            echononl "Wrong entry! - repeat [yes/nno]: "
            read OK
         done
         [[ $OK = "yes" ]] || fatal "Abbruch durch User"

      else
         echo_ok
      fi


      echononl "Empty Database '${DB_NAME}'"

      # Get a list of all tables in the database
      #
      db_tables=$(sudo -u postgres psql -U postgres -d ${DB_NAME} -t \
         -c "SELECT tablename FROM pg_tables WHERE schemaname = 'public';")  > $log_file 2>&1

      # Delete each table
      #
      : > $log_file
      _failed=false
      error_message="Errors deleting tables from database ${DB_NAME}:"
      for _table in ${db_tables} ; do
         sudo -u postgres psql -U postgres -d ${DB_NAME} -c "DROP TABLE IF EXISTS $_table CASCADE;"  >> $log_file 2>&1
         if [[ $? -ne 0 ]] ; then
            error_message+="\n              Unable to remove table ${_table} from database ${DB_NAME}"
            _failed=true
         fi
      done
      if ${_failed} ; then
         echo_failed
         error "$(echo -e "${error_message}"i)"

         echo ""
         echononl "\033[1mcontinue anyway\033[m [yes/no]: "
         read OK
         while [[ "${OK,,}" != "yes" ]] && [[  "${OK,,}" != "no" ]] ; do
            echononl "Wrong entry! - repeat [yes/nno]: "
            read OK
         done
         [[ $OK = "yes" ]] || fatal "Abbruch durch User"
      else
         echo_ok
      fi


      # Also delete all sequences, if available
      #
      : > $log_file
      _failed=false
      error_message="Errors deleting sequences from database ${DB_NAME}:"
      db_sequences=$(sudo -u postgres psql -U  postgres -d ${DB_NAME} -t \
         -c "SELECT sequence_name FROM information_schema.sequences WHERE sequence_schema = 'public';") > $log_file 2>&1

      for _sequence in ${db_sequences}; do
         sudo -u postgres psql -U postgres -d ${DB_NAME} \
            -c "DROP SEQUENCE IF EXISTS ${_sequence} CASCADE;" >> $log_file 2>&1
         if [[ $? -ne 0 ]] ; then
            error_message+="\n              Unable to remove sequence ${_sequence} from database ${DB_NAME}"
            _failed=true
         fi
      done

   else
      sudo -u postgres psql -c "CREATE DATABASE ${DB_NAME};" > $log_file 2>&1

      if [[ $? -ne 0 ]] ; then
         echo_failed
         error "$(cat "$log_file")"

         echo ""
         echononl "\033[1mcontinue anyway\033[m [yes/no]: "
         read OK
         while [[ "${OK,,}" != "yes" ]] && [[  "${OK,,}" != "no" ]] ; do
            echononl "Wrong entry! - repeat [yes/nno]: "
            read OK
         done
         [[ $OK = "yes" ]] || fatal "Abbruch durch User"

      else
         echo_ok
      fi

   fi


   declare -i _response
   _response="$(sudo -u postgres psql postgres -tAc "SELECT 1 FROM pg_roles WHERE rolname='${DB_USER}'" 2>/dev/null)"

   echononl "Create PostgreSQL database user ${DB_USER}.."

   if [[ ${_response} -eq 1 ]]; then
      echo_skipped


      echononl "Reset the Password for database user '${DB_USER}'.."
      sudo -u postgres psql -c "ALTER USER ${DB_USER} WITH PASSWORD '${DB_PASS}';" > $log_file 2>&1

      if [[ $? -ne 0 ]] ; then
         echo_failed
         error "$(cat "$log_file")"

         echo ""
         echononl "\033[1mcontinue anyway\033[m [yes/no]: "
         read OK
         while [[ "${OK,,}" != "yes" ]] && [[  "${OK,,}" != "no" ]] ; do
            echononl "Wrong entry! - repeat [yes/nno]: "
            read OK
         done
         [[ $OK = "yes" ]] || fatal "Abbruch durch User"

      else
         echo_ok
      fi

   else

      sudo -u postgres psql -c "CREATE USER ${DB_USER} WITH PASSWORD '${DB_PASS}';"  > $log_file 2>&1

      if [[ $? -ne 0 ]] ; then
         echo_failed
         error "$(cat "$log_file")"

         echo ""
         echononl "\033[1mcontinue anyway\033[m [yes/no]: "
         read OK
         while [[ "${OK,,}" != "yes" ]] && [[  "${OK,,}" != "no" ]] ; do
            echononl "Wrong entry! - repeat [yes/nno]: "
            read OK
         done
         [[ $OK = "yes" ]] || fatal "Abbruch durch User"

      else
         echo_ok
      fi
   fi


   echononl "Grant the user access to the Keycloak database.."

