#!/bin/bash

SCRIPT_VER="1.3"

APP="Pure FTPd"
APP_CATEGORY="System Services"
APP_SCOPE="system"
APP_ENABLED="yes"
SYS_PKG_NAME="pure-ftpd"
STORED_PASSWORD_SERVICE="user"
SUPPORTED_ON="CentOS7,CentOS8,CentOSStream8,Debian9,Debian10,Ubuntu16.04,Ubuntu18.04,Ubuntu20.04,Ubuntu22.04"
LIBRARY="functions4.sh"

if [ "${SUPPORT-}" = '' ]; then
    SUPPORT="https://installers.rapidseedbox.com/scripts/whmcs_client_installers/support"
fi

LOGFILE="/var/log/whmcs_client_installers/${0}.log"
[ ! -d "/var/log/whmcs_client_installers" ] && mkdir -p "/var/log/whmcs_client_installers"

wget -4 -nc -q --no-check-certificate --timeout=20 --tries=5 ${SUPPORT}/${LIBRARY} >> "${LOGFILE}" 2>&1
if [ ! -f "./${LIBRARY}" ] ; then
    echo "55"
    echo "Error downloading \"${SUPPORT}/${LIBRARY}\"" >> "${LOGFILE}"
    exit 55
fi

# shellcheck source=support/functions4.sh
. "./${LIBRARY}"
SCRIPTENTRY

PURE_CFG_DIR="/etc/pure-ftpd"

__conf_dir () {
    local _key="${1}"
    local _value="${2}"
    local _rc=0

    RUN_LOG "echo '${_value}' > ${PURE_CFG_DIR}/conf/${_key}" \
            || _rc=1
    return ${_rc}
}

__conf_file () {
    local _key="${1}"
    local _value="${2}"
    local _rc=0

    if grep -q -E "^(#)?(\s*)?${_key}\s+" "${PURE_CFG_DIR}/pure-ftpd.conf" ; then
        RUN_LOG "sed -i -re 's|^#?\s*?${_key}\s+.*$|${_key} ${_value}|g' '${PURE_CFG_DIR}/pure-ftpd.conf'" \
            || _rc=1
    else
        RUN_LOG "echo '${_key} ${_value}' >> '${PURE_CFG_DIR}/pure-ftpd.conf'" \
            || _rc=1
    fi
    return ${_rc}
}

while : ; do

    main_rc=1 

    CHECK_APP ; _rc=$?
    if [ ${_rc} -ne 0 ] ; then
        main_rc=${_rc}
        break
    fi


    case "${LSB_VENDOR}" in
      "CentOS"|"CentOSStream")
          _pkglist="pure-ftpd"
          PURE_CONFIG="__conf_file"
          ;;
      "Debian"|"Ubuntu")
          _pkglist="ssl-cert update-inetd pure-ftpd"
          PURE_CONFIG="__conf_dir"
          ;;
    esac

    ${PKG_INSTALL} ${_pkglist} \
        || break

    # Enable root login
    if [ -e "/etc/ftpusers" ] ; then
        RUN_LOG "sed -i -e '/^root$/d' /etc/ftpusers" || break
    else
        RUN_LOG "touch /etc/ftpusers" || break
    fi
    ${PURE_CONFIG} "MinUID" "0" || break

    # Disable DNS reverse lookups upon connect
    ${PURE_CONFIG} "DontResolve" "0" || break

    # Enable both - TLS & Plain text
    ${PURE_CONFIG} "TLS" "1" || break

    # Enable ChrootEveryone
    ${PURE_CONFIG} "ChrootEveryone" "yes" || break

    # MaxClientsPerIP = 32
    ${PURE_CONFIG} "MaxClientsPerIP" "32" || break

    # Generate /etc/ssl/private/pure-ftpd-dhparams.pem
    RUN_LOG "openssl dhparam -out /etc/ssl/private/pure-ftpd-dhparams.pem 2048"

