#!/bin/bash

SCRIPT_VER="1.1"

APP="OpenVPN 2.6"
APP_CATEGORY="System Services"
APP_SCOPE="system"
APP_ENABLED="yes"
SYS_PKG_NAME="openvpn"
CONFLICTS="OpenVPN 2.4|OpenVPN 2.5"
STORED_PASSWORD_SERVICE="user"
SUPPORTED_ON="Ubuntu18.04,Ubuntu20.04"
LIBRARY="functions4.sh"

if [ "${SUPPORT-}" = '' ]; then
    SUPPORT="https://installers.rapidseedbox.com/scripts/whmcs_client_installers/support"
fi

LOGFILE="/var/log/whmcs_client_installers/${0}.log"
[ ! -d "/var/log/whmcs_client_installers" ] && mkdir -p "/var/log/whmcs_client_installers"

wget -4 -nc -q --no-check-certificate --timeout=20 --tries=5 ${SUPPORT}/${LIBRARY} >> "${LOGFILE}" 2>&1
if [ ! -f "./${LIBRARY}" ] ; then
    echo "55"
    echo "Error downloading \"${SUPPORT}/${LIBRARY}\"" >> "${LOGFILE}"
    exit 55
fi

# shellcheck source=support/functions4.sh
. "./${LIBRARY}"
SCRIPTENTRY

while : ; do

    main_rc=1

    CHECK_APP ; _rc=$?
    if [ ${_rc} -ne 0 ] ; then
        main_rc=${_rc}
        break
    fi

    # -- Remove old `openvpn` package
    if DPKG_CHECK "openvpn" ; then
        if [ -e "/etc/monit/conf.d/openvpn@rsb-server" ] ; then
            RM_FILES "/etc/monit/conf.d/openvpn@rsb-server"
            MONIT_RELOAD
        fi
        SVC_STOP       "openvpn@rsb-server"
        SVC_DISABLE    "openvpn@rsb-server"
        APT_REMOVE "openvpn"
        APT_AUTOREMOVE
    fi

    # -- Install new `openvpn` package
    if [ ! -d "/etc/apt/sources.list.d" ] ; then
        MKDIR "/etc/apt/sources.list.d" || break
    fi

    echo "deb http://build.openvpn.net/debian/openvpn/release/2.6 ${LSB_CODENAME} main" \
                > "/etc/apt/sources.list.d/openvpn26.list"
    if [ $? -ne 0 ] ; then
        ERROR "Error adding ${APP} repository!" ; break
    fi
    ADD_APT_KEY_URL "https://swupdate.openvpn.net/repos/repo-public.gpg" "openvpn.gpg"
    if [ $? -ne 0 ] ; then
        ERROR "Error adding ${APP} repository key!" ; break
    fi
    APT_UPDATE || break

    APT_INSTALL "openvpn" "easy-rsa" || break

    # Workaround for `openvpn-plugin-auth-pam.so` relocation to the plugins directory
    if [ ! -e "/usr/lib/openvpn/openvpn-plugin-auth-pam.so" ] ; then
        case "${LSB_VER}" in
          "Ubuntu18.04"|"Ubuntu20.04"|"Ubuntu22.04")
              _src="/usr/lib/x86_64-linux-gnu/openvpn/plugins/openvpn-plugin-auth-pam.so"
              ;;
          *)
              _src="/usr/lib/openvpn/plugins/openvpn-plugin-auth-pam.so"
              ;;
        esac
        if [ ! -e "${_src}" ] ; then
            ERROR "Could not find plugin: '${_src}'"
            break
        else
            [ -e "/usr/lib/openvpn" ] || MKDIR "/usr/lib/openvpn"
            LN "${_src}" \
                    "/usr/lib/openvpn/openvpn-plugin-auth-pam.so" \
                || break
        fi
    fi

    # -- Configure 
    WGET "${SUPPORT}/openvpn/openvpn-rsb-config.tar.gz" || break
    TAR_ZXF "${TMP_DIR}/openvpn-rsb-config.tar.gz" "/etc/" || break
    CHOWN_DIR  root:root "/etc/openvpn" || break
    CHOWN_FILE root:root "/etc/pam.d/openvpn" || break