   sudo -u postgres psql -c "GRANT ALL PRIVILEGES ON DATABASE ${DB_NAME} to ${DB_USER};" > $log_file 2>&1

   if [[ $? -ne 0 ]] ; then
      echo_failed
      error "$(cat "$log_file")"

      echo ""
      echononl "\033[1mcontinue anyway\033[m [yes/no]: "
      read OK
      while [[ "${OK,,}" != "yes" ]] && [[  "${OK,,}" != "no" ]] ; do
         echononl "Wrong entry! - repeat [yes/nno]: "
         read OK
      done
      [[ $OK = "yes" ]] || fatal "Abbruch durch User"

   else
      echo_ok
   fi


   echononl "Change the owner of database '${DB_NAME}' to '${DB_USER}'.."

   sudo -u postgres psql -c "ALTER DATABASE ${DB_NAME} OWNER TO ${DB_USER};" > $log_file 2>&1

   if [[ $? -ne 0 ]] ; then
      echo_failed
      error "$(cat "$log_file")"

      echo ""
      echononl "\033[1mcontinue anyway\033[m [yes/no]: "
      read OK
      while [[ "${OK,,}" != "yes" ]] && [[  "${OK,,}" != "no" ]] ; do
         echononl "Wrong entry! - repeat [yes/nno]: "
         read OK
      done
      [[ $OK = "yes" ]] || fatal "Abbruch durch User"

   else
      echo_ok
   fi

   echononl "Grant access to objects contained in the specified schema.."

   sudo -u postgres psql -c "GRANT USAGE, CREATE ON SCHEMA PUBLIC TO ${DB_USER};" > $log_file 2>&1

   if [[ $? -ne 0 ]] ; then
      echo_failed
      error "$(cat "$log_file")"

      echo ""
      echononl "\033[1mcontinue anyway\033[m [yes/no]: "
      read OK
      while [[ "${OK,,}" != "yes" ]] && [[  "${OK,,}" != "no" ]] ; do
         echononl "Wrong entry! - repeat [yes/nno]: "
         read OK
      done
      [[ $OK = "yes" ]] || fatal "Abbruch durch User"

   else
      echo_ok
   fi

fi

blank_line

echononl "Create the Keycloak (system) group.."
if cat /etc/group | grep -e "^${KEYCLOAK_GROUP}:" > /dev/null  2>&1  ; then
   echo_skipped
else
   groupadd -r ${KEYCLOAK_GROUP} > "$log_file" 2>&1
   if [[ $? -ne 0 ]]; then
      echo_failed
      error "$(cat "$log_file")"
   else
      echo_ok
   fi
fi

echononl "Create the Keycloak (system) user.."
if id -u ${KEYCLOAK_USER} > /dev/null 2>&1; then
   echo_skipped
else
   useradd -r -M -d /opt/Keycloak -s /bin/false -g ${KEYCLOAK_GROUP} ${KEYCLOAK_USER} > "$log_file" 2>&1
   if [[ $? -ne 0 ]]; then
      echo_failed
      error "$(cat "$log_file")"
   else
      echo_ok
   fi
fi

blank_line

echononl "Download the latest version (${KEYCLOAK_VERSION}) of the Keycloak Server.."
if [[ ! -f "${working_dir}/${DOWNLOAD_ARCHIVE}" ]]; then
   wget -O "${working_dir}/${DOWNLOAD_ARCHIVE}" "${DOWNLOAD_URL}" > "$log_file" 2>&1
   if [[ $? -ne 0 ]]; then
      echo_failed
      error "$(cat "$log_file")"
   else
      echo_ok
   fi
else
   echo_skipped
fi


