#!/bin/bash
#
# Traefik Service

PATH=$HOME/.docker/cli-plugins:/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
. /etc/federated

config_traefik() {
  echo -ne "* Configuring traefik container.."

  if [ ! -d "/federated/apps/traefik" ]; then
    mkdir -p /federated/apps/traefik/data/letsencrypt
  fi

TRAEFIK_HTTPAUTH_STRING=$(echo `htpasswd -nb admin $ADMINPASS` | sed -e s/\\$/\\$\\$/g)

if [[ "${PLUS}" = "true" ]]; then
cat > /federated/apps/traefik/docker-compose.yml <<EOF
services:
  traefik:
    image: traefik:\${IMAGE_VERSION}
    container_name: traefik
    hostname: traefik.$DOMAIN
    restart: always
    networks:
      core:
        ipv4_address: 192.168.0.13
    command:
      # Tell Traefik to discover containers using the Docker API
      - --providers.docker=true
      # Enable the Trafik dashboard
      - --api.dashboard=true
      # Set up LetsEncrypt
      #- --certificatesresolvers.letsencrypt.acme.dnschallenge=true
      #- --certificatesresolvers.letsencrypt.acme.dnschallenge.provider=pdns
      #- --certificatesresolvers.letsencrypt.acme.email=hostmaster@$DOMAIN
      #- --certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json
      #- --certificatesresolvers.letsencrypt.acme.dnschallenge.DisablePropagationCheck=true
      # --certificatesresolvers.letsencrypt.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory
      # Added HTTP challenge
      - --certificatesresolvers.httpresolver.acme.httpchallenge=true
      - --certificatesresolvers.httpresolver.acme.httpchallenge.entrypoint=web
      #- "--certificatesresolvers.httpresolver.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory"
      - --certificatesresolvers.httpresolver.acme.email=hostmaster@$DOMAIN
      - --certificatesresolvers.httpresolver.acme.storage=/letsencrypt/httpacme.json
      - --log.level=DEBUG
      # Set up an insecure listener that redirects all traffic to HTTPS
      - --entrypoints.web.address=:80
      - --entrypoints.websecure.address=:443
      - --entrypoints.web.http.redirections.entrypoint.to=websecure
      - --entrypoints.web.http.redirections.entrypoint.scheme=https
      # Set up the TLS configuration for our websecure listener
      - --entrypoints.websecure.http.tls=true
      - --entrypoints.websecure.http.tls.certResolver=letsencrypt
      - --entrypoints.websecure.http.tls.domains[0].main=$DOMAIN
      - --entrypoints.websecure.http.tls.domains[0].sans=*.$DOMAIN
    env_file:
      - ./.env
    ports:
      - 80:80
      - 443:443
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./data/letsencrypt:/letsencrypt
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.traefik.rule=Host(\`traefik.$DOMAIN\`)"
      - "traefik.http.routers.traefik.entrypoints=websecure"
      - "traefik.http.routers.traefik.tls.certresolver=letsencrypt"
      - "traefik.http.routers.traefik.service=api@internal"
      - "traefik.http.routers.traefik.middlewares=strip"
      - "traefik.http.middlewares.strip.stripprefix.prefixes=/traefik"
      - "traefik.http.routers.traefik.middlewares=traefik-auth"
      - "traefik.http.middlewares.traefik-auth.basicauth.users=$TRAEFIK_HTTPAUTH_STRING"