    _iptables="$( which iptables )"
    _pid_dir="/var/run/openvpn"
    _pid_file="${_pid_dir}/rsb-server.pid"

    RUN_LOG "sed -i -e 's|iptables|${_iptables}|g' /etc/openvpn/rsb-server-up.sh" \
        || break
    RUN_LOG "sed -i -e 's|iptables|${_iptables}|g' /etc/openvpn/rsb-server-down.sh" \
        || break
    RUN_LOG "sed -i -e 's|venet0|${DEV}|g' /etc/openvpn/rsb-server-up.sh" \
        || break
    RUN_LOG "sed -i -e 's|venet0|${DEV}|g' /etc/openvpn/rsb-server-down.sh" \
        || break
    RUN_LOG "sed -i -e 's|^writepid\s*.*$|writepid ${_pid_file}|' /etc/openvpn/rsb-server.conf" \
        || break

    # -- Enable/start services
    if grep -e '^LimitNPROC=' "/lib/systemd/system/openvpn@.service" >> "${LOGFILE}" 2>&1 ; then
        sed -e 's|^\(LimitNPROC=.*\)$|#\1|' -i "/lib/systemd/system/openvpn@.service" >> "${LOGFILE}" 2>&1
    fi

    cat <<-'EOF' > "/etc/systemd/system/openvpn@.service"
	[Unit]
	Description=OpenVPN connection to %i
	PartOf=openvpn.service
	ReloadPropagatedFrom=openvpn.service
	Before=systemd-user-sessions.service
	Documentation=man:openvpn(8)
	Documentation=https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage
	Documentation=https://community.openvpn.net/openvpn/wiki/HOWTO

	[Service]
	PrivateTmp=true
	KillMode=mixed
	Type=forking
	ExecStart=/usr/sbin/openvpn --daemon ovpn-%i --status /run/openvpn/%i.status 10 --cd /etc/openvpn --script-security 2 --config /etc/openvpn/%i.conf --writepid /run/openvpn/%i.pid
	PIDFile=/run/openvpn/%i.pid
	ExecReload=/bin/kill -HUP $MAINPID
	WorkingDirectory=/etc/openvpn
	ProtectSystem=yes
	CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_READ_SEARCH CAP_AUDIT_WRITE
	#LimitNPROC=10
	DeviceAllow=/dev/null rw
	DeviceAllow=/dev/net/tun rw

	[Install]
	WantedBy=multi-user.target
	EOF

    SYSTEMD_RELOAD
    SVC_ENABLE  "openvpn@rsb-server"
    SVC_START   "openvpn@rsb-server"

    if [ -d "/etc/monit/conf.d" ] ; then
        cat <<-EOF > "/etc/monit/conf.d/openvpn@rsb-server"
		check process openvpn-rsb-server with pidfile /var/run/openvpn/rsb-server.pid
		  start program = "/usr/sbin/service openvpn@rsb-server restart"
		  stop  program = "/usr/sbin/service openvpn@rsb-server stop"
		  if 5 restarts with 5 cycles then timeout
		EOF
        MONIT_RELOAD
    fi


    main_rc=0
    break

done


# Cleanup if error
if [ ${main_rc} -ne 0 -a ${main_rc} -ne 111 -a ${main_rc} -ne 117 ] ; then
    if [ -e "/etc/monit/conf.d/openvpn@rsb-server" ] ; then
        RM_FILES "/etc/monit/conf.d/openvpn@rsb-server"
        MONIT_RELOAD
    fi
    SVC_STOP       "openvpn@rsb-server"
    SVC_DISABLE    "openvpn@rsb-server"
    APT_REMOVE "openvpn"
    RM_DIRS  "/etc/openvpn"
    RM_FILES "/etc/pam.d/openvpn"
    RM_FILES "/etc/apt/sources.list.d/openvpn26.list"
    APT_UPDATE
fi

SCRIPTEXIT