echo
echo -e "\033[37m\033[1mInstalling Keycloak Service..\033[m"
echo

echononl "Backup Keycloak Installation directory.."
if [[ -n "${OLD_INSTALL_DIR}" ]]; then
   mv "${OLD_INSTALL_DIR}" "${OLD_INSTALL_DIR}.${backup_date}" > "$log_file" 2>&1
   if [[ $? -ne 0 ]]; then
      echo_failed
      error "$(cat "$log_file")"
   else
      echo_ok
   fi
else
   echo_skipped
fi

echononl "Remove Symlink '${KEYCLOAK_BASE_INSTALL_PATH}/keycloak' .."
if [[ -h "${KEYCLOAK_BASE_INSTALL_PATH}/keycloak" ]] ; then
   rm "${KEYCLOAK_BASE_INSTALL_PATH}/keycloak"  > "$log_file" 2>&1
   if [[ $? -ne 0 ]]; then
      echo_failed
      error "$(cat "$log_file")"
   else
      echo_ok
   fi
else
   echo_skipped
fi


blank_line

echononl "Extract the Keycloak Service files.."
tar -C "${KEYCLOAK_BASE_INSTALL_PATH}" -xvzf "${working_dir}/${DOWNLOAD_ARCHIVE}" > "$log_file" 2>&1
if [[ $? -ne 0 ]]; then
   echo_failed
   error "$(cat "$log_file")"
else
   echo_ok
fi


blank_line

echononl "Symlink keycloak -> keycloak-${KEYCLOAK_VERSION} .."
ln -s "keycloak-${KEYCLOAK_VERSION}" "${KEYCLOAK_BASE_INSTALL_PATH}/keycloak" > "$log_file" 2>&1
if [[ $? -ne 0 ]]; then
   echo_failed
   error "$(cat "$log_file")"
else
   echo_ok
fi 

echononl "Backup original configuration file.."
mv "${KEYCLOAK_BASE_INSTALL_PATH}/keycloak/conf/keycloak.conf" \
   "${KEYCLOAK_BASE_INSTALL_PATH}/keycloak/conf/keycloak.conf.ORIG"
if [[ $? -ne 0 ]]; then
   echo_failed
   error "$(cat "$log_file")"
else
   echo_ok
fi 


echononl "Create new configuration .."
if [[ "${DB_TYPE}" = "pgsql" ]]; then
   _db_type="postgres"
   _db_url="jdbc:postgresql://localhost/${DB_NAME}"
else
   _db_type="mysql"
   _db_url="jdbc:mysql://localhost/${DB_NAME}?useSSL=false&allowPublicKeyRetrieval=true&characterEncoding=UTF-8"
fi
cat <<EOF > "${KEYCLOAK_BASE_INSTALL_PATH}/keycloak/conf/keycloak.conf" 2> "$log_file"
# ---------------------------------------------
# Configuration for KEYCLOAK Service
#     located: /opt/keycloak/conf/keycloak.conf
# ---------------------------------------------

# Database
db=${_db_type}
db-url=${_db_url}
db-username=${DB_USER}
db-password=${DB_PASS}

# Hostname v2
hostname=${FQHN_HOSTNAME}
hostname-strict=true

# HTTP(S)
http-enabled=true
http-host=127.0.0.1
http-port=8080
EOF
if ${_certs_installed} ; then
   cat <<EOF >> "${KEYCLOAK_BASE_INSTALL_PATH}/keycloak/conf/keycloak.conf" 2> "$log_file"
# HTTPS aktivieren
#https-port=8443
#https-certificate-file=/opt/keycloak/certs/${FQHN_HOSTNAME}.crt
#https-certificate-key-file=/opt/keycloak/certs/${FQHN_HOSTNAME}.key
EOF
else
   cat <<EOF >> "${KEYCLOAK_BASE_INSTALL_PATH}/keycloak/conf/keycloak.conf" 2> "$log_file"
# HTTPS aktivieren
#https-port=8443
#https-certificate-file=/opt/keycloak/certs/${FQHN_HOSTNAME}.crt
#https-certificate-key-file=/opt/keycloak/certs/${FQHN_HOSTNAME}.key
EOF
fi
cat <<EOF >> "${KEYCLOAK_BASE_INSTALL_PATH}/keycloak/conf/keycloak.conf" 2> "$log_file"

