#!/bin/bash
#
# (c) 2019-2024 m-privacy GmbH
#
# Last change: ao, 05/Apr/2024
#

RED="\033[31;01m"
BLUE="\033[34;01m"
GREEN="\033[32;01m"
MAGENTA="\033[35;01m"
RESET="\033[00m"

ISOIMAGE="/srv/tftp/install/tightgate.iso"
MOUNTPOINT="/tmp/tgpromnt"

if test -z "$1"
then
	echo "Use: $0 number"
	echo "Create an rbd image tgpro\$number with size 50G"
	echo "using $ISOIMAGE"
	echo "e.g.: $0 1"
	exit
fi

TGNUM="$1"
case "$TGNUM" in
	[123456789])
		;;
	[123456789][0123456789])
		;;
	[123456789][0123456789][0123456789])
		;;
	*)
		echo -e "${RED}Number \"$TGNUM\" is not a number${RESET}"
		exit 1
esac

if ! test -e $ISOIMAGE
then
	echo -e "${RED}ISO image $ISOIMAGE not found${RESET}"
	exit 2
fi

TMPFILE=/tmp/tgpro-image-create.$$

if ! ceph osd pool ls | grep -q rbd
then
	echo -e "${BLUE}Create required pool rbd${RESET}"
	ceph osd pool create rbd 32
	echo -e "${MAGENTA}o--> ceph osd pool set rbd pg_autoscale_mode on${RESET}"
	ceph osd pool set rbd pg_autoscale_mode on
fi
rbd pool init rbd

if rbd ls | grep "^tgpro$TGNUM$"
then
	echo -e "${RED}Image tgpro$TGNUM already exists${RESET}"
	exit 3
fi

if rbd device list | grep -q "/dev/rbd0"
then
	echo -e "${RED}/dev/rbd0 is already mapped${RESET}"
	exit 4
fi

echo -e "${BLUE}Create rbd image tgpro$TGNUM with size 50G now${RESET}"
echo "Using ISO image $ISOIMAGE"
echo "Press return to continue or CTLR-C to abort"
read dummy

rbd create "tgpro$TGNUM" --size "50G" \
	--image-feature layering --image-feature striping \
	--image-feature exclusive-lock

echo -e "${BLUE}Images now:${RESET}"
rbd ls -l | grep -v '@'

if ! rbd map "tgpro$TGNUM"
then
	echo -e "${RED}Failed to map image tgpro$TGNUM${RESET}"
	exit 5
fi

ALLBLOCK=$(sfdisk -s /dev/rbd0 2>/dev/null)
if test -z "$ALLBLOCK"
then
	echo -e "${RED}Failed to get block count$TGNUM${RESET}"
	rbd unmap "tgpro$TGNUM"
	rbd rm "tgpro$TGNUM"
	exit 6
fi

echo -e "${BLUE}Create partitions, $ALLBLOCK KB${RESET}"

GB=1048576
ALIGN=8192
dd if=/dev/zero of=/dev/rbd0 bs=512 count=1 &>/dev/null
ALLBLOCK=$((2*$ALLBLOCK))

echo "# partition table of $DEV
${DEVPART}1 : start=$ALIGN, size=$((20*$GB-$ALIGN)), Id=83, bootable
${DEVPART}2 : start=$((20*$GB)), size=$((10*$GB)), Id=82
${DEVPART}3 : start=$((30*$GB)), size=$((20*$GB)), Id=83
${DEVPART}4 : start=$((50*$GB)), size=$(($ALLBLOCK-50*$GB)), Id=5
${DEVPART}5 : start=$((50*$GB+$ALIGN)), size=$((20*$GB-$ALIGN)), Id=83
${DEVPART}6 : start=$((70*$GB+$ALIGN)), size=$(($ALLBLOCK-70*$GB-$ALIGN)), Id=83" >$TMPFILE
# cat $TMPFILE
if ! sfdisk -f -q /dev/rbd0 < $TMPFILE
then
	echo -e "${RED}Failed to fdisk$TGNUM${RESET}"
	cat $TMPFILE
	rbd unmap "tgpro$TGNUM"
	rbd rm "tgpro$TGNUM"
	rm $TMPFILE
	exit 7
fi
rm $TMPFILE
for i in 1 2 3 5 6
do
	dd if=/dev/zero of=/dev/rbd0p$i bs=512 count=1 &>/dev/null
done
echo -e -n "${BLUE}Format ext4:${RESET}"
for i in 1 3 5 6
do
	echo -n " /dev/rbd0p$i"
	mke2fs -q -t ext4 /dev/rbd0p$i
done
echo ""
mkswap /dev/rbd0p2 >/dev/null

mkdir -p "$MOUNTPOINT"
mount -t ext4 -o discard /dev/rbd0p1 "$MOUNTPOINT"
mkdir "$MOUNTPOINT/var" "$MOUNTPOINT/home"
mount -t ext4 -o discard /dev/rbd0p3 "$MOUNTPOINT/var"
mkdir "$MOUNTPOINT/var/log"
mount -t ext4 -o discard /dev/rbd0p5 "$MOUNTPOINT/var/log"
mount -t ext4 -o discard /dev/rbd0p6 "$MOUNTPOINT/home"

