commander

#!/usr/bin/env bash

set -euo pipefail

LOGFILE=/logs/commander.log

err_report() {
    echo "ERROR! On line $1 in commander script"
}

trap 'err_report $LINENO' INT TERM ERR

dn=$(dirname $0)
source "$dn/utils.sh"

function wait_server() {
    local url="$1"

    local status=0
    local cnt=0

    set +e
    res=$(curl -o /dev/null -sSLk --head --write-out '%{http_code}\n' $url 2>&1)
    if [ $? -ne 0 ]; then
        echo -n $res
    fi
    set -e
    while [ $cnt -lt 40 ] && [ "$status" != "200" ]; do
        status=$(curl -o /dev/null -sSL --head --write-out '%{http_code}\n' $url 2>>$LOGFILE)
        let cnt=$cnt+1
        if [ "$status" != "200" ]; then
            sleep 5
        fi
    done
}


read txt
case $txt in
"docker-restart")
    cd /boulder
    COMPOSE_HTTP_TIMEOUT=120 docker-compose restart boulder bmysql bconsul labca nginx &>>$LOGFILE
    sleep 45
    wait_up $PS_MYSQL &>>$LOGFILE
    wait_up $PS_CONSUL 2 &>>$LOGFILE
    wait_up $PS_LABCA &>>$LOGFILE
    wait_up $PS_BOULDER $PS_BOULDER_COUNT &>>$LOGFILE
    ;;
"acme-request")
    wait_up $PS_BOULDER $PS_BOULDER_COUNT &>>$LOGFILE
    cd /etc/nginx/ssl
    [ -e account.key ] || openssl genrsa 4096 > account.key
    [ -e labca_key.pem ] || openssl genrsa 4096 > labca_key.pem
    san=$(openssl x509 -noout -text -in labca_cert.pem | grep DNS:)
    openssl req -new -utf8 -sha256 -key labca_key.pem -subj "/" -reqexts SAN -config <(cat /etc/ssl/openssl.cnf <(printf "[SAN]\nsubjectAltName=$san")) > domain.csr
    url=$(grep 'DEFAULT_DIRECTORY_URL =' /labca/acme_tiny.py | sed -e 's/.*=[ ]*//' | sed -e 's/\"//g')
    wait_server $url
    sleep 10
    /labca/renew
    ln -sf /labca/cron_d /etc/cron.d/labca
    ln -sf /labca/logrotate_d /etc/logrotate.d/labca
    ;;
"acme-change")
    read fqdn
    cd /etc/nginx/ssl
    openssl genrsa 4096 > labca_key.pem
    openssl req -new -utf8 -sha256 -key labca_key.pem -subj "/" -reqexts SAN -config <(cat /etc/ssl/openssl.cnf <(printf "[SAN]\nsubjectAltName=DNS:$fqdn")) > domain.csr
    url=$(grep 'DEFAULT_DIRECTORY_URL =' /labca/acme_tiny.py | sed -e 's/.*=[ ]*//' | sed -e 's/\"//g')
    wait_server $url
    sleep 10
    /labca/renew
    ;;
"nginx-remove-redirect")
    perl -i -p0e 's/\n    # BEGIN temporary redirect\n    location = \/ \{\n        return 302 \/admin\/;\n    }\n    # END temporary redirect\n//igs' /etc/nginx/conf.d/labca.conf
    ;;
"nginx-reload")
    cd /boulder
    docker-compose exec -T nginx nginx -s reload &>>$LOGFILE
    ;;
"nginx-restart")
    cd /boulder
    docker-compose restart nginx &>>$LOGFILE
    ;;
"log-cert")
    [ -f /etc/nginx/ssl/acme_tiny.log ] && tail -200 /etc/nginx/ssl/acme_tiny.log || /bin/true
    exit 0
    ;;
"log-commander")
    [ -f $LOGFILE ] && tail -200 $LOGFILE || /bin/true
    exit 0
    ;;
"log-control-notail")
    cd /boulder
    docker-compose logs --no-color --tail=50 control
    ;;
"log-cron")
    [ -f /logs/cron.log ] && tail -n200 -f /logs/cron.log || /bin/true
    exit 0
    ;;
"log-boulder")
    cd /boulder
    docker-compose logs -f --no-color --tail=50 boulder
    ;;
"log-boulder-notail")
    cd /boulder
    docker-compose logs --no-color --tail=50 boulder
    ;;
"log-audit")
    cd /boulder
    docker-compose logs --no-color boulder | grep "\[AUDIT\]" | grep -v "grpc: parseServiceConfig error unmarshaling  due to unexpected end of JSON input" | tail -50
    docker-compose logs -f --no-color --tail=0 boulder | grep "\[AUDIT\]"
    ;;
"log-activity")
    cd /boulder
    echo "GMT"
    docker-compose logs --no-color boulder | grep "\[AUDIT\]" | grep -v "grpc: parseServiceConfig error unmarshaling  due to unexpected end of JSON input" | tail -15
    exit 0
    ;;
"log-labca")
    cd /boulder
    docker-compose logs -f --no-color --tail=50 labca
    ;;
"log-labca-notail")
    cd /boulder
    docker-compose logs --no-color --tail=50 labca
    ;;
"log-web")
    cd /boulder