# Proxy
proxy-headers=xforwarded

# Admin CLI aktivieren
#admin-cli-enabled=true

EOF
if [[ $? -ne 0 ]]; then
   echo_failed
   error "$(cat "$log_file")"
else
   echo_ok
fi 


echo
echo -e "\033[37m\033[1mSetup Keycloak to use systemd for starting and stopping..\033[m"
echo

echononl "Create a systemd unit file.."
if [[ "${DB_TYPE}" = "pgsql" ]]; then
   cat <<EOF > /etc/systemd/system/keycloak.service 2>"$log_file"
[Unit]
Description=Keycloak Server
After=network.target postgresql.service
Requires=postgresql.service

[Service]
User=${KEYCLOAK_USER}
Group=${KEYCLOAK_GROUP}
ExecStart=${KEYCLOAK_BASE_INSTALL_PATH}/keycloak/bin/kc.sh start --optimized
#Environment="JAVA_OPTS=-Xms512m -Xmx1024m"
Restart=always
LimitNOFILE=102400

[Install]
WantedBy=multi-user.target
EOF
   if [[ $? -ne 0 ]]; then
      echo_failed
      error "$(cat "$log_file")"
   else
      echo_ok
   fi 
else
   cat <<EOF > /etc/systemd/system/keycloak.service 2>"$log_file"
[Unit]
Description=Keycloak Server
After=network.target postgresql.service
Requires=postgresql.service

[Service]
User=${KEYCLOAK_USER}
Group=${KEYCLOAK_GROUP}
ExecStart=${KEYCLOAK_BASE_INSTALL_PATH}/keycloak/bin/kc.sh start --optimized
Environment="JAVA_OPTS=-Xms512m -Xmx1024m"
Restart=always
LimitNOFILE=102400

[Install]
WantedBy=multi-user.target
EOF
   if [[ $? -ne 0 ]]; then
      echo_failed
      error "$(cat "$log_file")"
   else
      echo_ok
   fi 
fi


echononl "Make systemd load the new unit.."
systemctl daemon-reload > "$log_file" 2>&1
if [[ $? -ne 0 ]]; then
   echo_failed
   error "$(cat "$log_file")"
else
   echo_ok
fi

echononl "Set Keycloak Service to start on machine start up.."
systemctl enable keycloak.service > "$log_file" 2>&1
if [[ $? -ne 0 ]]; then
   echo_failed
   error "$(cat "$log_file")"
else
   echo_ok
fi

blank_line

_certs_installed=false
echononl "Run script 'check_cert_for_keycloak.sh'.."
if [[ -x "/root/bin/monitoring/check_cert_for_keycloak.sh" ]] ; then
   /root/bin/monitoring/check_cert_for_keycloak.sh > "$log_file" 2>&1
   if [[ $? -ne 0 ]]; then
      echo_failed
      cat "$log_file"
   else
      echo_ok
      _certs_installed=true
   fi
else
   warn "Certificate/Key for ${FQHN_HOSTNAME} cannot be provided."
fi

echononl "Add a cronjob for checking cert.."
if [[ -f "$crontab_backup_file" ]]; then
   if ! grep -iq -E "/root/bin/monitoring/check_cert_for_keycloak.sh" "$crontab_backup_file" > /dev/null 2>&1; then
      cat <<EOF >> $crontab_backup_file

# Check if cert for Keycloak service is up-to-date
#
51 05 * * * /root/bin/monitoring/check_cert_for_keycloak.sh
EOF
      if [[ "$?" -ne 0 ]] ; then
         echo_failed
      else
         echo_ok
      fi

   else
      echo_skipped
   fi

elif [[ -f "/var/spool/cron/crontabs/root" ]] ; then

   if ! grep -i -E "/root/bin/monitoring/check_cert_for_keycloak.sh" /var/spool/cron/crontabs/root > /dev/null 2>&1; then
      installation_failed=false
      crontab -l > /tmp/tmp_crontab 2> $log_file
      if [[ "$?" -ne 0 ]] ; then
         installation_failed=true
      fi

