#!/bin/bash
# postinst script for jitsi-meet
#
# see: dh_installdeb(1)

set -e

# summary of how this script can be called:
#        * <postinst> `configure' <most-recently-configured-version>
#        * <old-postinst> `abort-upgrade' <new version>
#        * <conflictor's-postinst> `abort-remove' `in-favour' <package>
#          <new-version>
#        * <postinst> `abort-remove'
#        * <deconfigured's-postinst> `abort-deconfigure' `in-favour'
#          <failed-install-package> <version> `removing'
#          <conflicting-package> <version>
# for details, see http://www.debian.org/doc/debian-policy/ or
# the debian-policy package

case "$1" in
    configure)

        JVB_ETC_CONFIG="/etc/jitsi/videobridge/config"
        JVB_CONFIG="/usr/share/jitsi-videobridge/.sip-communicator/sip-communicator.properties"

        . $JVB_ETC_CONFIG

        # loading debconf
        . /usr/share/debconf/confmodule

        # detect dpkg-reconfigure
        RECONFIGURING="false"
        db_get jitsi-meet/jvb-hostname
        JVB_HOSTNAME_OLD=$RET
        if [ -n "$RET" ] && [ ! "$JVB_HOSTNAME_OLD" = "$JVB_HOSTNAME" ] ; then
            RECONFIGURING="true"
            rm -f /etc/jitsi/meet/$JVB_HOSTNAME_OLD-config.js
        fi

        JVB_SERVE="false"
        db_get jitsi-meet/jvb-serve
        if [ -n "$RET" ] && [ "$RET" = "true" ] ; then
            JVB_SERVE="true"
        fi

        # stores the hostname so we will reuse it later, like in purge
        db_set jitsi-meet/jvb-hostname $JVB_HOSTNAME

        NGINX_INSTALL_CHECK="$(dpkg-query -W -f '${PackageSpec}:${Status}\n' nginx 2>&1 | grep -v "ok installed" || :)"
        if [ -n "${NGINX_INSTALL_CHECK}" ]; then
            FORCE_NGINX="false"
        else
            FORCE_NGINX="true"
        fi

        # SSL for nginx
        db_get jitsi-meet/cert-choice
        CERT_CHOICE="$RET"
        UPLOADED_CERT_CHOICE="A certificate is available and the files are uploaded on the server"

        # jitsi meet
        JITSI_MEET_CONFIG="/etc/jitsi/meet/$JVB_HOSTNAME-config.js"
        if [ ! -f $JITSI_MEET_CONFIG ] ; then
            cp /usr/share/doc/jitsi-meet/config.js $JITSI_MEET_CONFIG
            sed -i "s/jitsi-meet.example.com/$JVB_HOSTNAME/g" $JITSI_MEET_CONFIG
        fi

        # this is new install let's configure jvb to serve meet
        if [[ -z $FORCE_NGINX && ( -z $JVB_HOSTNAME_OLD || "$JVB_SERVE" = "true" ) ]] ; then
            # this is a reconfigure, lets just delete old links
            if [ "$RECONFIGURING" = "true" ] ; then
                rm -f $JVB_CONFIG
            fi

            # configure jvb
            echo "AUTHBIND=yes" >> $JVB_ETC_CONFIG
            sed -i "s/JVB_OPTS=.*/JVB_OPTS=--apis=rest,xmpp/g" $JVB_ETC_CONFIG

            echo "org.jitsi.videobridge.rest.jetty.host=::" >> $JVB_CONFIG
            echo "org.jitsi.videobridge.rest.jetty.port=443" >> $JVB_CONFIG
            echo "org.jitsi.videobridge.rest.jetty.ProxyServlet.hostHeader=$JVB_HOSTNAME" >> $JVB_CONFIG
            echo "org.jitsi.videobridge.rest.jetty.ProxyServlet.pathSpec=/http-bind" >> $JVB_CONFIG
            echo "org.jitsi.videobridge.rest.jetty.ProxyServlet.proxyTo=http://localhost:5280/http-bind" >> $JVB_CONFIG
            echo "org.jitsi.videobridge.rest.jetty.ResourceHandler.resourceBase=/usr/share/jitsi-meet" >> $JVB_CONFIG
            echo "org.jitsi.videobridge.rest.jetty.ResourceHandler.alias./config.js=/etc/jitsi/meet/$JVB_HOSTNAME-config.js" >> $JVB_CONFIG
            echo "org.jitsi.videobridge.rest.jetty.RewriteHandler.regex=^/([a-zA-Z0-9]+)$" >> $JVB_CONFIG
            echo "org.jitsi.videobridge.rest.jetty.RewriteHandler.replacement=/" >> $JVB_CONFIG
            echo "org.jitsi.videobridge.rest.jetty.tls.port=443" >> $JVB_CONFIG
            echo "org.jitsi.videobridge.TCP_HARVESTER_PORT=443" >> $JVB_CONFIG
            echo "org.jitsi.videobridge.rest.jetty.sslContextFactory.keyStorePath=/etc/jitsi/videobridge/$JVB_HOSTNAME.jks" >> $JVB_CONFIG
            echo "org.jitsi.videobridge.rest.jetty.sslContextFactory.keyStorePassword=changeit" >> $JVB_CONFIG