    # Symlink RSB certificate
    ln -svf rsb.pem "/etc/ssl/private/pure-ftpd.pem" || break

    # Virtual FTP users support preparation
    RUN_LOG "getent passwd ftpuser > /dev/null 2>&1" \
        || RUN_LOG "groupadd -g 2121 ftpgroup"
    RUN_LOG "getent group ftpgroup > /dev/null 2>&1" \
        || RUN_LOG "useradd -N -u 2121 -g ftpgroup -d /dev/null -s /etc ftpuser"

    # RSB scripts
    for __sc in \
      "addftpuser" \
      "addmultipleftpusers" \
      "changeftppass" \
      "enable-fxp" \
      "disable-fxp" \
      "ftpmgr" \
      "pure-disable-tls" \
      "pure-enable-tls"
    do
        if WGET "${SUPPORT}/rsb-scripts/common/${__sc}"
        then
            [ -e "/usr/local/bin/${__sc}" ] \
                && RM_FILES "/usr/local/bin/${__sc}"
            MV "${TMP_DIR}/${__sc}" "/usr/local/bin/${__sc}"
            CHOWN_FILE root:root "/usr/local/bin/${__sc}"
            CHMOD_FILE 755 "/usr/local/bin/${__sc}"
            LN "/usr/local/bin/${__sc}" "/usr/local/bin/rsb-${__sc}"
        fi
    done

    # Configure 'fail2ban'
    if [ -d "/etc/fail2ban/jail.d" ] ; then
        cat <<-EOF > "/etc/fail2ban/jail.d/pure-ftpd.conf"
	[pure-ftpd]
	enabled = true
	EOF
        SVC_STATUS "fail2ban" \
            && SVC_RESTART "fail2ban"
    fi

    # Configure 'logrotate'
    if [ -d "/etc/logrotate.d" ] ; then
        cat <<-EOF > "/etc/logrotate.d/pure-ftpd-configure"
	/var/log/pure-ftpd/configure.log {
	        weekly
	        missingok
	        rotate 7
	        compress
	        delaycompress
	        notifempty
	}
	EOF
    fi

    # Configure 'monit'
    if [ -d "/etc/monit/conf.d" ] ; then
        cat <<-EOF > "/etc/monit/conf.d/pure-ftpd"
	check process pure-ftpd with pidfile /var/run/pure-ftpd/pure-ftpd.pid
	  start program = "/bin/sh /etc/monit/scripts/start/pure-ftpd.start &"
	  stop program  = "/usr/sbin/service pure-ftpd stop &"
	  if failed port 21 protocol ftp then restart
	  if 5 restarts within 5 cycles then timeout
	EOF
        [ -d "/etc/monit/scripts/start" ] || MKDIR "/etc/monit/scripts/start"
        cat <<-EOF > "/etc/monit/scripts/start/pure-ftpd.start"
	#!/bin/sh

	/usr/bin/killall pure-ftpd 2> /dev/null
	/usr/sbin/service pure-ftpd restart
	EOF
        MONIT_RELOAD
    fi

    # Configure 'rsb.init.d' start script
    if [ -d "/etc/rsb.init.d" ] ; then
        cat <<-EOF > "/etc/rsb.init.d/pure-ftpd.sh"
	#!/bin/bash


	[ ! -d "/var/log/pure-ftpd" ] && mkdir -p "/var/log/pure-ftpd"
	LOGFILE="/var/log/pure-ftpd/configure.log"
	. "/usr/local/lib/rsb/functions.sh"


	# Configure Pure-ftpd

	SCRIPTENTRY

	FTPHOME="/home/ftpuser"

	if [ -d "\${FTPHOME}" ] ; then
	    RUN_LOG "find '\${FTPHOME}' \
	        -mindepth 1 \
	        -type d \
	        -name 'ftp*' \
	        -exec mount -o bind '\${FTPHOME}/public' '{}/public' \;"
	fi

	SCRIPTEXIT
	EOF
    fi

    # Restart the service to apply new changes
    SVC_RESTART "pure-ftpd"


    main_rc=0 
    break

done


SCRIPTEXIT