      cat << EOF >> /tmp/tmp_crontab 2>> $log_file

# Check if cert for Keycloak service is up-to-date
#
51 05 * * * /root/bin/monitoring/check_cert_for_keycloak.sh
EOF
      if [[ "$?" -ne 0 ]] ; then
         installation_failed=true
      fi
      crontab /tmp/tmp_crontab > /dev/null 2>> $log_file
      if [[ "$?" -ne 0 ]] ; then
         installation_failed=true
      fi
      rm /tmp/tmp_crontab  > /dev/null 2>> $log_file
      if [[ "$?" -ne 0 ]] ; then
         installation_failed=true
      fi
      if ! $installation_failed ; then
         echo_ok
      else
         echo_failed
         error "Adding cronjob for checking cert failed!"
      fi
   else
      echo_skipped
   fi
fi


blank_line

echononl "Genereate temporary admin user.."
export ADMIN_PASS="$(generate_random_string "16")"
/opt/keycloak/bin/kc.sh bootstrap-admin \
   user --username temp-admin \
   --password:env ADMIN_PASS  \
   --no-prompt > "$log_file" 2>&1
if [[ $? -ne 0 ]]; then
   echo_failed
   error "$(cat "$log_file")"
else
   echo_ok
fi

blank_line

echononl "Creates a new and optimized server image.."
${KEYCLOAK_BASE_INSTALL_PATH}/keycloak/bin/kc.sh build > "$log_file" 2>&1
if [[ $? -ne 0 ]]; then
   echo_failed
   error "$(cat "$log_file")"

   echononl "\033[1mcontinue anyway\033[m [yes/no]: "
   read OK
   while [[ "${OK,,}" != "yes" ]] && [[  "${OK,,}" != "no" ]] ; do
      echononl "Wrong entry! - repeat [yes/nno]: "
      read OK
   done
   [[ $OK = "yes" ]] || fatal "Abbruch durch User"

else
   echo_ok
fi

blank_line

echononl "Set ownbership of installation directory '${KEYCLOAK_INSTALL_DIR}'.."
chown -R ${KEYCLOAK_USER}:${KEYCLOAK_GROUP} "${KEYCLOAK_INSTALL_DIR}" > "$log_file" 2>&1
if [[ $? -ne 0 ]]; then
   echo_failed
   error "$(cat "$log_file")"
else
   echo_ok
fi

#echononl "Give write permissions to the keycloak group.."
#chmod -R g+w "${KEYCLOAK_INSTALL_DIR}" > "$log_file" 2>&1
#if [[ $? -ne 0 ]]; then
#   echo_failed
#   error "$(cat "$log_file")"
#else
#   echo_ok
#fi

blank_line

echononl "Start Keycloak Service"
systemctl start keycloak.service > "$log_file" 2>&1
if [[ $? -ne 0 ]]; then
   echo_failed
   error "$(cat "$log_file")"
else
   echo_ok
fi


echo ""
echo -e "\033[37m\033[1mConfiguring NGINX with SSL and HTTP/2..\033[m"
echo ""

echononl "Backup existing NGINX configuration.."
if [[ -f "/etc/nginx/sites-available/${FQHN_HOSTNAME}.conf" ]] ; then
   cp -a "/etc/nginx/sites-available/${FQHN_HOSTNAME}.conf" \
      "/etc/nginx/sites-available/${FQHN_HOSTNAME}.conf.${backup_date}" > "$log_file" 2>&1
   if [[ $? -ne 0 ]]; then
      echo_failed
      error "$(cat "$log_file")"
   else
      echo_ok
   fi
else
   echo_skipped
fi

echononl "NGINX virtual host configuration for '${FQHN_HOSTNAME}'.."
cat <<EOF > "/etc/nginx/sites-available/${FQHN_HOSTNAME}.conf" 2> "$log_file"
# -- ${FQHN_HOSTNAME} --

upstream kc_backend {
   server 127.0.0.1:8443;
   keepalive 32;
}

server {
    listen 80;
    listen [::]:80;
    server_name ${FQHN_HOSTNAME};

    return 301 https://$host$request_uri;
}

server {
   listen 443 ssl http2;
   listen [::]:443 ssl http2;

   server_name ${FQHN_HOSTNAME};

   # Include location directive for Let's Encrypt ACME Challenge
   #
   # Needed for (automated) updating certificate
   #
   include snippets/letsencrypt-acme-challenge.conf;

   ssl_certificate /var/lib/dehydrated/certs/${FQHN_HOSTNAME}/fullchain.pem;
   ssl_certificate_key /var/lib/dehydrated/certs/${FQHN_HOSTNAME}/privkey.pem;
   ssl_trusted_certificate /var/lib/dehydrated/certs/${FQHN_HOSTNAME}/chain.pem;

