#!/bin/bash

SCRIPT_VER="1.2"

APP="OpenVPN 2.4"
#APP_VER="2.4"
APP_CATEGORY="System Services"
APP_SCOPE="system"
APP_ENABLED="yes"
SYS_PKG_NAME="openvpn"
#><#APP_UPGRADE_VER_CMD="STANDARD_PACKAGE"
SUPPORTED_ON="CentOS7,CentOS8,Debian9,Debian10,Ubuntu16.04,Ubuntu18.04,Ubuntu20.04"
LIBRARY="functions4.sh"

if [ "${SUPPORT-}" = '' ]; then
    SUPPORT="https://installers.rapidseedbox.com/scripts/whmcs_client_installers/support"
fi

LOGFILE="/var/log/whmcs_client_installers/${0}.log"
[ ! -d "/var/log/whmcs_client_installers" ] && mkdir -p "/var/log/whmcs_client_installers"

wget -4 -nc -q --no-check-certificate --timeout=20 --tries=5 ${SUPPORT}/${LIBRARY} >> "${LOGFILE}" 2>&1
if [ ! -f "./${LIBRARY}" ] ; then
    echo "55"
    echo "Error downloading \"${SUPPORT}/${LIBRARY}\"" >> "${LOGFILE}"
    exit 55
fi

# shellcheck source=support/functions4.sh
. "./${LIBRARY}"
SCRIPTENTRY

while : ; do

    main_rc=1

    CHECK_APP ; _rc=$?
    if [ ${_rc} -ne 0 ] ; then
        main_rc=${_rc}
        break
    fi

    case "${LSB_VENDOR}" in
      "CentOS"|"CentOSStream")
          _pid_dir="/run/openvpn-server"
          _pid_file="${_pid_dir}/rsb-server.pid"
          ;;
      "Debian"|"Ubuntu")
          _pid_dir="/var/run/openvpn"
          _pid_file="${_pid_dir}/rsb-server.pid"
          # -- Remove old (?) `openvpn` package
          if DPKG_CHECK "openvpn" ; then
              if [ -e "/etc/monit/conf.d/openvpn@rsb-server" ] ; then
                  RM_FILES "/etc/monit/conf.d/openvpn@rsb-server"
                  MONIT_RELOAD
              fi
              SVC_STOP       "openvpn@rsb-server"
              SVC_DISABLE    "openvpn@rsb-server"
              APT_REMOVE "openvpn"
              APT_AUTOREMOVE
          fi

          # -- Install new `openvpn` package
          if [ ! -d "/etc/apt/sources.list.d" ] ; then
              MKDIR "/etc/apt/sources.list.d" || break
          fi

          if [ "${LSB_VER}" = "Ubuntu16.04" ] ; then
              echo "deb http://build.openvpn.net/debian/openvpn/release/2.4 ${LSB_CODENAME} main" \
                          > "/etc/apt/sources.list.d/openvpn24.list"
              if [ $? -ne 0 ] ; then
                  ERROR "Error adding ${APP} repository!" ; break
              fi
              ADD_APT_KEY_URL "https://swupdate.openvpn.net/repos/repo-public.gpg" "openvpn.gpg"
              if [ $? -ne 0 ] ; then
                  ERROR "Error adding ${APP} repository key!" ; break
              fi
              APT_UPDATE || break
          fi
          ;;
    esac

    ${PKG_INSTALL} "openvpn" "easy-rsa" || break

    # Workaround for `openvpn-plugin-auth-pam.so` relocation to the plugins directory
    if [ ! -e "/usr/lib/openvpn/openvpn-plugin-auth-pam.so" ] ; then
        case "${LSB_VER}" in
          "CentOS7"|"CentOS8"|"CentOSStream8")
              _src="/usr/lib64/openvpn/plugins/openvpn-plugin-auth-pam.so"
              cat <<-EOF > "/etc/pam.d/openvpn"
		#%PAM-1.0
		auth       include      system-auth
		account    include      system-auth
		password   include      system-auth
		session    optional     pam_keyinit.so revoke
		session    include      system-auth
		EOF
              ;;
          "Ubuntu18.04"|"Ubuntu20.04")
              _src="/usr/lib/x86_64-linux-gnu/openvpn/plugins/openvpn-plugin-auth-pam.so"
              ;;
          *)
              _src="/usr/lib/openvpn/plugins/openvpn-plugin-auth-pam.so"
              ;;
        esac
        if [ ! -e "${_src}" ] ; then
            ERROR "Could not find plugin: '${_src}'"
            break
        else
            [ -e "/usr/lib/openvpn" ] || MKDIR "/usr/lib/openvpn"
            LN "${_src}" \
                    "/usr/lib/openvpn/openvpn-plugin-auth-pam.so" \
                || break
        fi
    fi

    # -- Configure 
    WGET "${SUPPORT}/openvpn/openvpn-rsb-config.tar.gz" || break
    TAR_ZXF "${TMP_DIR}/openvpn-rsb-config.tar.gz" "/etc/" || break

    RUN_LOG "sed -i -e 's|iptables|/usr/sbin/iptables|g' /etc/openvpn/rsb-server-up.sh" \
        || break
    RUN_LOG "sed -i -e 's|iptables|/usr/sbin/iptables|g' /etc/openvpn/rsb-server-down.sh" \
        || break
    RUN_LOG "sed -i -e 's|venet0|${DEV}|g' /etc/openvpn/rsb-server-up.sh" \
        || break
    RUN_LOG "sed -i -e 's|venet0|${DEV}|g' /etc/openvpn/rsb-server-down.sh" \
        || break
    RUN_LOG "sed -i -e 's|^writepid\s*.*$|writepid ${_pid_file}|' /etc/openvpn/rsb-server.conf" \
        || break

    case "${LSB_VER}" in
      "CentOS7"|"CentOS8"|"CentOSStream8")
          cat <<-EOF > "/etc/pam.d/openvpn"
		#%PAM-1.0
		auth       include      system-auth
		account    include      system-auth
		password   include      system-auth
		session    optional     pam_keyinit.so revoke
		session    include      system-auth
		EOF
          ;;
    esac

    CHOWN_DIR  root:root "/etc/openvpn" || break
    CHOWN_FILE root:root "/etc/pam.d/openvpn" || break

    # -- Enable/start services
    if grep -e '^LimitNPROC=' "/lib/systemd/system/openvpn@.service" >> "${LOGFILE}" 2>&1 ; then
        sed -e 's|^\(LimitNPROC=.*\)$|#\1|' -i "/lib/systemd/system/openvpn@.service" >> "${LOGFILE}" 2>&1
    fi
    SVC_ENABLE  "openvpn@rsb-server"
    SVC_RESTART "openvpn@rsb-server"
    if [ -d "/etc/monit/conf.d" ] ; then
        cat <<-EOF > "/etc/monit/conf.d/openvpn@rsb-server"
		check process openvpn-rsb-server with pidfile ${_pid_file}
		  start program = "/usr/sbin/service openvpn@rsb-server restart"
		  stop  program = "/usr/sbin/service openvpn@rsb-server stop"
		  if 5 restarts with 5 cycles then timeout
		EOF
        MONIT_RELOAD
    fi


    main_rc=0
    break

done


SCRIPTEXIT