    docker-compose logs -f --no-color --tail=50 nginx
    ;;
"log-components")
    nginx=$(docker inspect $(docker ps --format "{{.Names}}" | grep -- -nginx-) | grep -i started | sed -e "s/[^:]*:\(.*\)/\1/" | sed -e "s/.*\"\(.*\)\".*/\1/")
    svc=$(docker inspect $(docker ps --format "{{.Names}}" | grep -- -control-) | grep -i started | sed -e "s/[^:]*:\(.*\)/\1/" | sed -e "s/.*\"\(.*\)\".*/\1/")
    boulder=$(docker inspect $(docker ps --format "{{.Names}}" | grep -- -boulder-) | grep -i started | grep -v depends_on | sed -e "s/[^:]*:\(.*\)/\1/" | sed -e "s/.*\"\(.*\)\".*/\1/")
    labca=$(docker inspect $(docker ps --format "{{.Names}}" | grep -- -labca-) | grep -i started | grep -v depends_on | sed -e "s/[^:]*:\(.*\)/\1/" | sed -e "s/.*\"\(.*\)\".*/\1/")
    mysql=$(docker inspect $(docker ps --format "{{.Names}}" | grep -- -bmysql-) | grep -i started | grep -v depends_on | sed -e "s/[^:]*:\(.*\)/\1/" | sed -e "s/.*\"\(.*\)\".*/\1/")
    consul=$(docker inspect $(docker ps --format "{{.Names}}" | grep -- -bconsul-) | grep -i started | sed -e "s/[^:]*:\(.*\)/\1/" | sed -e "s/.*\"\(.*\)\".*/\1/")
    echo "$nginx|$svc|$boulder|$labca|$mysql|$consul"
    exit 0
    ;;
"log-uptime")
    timezone=$(cat /etc/timezone)
    uptime=$(uptime -s)
    echo "$timezone|$uptime"
    exit 0
    ;;
"log-stats")
    docker stats --no-stream -a | grep " boulder-"
    ;;
"revoke-cert")
    read serial
    read reasonCode
    cd /boulder
    docker-compose exec -T boulder bin/admin-revoker serial-revoke --config labca/config/admin-revoker.json $serial $reasonCode 2>&1
    ;;
"test-email")
    read recipient
    cd /boulder
    docker-compose exec -T boulder bin/mail-tester --config labca/config/expiration-mailer.json $recipient 2>&1
    ;;
"boulder-start")
    cd /boulder
    COMPOSE_HTTP_TIMEOUT=120 docker-compose up -d bmysql bconsul
    wait_up $PS_MYSQL &>>$LOGFILE
    wait_up $PS_CONSUL 2 &>>$LOGFILE
    COMPOSE_HTTP_TIMEOUT=120 docker-compose up -d boulder
    wait_up $PS_BOULDER $PS_BOULDER_COUNT &>>$LOGFILE
    ;;
"boulder-stop")
    cd /boulder
    docker-compose stop boulder
    docker-compose stop bmysql bconsul
    wait_down $PS_MYSQL &>>$LOGFILE
    wait_down $PS_CONSUL &>>$LOGFILE
    wait_down $PS_BOULDER &>>$LOGFILE
    ;;
"boulder-restart")
    cd /boulder
    COMPOSE_HTTP_TIMEOUT=120 docker-compose restart boulder bmysql bconsul &>>$LOGFILE
    sleep 30
    wait_up $PS_MYSQL &>>$LOGFILE
    wait_up $PS_CONSUL 2 &>>$LOGFILE
    wait_up $PS_BOULDER $PS_BOULDER_COUNT &>>$LOGFILE
    ;;
"labca-restart")
    cd /boulder
    COMPOSE_HTTP_TIMEOUT=120 docker-compose restart labca
    sleep 15
    wait_up $PS_LABCA &>>$LOGFILE
    ;;
"mysql-restart")
    cd /boulder
    set +e
    COMPOSE_HTTP_TIMEOUT=120 docker-compose restart bmysql
    set -e
    ;;
"consul-restart")
    cd /boulder
    set +e
    COMPOSE_HTTP_TIMEOUT=120 docker-compose restart bconsul
    set -e
    ;;
"svc-restart")
    cd /boulder
    set +e
    COMPOSE_HTTP_TIMEOUT=120 docker-compose restart control
    set -e
    ;;
"log-backups")
    ls -1tr /backup || /bin/true
    exit 0
    ;;
"log-server-backup")
    /labca/backup
    exit 0
    ;;
"backup-delete")
    read backup
    rm -f /backup/$backup
    ;;
"backup-restore")
    read backup
    /labca/restore "$backup"
    ;;
"server-restart")
    cd /boulder
    nohup docker-compose restart labca & >/dev/null
    nohup docker-compose restart nginx & >/dev/null
    set +e
    nohup docker-compose restart control & >/dev/null
    set -e
    ;;
"version-update")
    cd $dn
    branch="$(git symbolic-ref --short HEAD 2>/dev/null)" || branch="(none)"
    if [ "$branch" == "master" ] || [ "$branch" == "main" ] || [ "$branch" == "(none)" ]; then
        nohup /labca/install &>>$LOGFILE
    else
        nohup /labca/install -b $branch &>>$LOGFILE
    fi
    ;;
*)
    echo "Unknown command '$txt'. ERROR!"
    exit 1
    ;;
esac

echo "ok"