   # Diffie-Hellman parameter for DHE ciphersuites, recommended 2048 bits
   #
   # To generate a dhparam.pem file, run in a terminal
   #    openssl dhparam -dsaparam -out /etc/nginx/ssl/dhparam.pem 2048
   #
   ssl_dhparam /etc/nginx/ssl/dhparam.pem;

   # Enable TLS versions (TLSv1.3 is required upcoming HTTP/3 QUIC).
   ssl_protocols TLSv1.2 TLSv1.3;

   # Enable TLSv1.3's 0-RTT. Use \$ssl_early_data when reverse proxying to
   # prevent replay attacks.
   #
   # @see: https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_early_data
   ssl_early_data on;

   # ECDHE better than DHE (faster)  ECDHE & DHE GCM better than CBC (attacks on AES)
   # Everything better than SHA1 (deprecated)
   #
   ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';
   ssl_prefer_server_ciphers on;

   # Eable session resumption to improve https performance
   ssl_session_cache shared:SSL:50m;
   ssl_session_timeout 10m;
   ssl_session_tickets off;

   # HSTS (ngx_http_headers_module is required) (15768000 seconds = 6 months)
   #
   add_header Strict-Transport-Security max-age=15768000;

   # OCSP Stapling ---
   # fetch OCSP records from URL in ssl_certificate and cache them
   ssl_stapling on;
   ssl_stapling_verify on;

   #add_header X-Early-Data \$tls1_3_early_data;

   location / {
      proxy_pass http://localhost:8080;
      #proxy_pass https://localhost:8443;
      #proxy_pass https://kc_backend;
      proxy_set_header Host \$host;
      proxy_set_header X-Real-IP \$remote_addr;
      proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
      #proxy_set_header X-Forwarded-Host \$server_name;
      proxy_set_header X-Forwarded-Proto https;
      #proxy_set_header X-Forwarded-Proto \$scheme;
    }
}

EOF
if [[ $? -ne 0 ]]; then
   echo_failed
   error "$(cat "$log_file")"
else
   echo_ok
fi

echononl "Enable created configuration.."
if [[ ! -h "/etc/nginx/sites-enabled/${FQHN_HOSTNAME}.conf" ]]; then
   ln -s "../sites-available/${FQHN_HOSTNAME}.conf" \
      "/etc/nginx/sites-enabled/${FQHN_HOSTNAME}.conf"  > "$log_file" 2>&1
   if [[ $? -ne 0 ]]; then
      echo_failed
      error "$(cat "$log_file")"
   else
      echo_ok
   fi
else
   echo_skipped
fi

echononl "Restart NGINX Service.."
systemctl restart nginx  > "$log_file" 2>&1
if [[ $? -ne 0 ]]; then
   echo_failed
   error "$(cat "$log_file")"
else
   echo_ok
fi


echo
echo -e "\033[37m\033[1mSome post-installation stuff..\033[m"
echo

_cron_reenabled=false
echononl "Reenable previously saved crontab from '$(basename "${crontab_backup_file}")'.."
if [[ -f "${crontab_backup_file}" ]] ; then
   crontab ${crontab_backup_file} > $log_file 2>&1
   if [[ $? -eq 0 ]]; then
      echo_ok
      _cron_reenabled=true
   else
      echo_failed
      error "$(cat $log_file)"
   fi
else
   echo_skipped
fi

blank_line


echononl "Wait until the Keycloak service has started completely."
declare -i index=0
declare -i _max_secs_waiting=20
keycloak_service_started=false
while true ; do

   # Try to establish a connection to localhost:8080
   #
   if $(curl -s -o /dev/null -I http://localhost:8080) ; then
      echo_ok
      keycloak_service_started=true
      break
   fi
   if [[ ${index} -gt ${_max_secs_waiting} ]]; then
      echo_failed
      error "Could not connect to loacalhost on port 8080 after about 20 seconds!"
      break
   fi
   (( index++ ))
   sleep 1
done

echononl "Save configuration to file 'current-configuration.txt'."
${KEYCLOAK_BASE_INSTALL_PATH}/keycloak/bin/kc.sh show-config > "${working_dir}/current-configuration.txt" 2> "$log_file"
if [[ $? -ne 0 ]]; then
   echo_failed
   error "$(cat "$log_file")"
else
   echo_ok
fi