            # configure authbind to allow jvb to bind to privileged ports
            OWNER=$(stat -c '%U' /usr/share/jitsi-videobridge)
            GROUP=$(stat -c '%G' /usr/share/jitsi-videobridge)
            JVB_UID="`id -u $OWNER`"
            if [ ! -f "/etc/authbind/byuid/$JVB_UID" ] ; then
                if [ ! -d "/etc/authbind/byuid" ] ; then
                        mkdir -p /etc/authbind/byuid
                        chmod 755 /etc/authbind
                        chmod 755 /etc/authbind/byuid
                fi
                echo '::,443' >/etc/authbind/byuid/$JVB_UID
                chown $OWNER:$GROUP /etc/authbind/byuid/$JVB_UID
                chmod 700 /etc/authbind/byuid/$JVB_UID
            fi

            if [ "$CERT_CHOICE" = "$UPLOADED_CERT_CHOICE" ] ; then
                # create jks from uploaded certs
                openssl pkcs12 -export \
                    -in /etc/ssl/$JVB_HOSTNAME.crt \
                    -inkey /etc/ssl/$JVB_HOSTNAME.key \
                    -passout pass:changeit > /etc/jitsi/videobridge/$JVB_HOSTNAME.p12
                keytool -importkeystore \
                    -srckeystore /etc/jitsi/videobridge/$JVB_HOSTNAME.p12 \
                    -destkeystore /etc/jitsi/videobridge/$JVB_HOSTNAME.jks \
                    -srcstoretype pkcs12 \
                    -noprompt -storepass changeit -srcstorepass changeit
            else
                # create jks from self-signed certs
                openssl pkcs12 -export \
                    -in /var/lib/prosody/$JVB_HOSTNAME.crt \
                    -inkey /var/lib/prosody/$JVB_HOSTNAME.key \
                    -passout pass:changeit > /etc/jitsi/videobridge/$JVB_HOSTNAME.p12
                keytool -importkeystore \
                    -srckeystore /etc/jitsi/videobridge/$JVB_HOSTNAME.p12 \
                    -destkeystore /etc/jitsi/videobridge/$JVB_HOSTNAME.jks \
                    -srcstoretype pkcs12 \
                    -noprompt -storepass changeit -srcstorepass changeit
            fi

            db_set jitsi-meet/jvb-serve "true"

            invoke-rc.d jitsi-videobridge restart
        elif [[ "$FORCE_NGINX" = "true" || ( -n $JVB_HOSTNAME_OLD && "$JVB_SERVE" = "false" ) ]] ; then
            # this is a reconfigure, lets just delete old links
            if [ "$RECONFIGURING" = "true" ] ; then
                rm -f /etc/nginx/sites-enabled/$JVB_HOSTNAME_OLD.conf
                rm -f /etc/jitsi/meet/$JVB_HOSTNAME_OLD-config.js
            fi

            # nginx conf
            if [ ! -f /etc/nginx/sites-available/$JVB_HOSTNAME.conf ] ; then
                cp /usr/share/doc/jitsi-meet/jitsi-meet.example /etc/nginx/sites-available/$JVB_HOSTNAME.conf
                if [ ! -f /etc/nginx/sites-enabled/$JVB_HOSTNAME.conf ] ; then
                    ln -s /etc/nginx/sites-available/$JVB_HOSTNAME.conf /etc/nginx/sites-enabled/$JVB_HOSTNAME.conf
                fi
                sed -i "s/jitsi-meet.example.com/$JVB_HOSTNAME/g" /etc/nginx/sites-available/$JVB_HOSTNAME.conf
            fi

            if [ "$CERT_CHOICE" = "$UPLOADED_CERT_CHOICE" ] ; then
                db_set jitsi-meet/cert-path-key "/etc/ssl/$JVB_HOSTNAME.key"
                db_input critical jitsi-meet/cert-path-key || true
                db_go
                db_get jitsi-meet/cert-path-key
                CERT_KEY="$RET"
                db_set jitsi-meet/cert-path-crt "/etc/ssl/$JVB_HOSTNAME.crt"
                db_input critical jitsi-meet/cert-path-crt || true
                db_go
                db_get jitsi-meet/cert-path-crt
                CERT_CRT="$RET"
                # replace self-signed certificate paths with user provided ones
                CERT_KEY_ESC=$(echo $CERT_KEY | sed 's/\./\\\./g')
                CERT_KEY_ESC=$(echo $CERT_KEY_ESC | sed 's/\//\\\//g')
                sed -i "s/ssl_certificate_key\ \/var\/lib\/prosody\/.*key/ssl_certificate_key\ $CERT_KEY_ESC/g" \
                    /etc/nginx/sites-available/$JVB_HOSTNAME.conf
                CERT_CRT_ESC=$(echo $CERT_CRT | sed 's/\./\\\./g')
                CERT_CRT_ESC=$(echo $CERT_CRT_ESC | sed 's/\//\\\//g')
                sed -i "s/ssl_certificate\ \/var\/lib\/prosody\/.*crt/ssl_certificate\ $CERT_CRT_ESC/g" \
                    /etc/nginx/sites-available/$JVB_HOSTNAME.conf
            fi

            invoke-rc.d nginx reload
        fi

        # and we're done with debconf
        db_stop
    ;;

    abort-upgrade|abort-remove|abort-deconfigure)
    ;;

    *)
        echo "postinst called with unknown argument \`$1'" >&2
        exit 1
    ;;
esac

# dh_installdeb will replace this with shell code automatically
# generated by other debhelper scripts.

#DEBHELPER#

exit 0