#!/bin/bash
# Copyright (C) 2016 Ian Kelling

# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at

#     http://www.apache.org/licenses/LICENSE-2.0

# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

[[ $EUID == 0 ]] || exec sudo -E "$BASH_SOURCE" "$@"

set -eE -o pipefail
trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR


usage() {
    cat <<EOF
Usage: ${0##*/} [OPTIONS] [EXTRA_SETTINGS_FILE] DOMAIN
Note: this is less tested and mature than the apache site script.

Setup nginx config with https using
ssl config provided by let's encrypt and my standard
location for storing certs.

EXTRA_SETTINGS_FILE can be - for stdin
-c CERT_DIR       In priority: this arg, $ACME_TINY_WRAPPER_CERT_DIR,
                  $HOME/webservercerts, if the other options aren't set.
-f [ADDR:]PORT    Enable proxy to [ADDR:]PORT. ADDR default is 127.0.0.1
-p PORT           Port to listen on, default 443
-r DIR            DocumentRoot
-h|--help         Print help and exit

TODO: add https redir site.

Note: Uses GNU getopt options parsing style
EOF
    exit $1
}

##### begin command line parsing ########

cert_dir="$ACME_TINY_WRAPPER_CERT_DIR"
if [[ ! $cert_dir ]]; then
    cert_dir=$HOME/webservercerts
fi
port=443
extra_settings=
temp=$(getopt -l help: c:f:p:r:h "$@") || usage 1
eval set -- "$temp"
while true; do
    case $1 in
        -c) cert_dir="$2"; shift 2 ;;
        -f) proxy="$2"; shift 2 ;;
        -p) port="$2"; shift 2 ;;
        -r) root="$2"; shift 2 ;;
        --) shift; break ;;
        -h|--help) usage ;;
        *) echo "$0: Internal error!" ; exit 1 ;;
    esac
done

if (( ${#@} == 2 )); then
    read -r extra_settings h <<<"${@}"
else
    read -r h <<<"${@}"
fi

if [[ ! $h ]]; then
    echo "$0: error: expected domain arg"
    usage 1
fi

if [[ ! $root ]]; then
    root=/var/www/$h/html
fi

if [[ $proxy ]]; then
    [[ $proxy == *:* ]] || proxy=127.0.0.1:$proxy
fi


##### end command line parsing ########

rm -f /etc/nginx/sites-enabled/default

if nginx -V |& grep -- '--with-http_v2_module\b' &>/dev/null; then
    http2_arg=http2
fi

echo "$0: creating /etc/nginx/sites-enabled/$h.conf"
cat >/etc/nginx/sites-enabled/$h.conf <<EOF
# ssecurty settings taken from
# https://mozilla.github.io/server-side-tls/ssl-config-generator/
# using modern config. last checked 2017/2/20
server {
    server_name $h www.$h;
    root $root;
    listen $port ssl $http2_arg;
    listen [::]:$port ssl $http2_arg;

    # certs sent to the client in SERVER HELLO are concatenated in ssl_certificate
    ssl_certificate $cert_dir/$h-chained.pem;
    ssl_certificate_key $cert_dir/$h-domain.key;
    ssl_session_timeout 1d;
    ssl_session_cache shared:SSL:50m;
    ssl_session_tickets off;

    # Diffie-Hellman parameter for DHE ciphersuites, recommended 2048 bits
    ssl_dhparam $cert_dir/dh2048.pem;

    # modern configuration. tweak to your needs.
    ssl_protocols TLSv1.2;
    ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';
    ssl_prefer_server_ciphers on;

    # HSTS (ngx_http_headers_module is required) (15768000 seconds = 6 months)
    add_header Strict-Transport-Security max-age=15768000;

    # OCSP Stapling ---
    # fetch OCSP records from URL in ssl_certificate and cache them
    ssl_stapling on;
    ssl_stapling_verify on;

    # ian: todo: something is missing here, stapling is not enabled
    # per ssllabs.com test. need to put root cert in chain?.
    # ssl labs still says we are A+.
    # https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_stapling
    ## verify chain of trust of OCSP response using Root CA and Intermediate certs
    ssl_trusted_certificate $cert_dir/$h-chained.pem;

    # ian: left commented out, our local dns is expected to work fine.
    #resolver <IP DNS resolver>;
EOF
if [[ $extra_settings ]]; then
    cat $extra_settings >>/etc/nginx/sites-enabled/$h.conf
fi

if [[ $proxy ]]; then
    cat >>/etc/nginx/sites-enabled/$h.conf <<EOF
    location / {
        proxy_set_header Host \$host;
        proxy_set_header X-Real-IP \$remote_addr;
        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Ssl on;
        proxy_set_header X-Forwarded-Port $port;
        proxy_pass http://$proxy;
    }
EOF
fi


cat >>/etc/nginx/sites-enabled/$h.conf <<EOF
}
EOF
mkdir -p /var/www/$h/html
chown -R ian:ian /var/www/$h
service nginx restart