#!/bin/sh

# PROVIDE: bunkerweb_scheduler
# REQUIRE: LOGIN
# KEYWORD: shutdown

. /etc/rc.subr

name="bunkerweb_scheduler"
rcvar="bunkerweb_scheduler_enable"

load_rc_config "$name"

: ${bunkerweb_scheduler_enable:="NO"}
: ${bunkerweb_scheduler_logfile:="/var/log/bunkerweb/scheduler.log"}
: ${bunkerweb_scheduler_database_uri:="sqlite:////var/lib/bunkerweb/db.sqlite3"}

_bunkerweb_pythonpath="/usr/local/share/bunkerweb/common/gen:/usr/local/share/bunkerweb/common/utils:/usr/local/share/bunkerweb/common/db:/usr/local/share/bunkerweb/common/api:/usr/local/share/bunkerweb/deps/python"

pidfile="/var/run/bunkerweb/${name}.pid"
procname="%%PREFIX%%/bin/%%PYTHON_VERSION%%"
command="/usr/sbin/daemon"
command_args="-f -u www -p ${pidfile} -o ${bunkerweb_scheduler_logfile} /usr/bin/env PYTHONPATH=${_bunkerweb_pythonpath} %%PREFIX%%/bin/%%PYTHON_VERSION%% /usr/local/share/bunkerweb/scheduler/main.py"

bunkerweb_scheduler_precmd()
{
	mkdir -p /var/cache/bunkerweb/misc
	mkdir -p /usr/local/share/bunkerweb/misc
	mkdir -p /var/log/bunkerweb /var/run/bunkerweb

	if [ ! -f /var/cache/bunkerweb/misc/default-server-cert.pem ] || \
	   [ ! -f /var/cache/bunkerweb/misc/default-server-cert.key ]; then
		/usr/bin/openssl req -x509 -nodes -newkey rsa:2048 \
			-days 3650 \
			-subj "/CN=localhost" \
			-keyout /var/cache/bunkerweb/misc/default-server-cert.key \
			-out /var/cache/bunkerweb/misc/default-server-cert.pem >/dev/null 2>&1
	fi

	if [ ! -f /usr/local/share/bunkerweb/misc/root-ca.pem ] || \
	   [ ! -f /usr/local/share/bunkerweb/misc/root-ca.key ]; then
		/usr/bin/openssl req -x509 -nodes -newkey rsa:2048 \
			-days 3650 \
			-subj "/CN=BunkerWeb Root CA" \
			-keyout /usr/local/share/bunkerweb/misc/root-ca.key \
			-out /usr/local/share/bunkerweb/misc/root-ca.pem >/dev/null 2>&1
	fi

	chown -R www:www /var/cache/bunkerweb
	chmod 600 /var/cache/bunkerweb/misc/default-server-cert.key
	chmod 644 /var/cache/bunkerweb/misc/default-server-cert.pem

	chown root:www /usr/local/share/bunkerweb/misc/root-ca.key /usr/local/share/bunkerweb/misc/root-ca.pem
	chmod 640 /usr/local/share/bunkerweb/misc/root-ca.key
	chmod 644 /usr/local/share/bunkerweb/misc/root-ca.pem

	chown www:www /var/run/bunkerweb
	chown -R www:www /var/log/bunkerweb

	# The scheduler runs as the worker user: it writes the configuration that
	# the nginx worker replaces when the scheduler pushes it back.
	for _d in /var/lib/bunkerweb /var/tmp/bunkerweb /usr/local/etc/nginx /usr/local/etc/bunkerweb/configs \
	    /usr/local/etc/bunkerweb/plugins /usr/local/etc/bunkerweb/pro/plugins; do
		install -d -m 0750 -o www -g www "${_d}"
		chown -R www:www "${_d}"
	done

	# Upstream migrates the database from its systemd wrapper, which
	# FreeBSD does not use, so do it here before the scheduler starts.
	env PYTHONPATH="${_bunkerweb_pythonpath}" DATABASE_URI="${bunkerweb_scheduler_database_uri}" \
		%%PREFIX%%/bin/%%PYTHON_VERSION%% /usr/local/share/bunkerweb/common/db/freebsd-migrate.py
}

start_precmd="bunkerweb_scheduler_precmd"

run_rc_command "$1"