networks:
  core:
    external: true
EOF
else
cat > /federated/apps/traefik/docker-compose.yml <<EOF
services:
  traefik:
    image: traefik:\${IMAGE_VERSION}
    container_name: traefik
    hostname: traefik.$DOMAIN
    restart: always
    networks:
      core:
        ipv4_address: 192.168.0.13
    command:
      # Tell Traefik to discover containers using the Docker API
      - --providers.docker=true
      # Enable the Trafik dashboard
      - --api.dashboard=true
      # Set up LetsEncrypt
      - --certificatesresolvers.letsencrypt.acme.dnschallenge=true
      - --certificatesresolvers.letsencrypt.acme.dnschallenge.provider=pdns
      - --certificatesresolvers.letsencrypt.acme.email=hostmaster@$DOMAIN
      - --certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json
      - --certificatesresolvers.letsencrypt.acme.dnschallenge.DisablePropagationCheck=true
      # --certificatesresolvers.letsencrypt.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory
      # Added HTTP challenge
      - --certificatesresolvers.httpresolver.acme.httpchallenge=true
      - --certificatesresolvers.httpresolver.acme.httpchallenge.entrypoint=web
      #- "--certificatesresolvers.httpresolver.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory"
      - --certificatesresolvers.httpresolver.acme.email=hostmaster@$DOMAIN
      - --certificatesresolvers.httpresolver.acme.storage=/letsencrypt/httpacme.json
      - --log.level=DEBUG
      # Set up an insecure listener that redirects all traffic to HTTPS
      - --entrypoints.web.address=:80
      - --entrypoints.websecure.address=:443
      - --entrypoints.web.http.redirections.entrypoint.to=websecure
      - --entrypoints.web.http.redirections.entrypoint.scheme=https
      # Set up the TLS configuration for our websecure listener
      - --entrypoints.websecure.http.tls=true
      - --entrypoints.websecure.http.tls.certResolver=letsencrypt
      - --entrypoints.websecure.http.tls.domains[0].main=$DOMAIN
      - --entrypoints.websecure.http.tls.domains[0].sans=*.$DOMAIN
    env_file:
      - ./.env
    ports:
      - 80:80
      - 443:443
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./data/letsencrypt:/letsencrypt
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.traefik.rule=Host(\`traefik.$DOMAIN\`)"
      - "traefik.http.routers.traefik.entrypoints=websecure"
      - "traefik.http.routers.traefik.tls.certresolver=letsencrypt"
      - "traefik.http.routers.traefik.service=api@internal"
      - "traefik.http.routers.traefik.middlewares=strip"
      - "traefik.http.middlewares.strip.stripprefix.prefixes=/traefik"
      - "traefik.http.routers.traefik.middlewares=traefik-auth"
      - "traefik.http.middlewares.traefik-auth.basicauth.users=$TRAEFIK_HTTPAUTH_STRING"

networks:
  core:
    external: true
EOF
fi

PDNS_APIKEY=`grep PDNS_api_key /federated/apps/pdns/.env | awk -F= '{ print $2 }'`

cat > /federated/apps/traefik/.env <<EOF
IMAGE_VERSION="v2.11.16"
PDNS_API_KEY=$PDNS_APIKEY
PDNS_API_URL=http://pdns.$DOMAIN:8081
EOF
chmod 600 /federated/apps/traefik/.env

echo -ne "done.\n"
}
start_traefik() {
  # Start service with command to make sure it's up before proceeding
  if [[ "${PLUS}" = "true" ]]; then
    docker compose -f /federated/apps/traefik/docker-compose.yml -p traefik up -d
  #  start_service "traefik" "traefik-certs-dumper file --version v2 --source /federated/apps/traefik/data/letsencrypt/httpacme.json --dest /federated/certs &> /dev/null && ls /federated/certs/private/*.$DOMAIN.key /federated/certs/certs/*.$DOMAIN.crt &> /dev/null" "10"
  else
    start_service "traefik" "traefik-certs-dumper file --version v2 --source /federated/apps/traefik/data/letsencrypt/acme.json --dest /federated/certs &> /dev/null && ls /federated/certs/private/$DOMAIN.key /federated/certs/certs/$DOMAIN.crt &> /dev/null" "10"
  fi
}
start_traefik_old() {
  echo -ne "\n* Starting /federated/apps/traefik service.."

  spin &
  SPINPID=$!

  if [ $DEBUG ]; then
    # Start /federated/apps/traefik with output to console for debug
    docker compose -f /federated/apps/traefik/docker-compose.yml -p traefik up
    [ $? -eq 0 ] && echo -ne "done.\n" || fail "There was a problem starting service /federated/apps/traefik"
  else
    # Start /federated/apps/traefik with output to /dev/null
    docker compose -f /federated/apps/traefik/docker-compose.yml -p traefik up -d &> /dev/null

    # Keep trying to see that certificates are generated
    RETRY="20"
    while [ $RETRY -gt 0 ]; do
      traefik-certs-dumper file --version v2 --source /federated/apps/traefik/data/letsencrypt/acme.json --dest /federated/certs &> /dev/null

      # Check if certs are generated
      ls /federated/certs/private/$DOMAIN.key /federated/certs/certs/$DOMAIN.crt &> /dev/null
      if [ $? -eq 0 ]; then
        kill -9 $SPINPID &> /dev/null
        echo -ne "done."
        break
      else
        if [ "$RETRY" == 1 ]; then
          docker compose -f /federated/apps/traefik/docker-compose.yml -p traefik down &> /dev/null
          fail "There was a problem starting service /federated/apps/traefik\nCheck the output of 'docker logs traefik' or turn on\ndebug with -d"
        fi
        ((RETRY--))
        sleep 9
      fi
    done
  fi
}