#!/bin/bash

SCRIPT_VER="1.9"

APP="VNC"
APP_CATEGORY="Remote Access"
APP_SCOPE="user"
APP_ENABLED="yes"
STORED_PASSWORD_SERVICE="vnc"
SUPPORTED_ON="CentOS7,CentOS8,CentOSStream8,Debian9,Debian10,Ubuntu16.04,Ubuntu18.04,Ubuntu20.04,Ubuntu22.04"
DAEMON_PORT=5901
LIBRARY="functions4.sh"

if [ "${SUPPORT-}" = '' ]; then
    SUPPORT="https://installers.rapidseedbox.com/scripts/whmcs_client_installers/support"
fi

LOGFILE="/var/log/whmcs_client_installers/${0}.log"
[ ! -d "/var/log/whmcs_client_installers" ] && mkdir -p "/var/log/whmcs_client_installers"

wget -4 -nc -q --no-check-certificate --timeout=20 --tries=5 ${SUPPORT}/${LIBRARY} >> "${LOGFILE}" 2>&1
if [ ! -f "./${LIBRARY}" ] ; then
    echo "55"
    echo "Error downloading \"${SUPPORT}/${LIBRARY}\"" >> "${LOGFILE}"
    exit 55
fi

# shellcheck source=support/functions4.sh
. "./${LIBRARY}"
SCRIPTENTRY

VALIDATE_USER

APP_DIRECTORY="${USERHOME}/.vnc"

while : ; do

    main_rc=1

    CHECK_APP ; _rc=$?
    if [ ${_rc} -ne 0 ] ; then
        main_rc=${_rc}
        break
    fi

    VNC_DISPLAY="$(( USERUID - FIRST_UID + 1 ))"
    VNC_PORT="$(( USERUID - FIRST_UID + 5901 ))"
    VNC_PID_FILE="${APP_DIRECTORY}/$( hostname ):${VNC_DISPLAY}.pid"

    if [ "${LSB_VENDOR}" = "CentOS" ] || [ "${LSB_VENDOR}" = "CentOSStream" ] ; then
        PKGS="tigervnc-server"
        VNCSERVER_ARGS="-depth 24 -geometry 1280x800"
        if ${PKG_CHECK} "gnome-session" ; then
            ${PKG_REMOVE} "gnome-session" || break
            ${PKG_AUTOREMOVE} || break
        fi
    elif [ "${LSB_VENDOR}" = "Debian" ] || [ "${LSB_VENDOR}" = "Ubuntu" ] ; then
        PKGS="tightvncserver"
        case "${LSB_CODENAME}" in
          "buster")
              VNCSERVER_ARGS="-depth 24 -geometry 1280x800"
              ;;
          *)
              VNCSERVER_ARGS="-depth 24 -geometry 1280x800 -basehttpport 5800"
              PKGS="${PKGS} tightvnc-java"
              ;;
        esac
    elif [ "${LSB_VENDOR}" = "Devuan" ] ; then
        PKGS="tightvncserver"
        VNCSERVER_ARGS="-depth 24 -geometry 1280x800 -basehttpport 5800"
    fi

    ${PKG_INSTALL} ${PKGS} || break

    MKDIR "${APP_DIRECTORY}"
    CHOWN_DIR "${USERNAME}":"${USERNAME}" "${APP_DIRECTORY}"
    RUN_LOG "su -l ${USERNAME} -c 'echo -n -e \"${USERPASSWORD}\n${USERPASSWORD}\n\" | vncpasswd' 2>&1"

    if [ "${SVC_SYSTEM}" = "init" ] ; then
        case "${LSB_VER}" in
          "Devuan1.0")
              WGET "${SUPPORT}/vncserver/vncserver.init.${LSB_VER}" \
                      "/etc/rc.d/init.d/vncserver-${USERNAME}"
              RUN_LOG "echo 's|###USERNAME###|${USERNAME}|g' | \
                      sed -i -f - '/etc/rc.d/init.d/vncserver-${USERNAME}' 2>&1"
              RUN_LOG "echo 's|###VNC_PORT###|${VNC_PORT}|g' | \
                      sed -i -f - '/etc/rc.d/init.d/vncserver-${USERNAME}' 2>&1"
              CHMOD_FILE 0755 "/etc/rc.d/init.d/vncserver-${USERNAME}"
              ;;
        esac
    elif [ "${SVC_SYSTEM}" = "systemd" ] ; then
        cat <<-EOF > /etc/systemd/system/vncserver-${USERNAME}.service
		[Unit]
		Description=Start VNC server at startup
		After=syslog.target network.target

		[Service]
		Type=forking
		User=${USERNAME}
		Group=${USERNAME}
		PIDFile=${APP_DIRECTORY}/%H:${VNC_DISPLAY}.pid
		ExecStartPre=-/usr/bin/vncserver -kill :${VNC_DISPLAY} > /dev/null 2>&1
		ExecStart=/usr/bin/vncserver ${VNCSERVER_ARGS} :${VNC_DISPLAY}
		ExecStop=/usr/bin/vncserver -kill :${VNC_DISPLAY}

		[Install]
		WantedBy=multi-user.target
		EOF

        SYSTEMD_RELOAD
        SVC_ENABLE "vncserver-${USERNAME}"
        SVC_START  "vncserver-${USERNAME}"
    fi

    # Configure firewall
    FW_OPEN_PORTS "${VNC_PORT}/tcp"

    # -- monit configs
    if [ -d "/etc/monit/conf.d" ] ; then
        cat <<-EOF > "/etc/monit/conf.d/vncserver-${USERNAME}" 2>> "${LOGFILE}"
	check process vncserver-${USERNAME} with pidfile "${VNC_PID_FILE}"
	  start program = "/usr/sbin/service vncserver-${USERNAME} restart"
	  stop program = "/usr/sbin/service vncserver-${USERNAME} stop"
	  if failed host localhost port ${VNC_PORT} type tcp then restart
	EOF
        MONIT_RELOAD
    fi

    # `fail2ban` setup
    # https://github.com/m0jo/fail2ban-tightvncserver
    if [ -d "/etc/fail2ban/filter.d" ] && [ -d "/etc/fail2ban/jail.d" ] ; then
        cat <<-EOF > "/etc/fail2ban/filter.d/tighvnc-auth.conf"
	# Fail2Ban configuration file for xtighvnc
	#
	# Author: m0jo
	#
	[Definition]
	failregex = authentication failed from <HOST>
	ignoreregex =
	EOF
        cat <<-EOF > "/etc/fail2ban/jail.d/tighvnc-${USERNAME}.conf"
	[tighvnc-auth-${USERNAME}]
	enabled = true
	port = ${VNC_PORT}
	filter = tighvnc-auth
	logpath = /home/${USERNAME}/.vnc/*.log
	#bantime = 86400
	#findtime = 3600
	bantime = 3600
	findtime = 600
	maxretry = 3
	EOF
        SVC_STATUS "fail2ban" && SVC_RESTART "fail2ban"
    else
        INFO "'fail2ban' config directories missing."
    fi



    main_rc=0
    break

done


SCRIPTEXIT