#!/bin/bash
#
# Server setup procedure

serverUser=oper
servDeveloper=animus
projectDir=/opt/runway
projectGroup=teas

# Setup PROXY environment
bash ./proxy

# Configure BASH aliases
bash ./aliases

# Add needed packages
sudo apt -y install locales firewalld apt-transport-https ca-certificates curl gnupg lsb-release tcpdump unzip

# install zabbix agent
bash ./zabbix-agent

# install docker engine
bash ./docker

# Disable IPv6
echo -e "# Disabling the IPv6
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1
net.ipv6.conf.lo.disable_ipv6 = 1" sudo tee -a /etc/sysctl.conf > /dev/null
sudo update-initramfs -u

# Setup NTP client
bash ./ntp

sudo mkdir -p /etc/letsencrypt/docker_certs

# Configure firewall rules
bash ./firewall

# Update current user group membership and create supervisor account
sudo groupadd ${projectGroup}
userGroups="audio,video,tty,adm,cdrom,sudo,dip,plugdev,docker,${projectGroup}"
sudo usermod -a -G adm,docker,${projectGroup} $USER
sudo useradd -m -s /bin/bash -c "Server developer account" -g ${projectGroup} -G ${userGroups} ${servDeveloper}
echo "Enter password for developer account \"${servDeveloper}\": "
sudo passwd ${servDeveloper}
sudo useradd -m -s /bin/bash -c "Server operator account" -g ${projectGroup} -G ${userGroups} ${serverUser}
echo "Enter password for server operator account \"${serverUser}\": "
sudo passwd ${serverUser}

# Additiona user settings
echo "[ -f \$HOME/.bash_aliases ] && . \$HOME/.bash_aliases" | sudo tee -a /root/.bashrc > /dev/null
echo "[ -f \$HOME/.bash_aliases ] && . \$HOME/.bash_aliases" | sudo tee -a /home/${serverUser}/.bashrc > /dev/null
echo "[ -f \$HOME/.bash_aliases ] && . \$HOME/.bash_aliases" | sudo tee -a /home/${servDeveloper}/.bashrc > /dev/null
echo "[ -f \$HOME/.bash_aliases ] && . \$HOME/.bash_aliases" >> /$HOME/.bashrc
sudo ln -s /etc/bash.aliases /root/.bash_aliases
sudo ln -s /etc/bash.aliases /home/${serverUser}/.bash_aliases
sudo ln -s /etc/bash.aliases /home/${servDeveloper}/.bash_aliases
ln -s /etc/bash.aliases $HOME/.bash_aliases
sudo mkdir -m 775 -p ${projectDir}
sudo chown -R ${serverUser}:${projectGroup} ${projectDir}
sudo ln -s ${projectDir} /root/runway
sudo ln -s ${projectDir} /home/${serverUser}/runway
sudo ln -s ${projectDir} /home/${servDeveloper}/runway
ln -s ${projectDir} $HOME/

# superuser ssh key generation
sudo ssh-keygen -N '' -t ecdsa -C "$HOSTNAME superuser" -f /root/.ssh/id_ecdsa

# developer ssh key generation
sudo mkdir -p /home/${servDeveloper}/.ssh
sudo ssh-keygen -N '' -t ecdsa -C "$HOSTNAME developer" -f /home/${servDeveloper}/.ssh/id_ecdsa
sudo chmod 700 /home/${servDeveloper}/.ssh
sudo chown -R ${servDeveloper}:${projectGroup} /home/${servDeveloper}

# operator ssh key generation
sudo mkdir -p /home/${serverUser}/.ssh
sudo ssh-keygen -N '' -t ecdsa -C "$HOSTNAME operator" -f /home/${serverUser}/.ssh/id_ecdsa
sudo chmod 700 /home/${serverUser}/.ssh
sudo chown -R ${serverUser}:${projectGroup} /home/${serverUser}

# supervisor ssh key generation
ssh-keygen -N '' -t ecdsa -C "$HOSTNAME supervisor" -f $HOME/.ssh/id_ecdsa

# Add allowment for sudo user
echo -e "User_Alias ADMINS = %adm
Cmnd_Alias OPER_COMMANDS = /sbin/poweroff, /sbin/halt, /sbin/reboot, /usr/sbin/ntpdate, /bin/date
Cmnd_Alias SUPER_COMMANDS = /bin/systemctl, /sbin/ifconfig
ADMINS ALL=(ALL) ALL
ADMINS ALL=(ALL) NOPASSWD: OPER_COMMANDS
%${projectGroup} ALL=(ALL) PASSWD: SUPER_COMMANDS, OPER_COMMANDS" | sudo tee /etc/sudoers.d/${projectGroup} > /dev/null
sudo chmod 700 /etc/sudoers.d/${projectGroup}

sudo chown -R ${serverUser}:${projectGroup} ${projectDir}

# Create TEAS log directory
sudo mkdir -m 777 /var/log/${projectGroup}
