#!/bin/bash
#
# Traefik Service

PATH=$HOME/.docker/cli-plugins:/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
. /etc/federated

config_traefik() {
  echo -ne "* Configuring traefik container.."

  if [ ! -d "/federated/apps/traefik" ]; then
    mkdir -p /federated/apps/traefik/data/letsencrypt
  fi

TRAEFIK_HTTPAUTH_STRING=$(echo `htpasswd -nb admin $ADMINPASS` | sed -e s/\\$/\\$\\$/g)

if [[ "${PLUS}" = "true" ]]; then
cat > /federated/apps/traefik/docker-compose.yml <<EOF
services:
  traefik:
    image: traefik:\${IMAGE_VERSION}
    container_name: traefik
    hostname: traefik.$DOMAIN
    restart: always
    networks:
      core:
        ipv4_address: 192.168.0.13
    command:
      # Tell Traefik to discover containers using the Docker API
      - --providers.docker=true
      # Enable the Trafik dashboard
      #- --api.dashboard=true
      # Set up LetsEncrypt
      #- --certificatesresolvers.letsencrypt.acme.dnschallenge=true
      #- --certificatesresolvers.letsencrypt.acme.dnschallenge.provider=pdns
      #- --certificatesresolvers.letsencrypt.acme.email=hostmaster@$DOMAIN
      #- --certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json
      #- --certificatesresolvers.letsencrypt.acme.dnschallenge.DisablePropagationCheck=true
      # --certificatesresolvers.letsencrypt.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory
      # Added HTTP challenge
      - --certificatesresolvers.httpresolver.acme.httpchallenge=true
      - --certificatesresolvers.httpresolver.acme.httpchallenge.entrypoint=web
      #- "--certificatesresolvers.httpresolver.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory"
      - --certificatesresolvers.httpresolver.acme.email=hostmaster@$DOMAIN
      - --certificatesresolvers.httpresolver.acme.storage=/letsencrypt/httpacme.json
      - --log.level=DEBUG
      # Set up an insecure listener that redirects all traffic to HTTPS
      - --entrypoints.web.address=:80
      - --entrypoints.websecure.address=:443
      - --entrypoints.web.http.redirections.entrypoint.to=websecure
      - --entrypoints.web.http.redirections.entrypoint.scheme=https
      # Set up the TLS configuration for our websecure listener
      - --entrypoints.websecure.http.tls=true
      - --entrypoints.websecure.http.tls.certResolver=letsencrypt
      - --entrypoints.websecure.http.tls.domains[0].main=$DOMAIN
      - --entrypoints.websecure.http.tls.domains[0].sans=*.$DOMAIN
    env_file:
      - ./.env
    ports:
      - 80:80
      - 443:443
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./data/letsencrypt:/letsencrypt
    #labels:
      #- "traefik.enable=true"
      #- "traefik.http.routers.traefik.rule=Host(\`traefik.$DOMAIN\`)"
      #- "traefik.http.routers.traefik.entrypoints=websecure"
      #- "traefik.http.routers.traefik.tls.certresolver=letsencrypt"
      #- "traefik.http.routers.traefik.service=api@internal"
      #- "traefik.http.routers.traefik.middlewares=strip"
      #- "traefik.http.middlewares.strip.stripprefix.prefixes=/traefik"
      #- "traefik.http.routers.traefik.middlewares=traefik-auth"
      #- "traefik.http.middlewares.traefik-auth.basicauth.users=$TRAEFIK_HTTPAUTH_STRING"

networks:
  core:
    external: true
EOF
else
cat > /federated/apps/traefik/docker-compose.yml <<EOF
services:
  traefik:
    image: traefik:\${IMAGE_VERSION}
    container_name: traefik
    hostname: traefik.$DOMAIN
    restart: always
    networks:
      core:
        ipv4_address: 192.168.0.13
    command:
      # Tell Traefik to discover containers using the Docker API
      - --providers.docker=true
      # Enable the Trafik dashboard
      - --api.dashboard=true
      # Set up LetsEncrypt
      - --certificatesresolvers.letsencrypt.acme.dnschallenge=true
      - --certificatesresolvers.letsencrypt.acme.dnschallenge.provider=pdns
      - --certificatesresolvers.letsencrypt.acme.email=hostmaster@$DOMAIN
      - --certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json
      - --certificatesresolvers.letsencrypt.acme.dnschallenge.DisablePropagationCheck=true
      # --certificatesresolvers.letsencrypt.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory
      # Added HTTP challenge
      - --certificatesresolvers.httpresolver.acme.httpchallenge=true
      - --certificatesresolvers.httpresolver.acme.httpchallenge.entrypoint=web
      #- "--certificatesresolvers.httpresolver.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory"
      - --certificatesresolvers.httpresolver.acme.email=hostmaster@$DOMAIN
      - --certificatesresolvers.httpresolver.acme.storage=/letsencrypt/httpacme.json
      - --log.level=DEBUG
      # Set up an insecure listener that redirects all traffic to HTTPS
      - --entrypoints.web.address=:80
      - --entrypoints.websecure.address=:443
      - --entrypoints.web.http.redirections.entrypoint.to=websecure
      - --entrypoints.web.http.redirections.entrypoint.scheme=https
      # Set up the TLS configuration for our websecure listener
      - --entrypoints.websecure.http.tls=true
      - --entrypoints.websecure.http.tls.certResolver=letsencrypt
      - --entrypoints.websecure.http.tls.domains[0].main=$DOMAIN
      - --entrypoints.websecure.http.tls.domains[0].sans=*.$DOMAIN
    env_file:
      - ./.env
    ports:
      - 80:80
      - 443:443
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./data/letsencrypt:/letsencrypt
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.traefik.rule=Host(\`traefik.$DOMAIN\`)"
      - "traefik.http.routers.traefik.entrypoints=websecure"
      - "traefik.http.routers.traefik.tls.certresolver=letsencrypt"
      - "traefik.http.routers.traefik.service=api@internal"
      - "traefik.http.routers.traefik.middlewares=strip"
      - "traefik.http.middlewares.strip.stripprefix.prefixes=/traefik"
      - "traefik.http.routers.traefik.middlewares=traefik-auth"
      - "traefik.http.middlewares.traefik-auth.basicauth.users=$TRAEFIK_HTTPAUTH_STRING"

networks:
  core:
    external: true
EOF
fi

PDNS_APIKEY=`grep PDNS_api_key /federated/apps/pdns/.env | awk -F= '{ print $2 }'`

if [[ "${PLUS}" = "true" ]]; then
cat > /federated/apps/traefik/.env <<EOF
IMAGE_VERSION="$(current_version traefik)"
EOF
else
cat > /federated/apps/traefik/.env <<EOF
IMAGE_VERSION="$(current_version traefik)"
PDNS_API_KEY=$PDNS_APIKEY
PDNS_API_URL=http://pdns.$DOMAIN:8081
EOF
fi
chmod 600 /federated/apps/traefik/.env

echo -ne "done.\n"
}
start_traefik() {
  if [[ "${PLUS}" = "true" ]]; then
    docker compose -f /federated/apps/traefik/docker-compose.yml -p traefik up -d &> /dev/null
  else
    start_service "traefik" "traefik-certs-dumper file --version v2 --source /federated/apps/traefik/data/letsencrypt/acme.json --dest /federated/certs &> /dev/null && ls /federated/certs/private/$DOMAIN.key /federated/certs/certs/$DOMAIN.crt &> /dev/null" "10"
  fi
}