blank_line

_admin_user_created=true
echononl "Login as temporary admin user .."
if ${keycloak_service_started} ; then
   export KC_CLI_PASSWORD=${ADMIN_PASS}
   /opt/keycloak/bin/kcadm.sh config credentials \
      --server http://localhost:8080 \
      --realm master \
      --user temp-admin  > "$log_file" 2>&1
   if [[ $? -eq 0 ]]; then
      echo_ok
   else
      echo_failed
      _admin_user_created=false
      error "$(cat $log_file)"
   fi
else
   echo_skipped
fi

echononl "Create permanent user 'admin'.."
if ${_admin_user_created} ; then
   /opt/keycloak/bin/kcadm.sh create users \
      -r master \
      -s username=admin \
      -s enabled=true \
      -o --fields id,username > "$log_file" 2>&1
   if [[ $? -eq 0 ]]; then
      echo_ok
   else
      echo_failed 
      _admin_user_created=false
      error "$(cat $log_file)"
   fi 
else
   echo_skipped
fi

echononl "Set password for user 'admin'.."
if ${_admin_user_created} ; then
   NEW_ADMIN_PASS="$(generate_random_string "16")"
   /opt/keycloak/bin/kcadm.sh set-password --username admin --new-password ${NEW_ADMIN_PASS}
   if [[ $? -eq 0 ]]; then
      echo_ok
   else
      echo_failed 
      _admin_user_created=false
      error "$(cat $log_file)"
   fi 
else
   echo_skipped
fi

roles="admin create-realm uma_authorization offline_access"
for _role in ${roles} ; do

   echononl "Add Role '${_role}' to user 'admin'.."

   if ${_admin_user_created} ; then

      if ${keycloak_service_started} ; then
         /opt/keycloak/bin/kcadm.sh add-roles --uusername admin --rolename ${_role}
         if [[ $? -eq 0 ]]; then
            echo_ok
         else
            echo_failed 
            _admin_user_created=false
            error "$(cat $log_file)"
         fi 
      else
         echo_skipped
      fi
   
   else
      echo_skipped
   fi
done


blank_line

echononl "Remove previously saved crontab file '$(basename "${crontab_backup_file}")'.."
if ${_cron_reenabled} ; then
   rm "${crontab_backup_file}" > $log_file 2>&1
   if [[ $? -eq 0 ]]; then
      echo_ok
   else
      echo_failed
      error "$(cat $log_file)"
   fi
else
   echo_skipped
fi


blank_line

echononl "Save credentials for 'temp-admin' into file 'temporary-login-credentials.txt'.."
cat <<EOF > "${working_dir}/login-credentials-temp-admin.txt" 2> "$log_file"

   Login into new Keycloak Service:

      URL:        https://${FQHN_HOSTNAME}
      USER:       temp-admin
      PASSSWORD:  ${ADMIN_PASS}

EOF
if [[ $? -ne 0 ]]; then
   echo_failed
   error "$(cat "$log_file")"
else
   echo_ok
fi

info "Login into new Keycloak Service as temporary admin user:

             URL:       https://${FQHN_HOSTNAME}

             USER:      temp-admin
             PASSSWORD: ${ADMIN_PASS}

             see also:  ${working_dir}/login-credentials-temp-admin.txt
"

if ${_admin_user_created} ; then

   echononl "Save credentials for permanent admin into file 'login-credentials-admin.txt'.."
   cat <<EOF > "${working_dir}/login-credentials-admin.txt" 2> "$log_file"

   Login into new Keycloak Service:

      URL:        https://${FQHN_HOSTNAME}
      USER:       admin
      PASSSWORD:  ${NEW_ADMIN_PASS}

EOF

   if [[ $? -ne 0 ]]; then
      echo_failed
      error "$(cat "$log_file")"
   else
      echo_ok



      info "Login into new Keycloak Service as permanent admin user:

             URL:       https://${FQHN_HOSTNAME}

             USER:      admin
             PASSSWORD: ${NEW_ADMIN_PASS}

             see also:  ${working_dir}/login-credentials-admin.txt

"


   fi
else
   rm -r "${working_dir}/login-credentials-admin.txt" > /dev/null 2>&1
fi

clean_up 0