#!/bin/bash
#
# Create keys for new nodes.
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU Affero General Public License as
# published by the Free Software Foundation, either version 3 of the
# License, or (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU Affero General Public License for more details.
#
# You should have received a copy of the GNU Affero General Public
# License along with this program.  If not, see
# <http://www.gnu.org/licenses/>.

function hydra_newkeys {
  # Generates ssh and gpg keys for new or existing nodes
  # GPG keys should be manually imported in the nodes
  local node
  local which

  if [ -z "$1" ]; then
    which="new"
  else
    which="$1"
  fi

  if [ ! -z "$2" ]; then
    shift
    NODES="$*"
  else
    NODES="`hydra $HYDRA nodes`"
  fi

  for node in $NODES; do
    node="`hydra_get_fqdn_from_nodename $node`"
    sshkey="$HYDRA_FOLDER/keyring/keys/nodes/$node/ssh/id_rsa.asc"
    gpgkey="$HYDRA_FOLDER/keyring/keys/nodes/$node/gpg/key.asc"
    borgkey="$HYDRA_FOLDER/keyring/keys/nodes/$node/borg/key.asc"

    if [ "$which" == "all" ]; then
      hydra_genpairs ssh     $node
      hydra_genpairs openpgp $node
    elif [ "$which" == "new" ]; then
      if [ ! -e "$sshkey" ]; then
        hydra_genpairs ssh $node
      fi

      if [ ! -e "$gpgkey" ]; then
        hydra_genpairs openpgp $node
      fi

      if [ ! -e "$borgkey" ]; then
        hydra_newkeys_borg $node
      fi
    elif [ "$which" == "ssh" ]; then
      hydra_genpairs ssh $node
    elif [ "$which" == "openpgp" ]; then
      hydra_genpairs openpgp $node
    elif [ ! -e "$borg" ]; then
      hydra_newkeys_borg $node
    fi
  done
}

function hydra_newkeys_borg {
  # Check for borg
  #if ! which borg &> /dev/null; then
  #  echo "Please install borgbackup to be able to generate borg keys"
  #  return 1
  #fi

  hydra_install_package borgbackup

  # Set working folder
  hydra_set_tmpfile hydra.newkeys.borg -d
  mkdir -p $TMPWORK/keys

  # Set password
  # BORG_PASSCOMMAND is supported only on recent borg
  #read -s -rep "Borg key password: " password
  #export BORG_PASSCOMMAND='keyringer $HYDRA decrypt nodes/$node/borg/key.passwd 2> /dev/nul'
  keyringer $HYDRA pwgen nodes/$node/borg/key.passwd
  password="`keyringer $HYDRA decrypt nodes/$node/borg/key.passwd 2> /dev/null`"
  export BORG_PASSPHRASE="$password"

  # Set borg parameters
  export BORG_CONFIG_DIR="$TMPWORK"
  export BORG_KEY_FILE="$TMPWORK/keys/key"

  # Create key
  borg init --encryption=keyfile $TMPWORK/repo

  # Encrypt key
  cat $BORG_KEY_FILE | keyringer $HYDRA encrypt nodes/$node/borg/key

  # Cleanup
  if which wipe &> /dev/null; then
    wipe -rf $TMPWORK
  else
    rm -rf $TMPWORK
  fi
}

function hydra_genpairs {
  BASEDIR="/tmp"

  local which="$1"
  local node="$2"

  if [ "$which" == "openpgp" ]; then
    keyringer $HYDRA genpair gpg nodes/$node/gpg/key    $node
  elif [ "$which" == "ssh" ]; then
    keyringer $HYDRA genpair ssh nodes/$node/ssh/id_rsa $node
  else
    return
  fi

  hydra_set_tmpfile genpair
  echo "Importing $which keys for $node" > $TMPWORK

  keyringer $HYDRA git commit -F $TMPWORK
  keyringer $HYDRA git push

  hydra_unset_tmpfile $TMPWORK
}

# Load.
source $APP_BASE/lib/hydra/functions || exit 1
hydra_config_load

# Check for keyringer.
if ! which keyringer &> /dev/null; then
  hydra_install_package keyringer
fi

hydra_newkeys $*