mkdir -p /cdrom
mount -r -o loop $ISOIMAGE /cdrom

echo -e "${BLUE}Unpack Tar archive ($(($(stat -c '%s' /cdrom/tightgate*-nosrc*.tar.xz)/1048576)) MiB, left column), please be patient!${RESET}"
cd "$MOUNTPOINT"
if ! pxz --verbose -dc /cdrom/tightgate*-nosrc*.tar.xz | tar xpf -
then
	echo -e "${RED}Failed to unpack Tar archive${RESET}"
	cd
	umount "$MOUNTPOINT/home"
	umount "$MOUNTPOINT/var/log"
	umount "$MOUNTPOINT/var"
	umount "$MOUNTPOINT"
	umount /cdrom
	rbd unmap "tgpro$TGNUM"
	rbd rm "tgpro$TGNUM"
	rm -rf "$MOUNTPOINT"
	exit 8
fi
. etc/cu/general
test -z "$VENDORBRAND" && VENDORBRAND="TightGate-Pro"

echo -e -n "${BLUE}Create ssh host keys:${RESET}"
echo "exit 0" >etc/init.d/firewall
echo -n " dsa"
rm etc/ssh/ssh_host_dsa_key
ssh-keygen -t dsa -b 1024 -N "" -C "$VENDORBRAND" -f etc/ssh/ssh_host_dsa_key >/dev/null
echo -n " rsa"
rm etc/ssh/ssh_host_rsa_key
ssh-keygen -t rsa -b 4096 -N "" -C "$VENDORBRAND" -f etc/ssh/ssh_host_rsa_key >/dev/null
echo -n " ed25519"
rm etc/ssh/ssh_host_ed25519_key
ssh-keygen -t ed25519 -N "" -C "$VENDORBRAND" -f etc/ssh/ssh_host_ed25519_key >/dev/null
echo -n " ecdsa"
rm etc/ssh/ssh_host_ecdsa_key
ssh-keygen -t ecdsa -N "" -C "$VENDORBRAND" -f etc/ssh/ssh_host_ecdsa_key >/dev/null
echo ""

echo -e "${BLUE}Remove obsolete packages${RESET}"
chroot . dpkg -P kernel-tightgate-pro-p4-smp-64
chroot . dpkg -P mprivacy-rescue
chroot . dpkg -P grub2

rm -rf rsbac64.dat var/rsbac64.dat var/log/rsbac64.dat home/rsbac64.dat
mkdir -p -m 755 etc/cu/initialpw
touch etc/cu/initialpw/all
echo "CUSTATUSPASS=\"\"" >> etc/cu/netconfcluster
rm -f etc/rc*.d/K07networking
if grep -q "^/dev/.*swap" etc/fstab
then
	echo -e "${BLUE}Disable swap in fstab${RESET}"
	sed -i -e 's|^\(/dev/.*swap.*\)|#\1|g' etc/fstab
fi
sed -i -e 's|errors=remount-ro|errors=remount-ro,discard|g' -e 's|defaults|discard|g' -e 's|quota,noatime|quota,noatime,discard|g' etc/fstab

KEY="$(timeout 60 ceph auth get-key client.tgpro 2>/dev/null)"
if test -n "$KEY"
then
	echo "CUCEPHEXTHOMEUSERSECRET=\"$KEY\"" >> etc/cu/netconfcluster
fi

echo -e "${BLUE}Umount${RESET}"

cd
umount "$MOUNTPOINT/home"
umount "$MOUNTPOINT/var/log"
umount "$MOUNTPOINT/var"
umount "$MOUNTPOINT"
rbd unmap "tgpro$TGNUM"
umount /cdrom

rm -rf "$MOUNTPOINT"

if ! timeout 60 ceph auth get client.rbd &>/dev/null
then
	echo -e "${BLUE}Create Ceph user${RESET}"
	ceph auth get-or-create client.rbd mon 'profile rbd' osd 'allow rwx pool=rbd' -o /etc/ceph/ceph.client.rbd.keyring
fi

KEY="$(timeout 60 ceph auth get-key client.rbd 2>/dev/null)"
if test -n "$KEY" -a -e /srv/tftp/pxelinux.cfg/default.dist
then
	if ! test -e /srv/tftp/pxelinux.cfg/default
	then
		echo -e "${BLUE}Create /srv/tftp/pxelinux.cfg/default from .dist${RESET}"
		sed -e "s|+CEPHUSER+|rbd|g" -e "s|+CEPHPASS+|$KEY|g" < /srv/tftp/pxelinux.cfg/default.dist > /srv/tftp/pxelinux.cfg/default
	fi
fi
if test -n "$KEY" -a -e /srv/tftp/grub/grub.cfg.dist
then
	if ! test -e /srv/tftp/grub/grub.cfg
	then
		echo -e "${BLUE}Create /srv/tftp/grub/grub.cfg from .dist${RESET}"
		sed -e "s|+CEPHUSER+|rbd|g" -e "s|+CEPHPASS+|$KEY|g" < /srv/tftp/grub/grub.cfg.dist > /srv/tftp/grub/grub.cfg
	fi
fi

echo -e "${BLUE}Ready.${RESET}"
echo ""
echo "- Create a DHCP static host entry in /etc/dhcp/dhcpd.conf now."
echo "- Check user rbd and key from /etc/ceph/ceph.client.rbd.keyring at kernel"
echo "  parameters CEPHUSER and CEPHPASS and check parameters CEPHNET and CEPHMONS"
echo "  in /srv/tftp/pxelinux.cfg/default and /srv/tftp/grub/grub.cfg."
echo "- Adjust pool size and min_size values, if needed,"
echo "  Check: ceph osd pool get rbd [min_]size"
echo "  Set:   ceph osd pool set rbd [min_]size N"
echo "  Check: ceph osd pool get .mgr [min_]size"
echo "  Set:   ceph osd pool set .mgr [min_]size N"

exit 0
