#!/bin/bash
# -*-mode: sh; tab-width: 8; coding: utf-8-unix -*-

ROLE=proxy
CONN=guest
USAGE="[config|start|stop|test|verify]"
prog=$( basename $0 .bash )
. /usr/local/bin/usr_local_tput.bash

. /usr/local/sbin/proxy_whonix_lib.bash || \
    { ERROR loading /usr/local/sbin/proxy_whonix_lib.bash ; exit 1; }
. /usr/local/sbin/proxy_whonix_gateway_tor.bash || \
    { ERROR loading /usr/local/sbin/proxy_whonix_gateway_tor.bash ; exit 2; }
. /usr/local/bin/usr_local_tput.bash || exit 3

NSL='nslookup -querytype=A'
NETS='netstat -nl4e'
SHARED_MNTS="o"
# ELTS="onion-grater" # these work and start normally
# sdwdate should be linked to NetManager and prevents logins if not connected
# well start tor ourselves
# we dont need vanguards
DISABLE_SERVICES="sdwdate tor vanguards"
DISABLE_X_SERVICES="rads sdwdate-gui-shutdown-notify tor-control-panel"
grep -q ' text ' /proc/cmdline && \
    DISABLE_SERVICES="$DISABLE_X_SERVICES $DISABLE_SERVICES"

## proxy_gateway_fix_getty_timeout
proxy_gateway_fix_getty_timeout () {
    # fix_getty_timeout - wheres inittab
    grep -l '^Exec.*agetty -o' /lib/systemd/system/*service | while read file ; do
	[ -f $file.dst ] && continue
	cp -p $file $file.dst
	sed -e 's/agetty -o/agetty -t 120 -o/' -i $file
    done
    return 0
}

## proxy_gateway_disable_rads
proxy_gateway_disable_rads () {
    # rads is really hard to kill
    if [ ! -f  /etc/rads.d/50_default.conf ] ; then
	sed /etc/rads.d/30_default.conf > /etc/rads.d/50_default.conf \
	    -e 's@rads_start_display_manager=1@rads_start_display_manager=0@' \
	    -e 's@rads_skip_ram_test=0rads_skip_ram_test=1@' \
	    -e 's@rads_wait=0@rads_wait=1@' \
	    -e 's@rads_wait_seconds=10@rads_wait_seconds=20@' \
	    -e 's@rads_debug=0@rads_debug=1@'
    fi
    return 0
}

## proxy_gateway_install_tor
proxy_gateway_install_tor () {
    # fixme parameterize?

    if [ ! -f /usr/local/etc/torrc.d/50_user.conf ] ; then
	cat > /usr/local/etc/torrc.d/50_user.conf << EOF
Socks5ProxyUsername foo
Socks5ProxyPassword bar
SafeLogging 0
SocksPort 10.0.2.15:9050
DnsPort 10.0.2.15:9053
HTTPTunnelPort 10.0.2.15:9128
TransPort 10.0.2.15:9040
ControlSocket /run/tor/control
ControlSocketGroupWriteable 1
DisableNetwork 0
EOF
    fi

    return 0
}

## proxy_gateway__shutup_verbosity
proxy_gateway_shutup_verbosity () {
    for file in /etc/issue* /etc/issue.d/* ; do
	[ -f $file ] || continue
	[ -s $file ] && cp /dev/null $file
    done
    return 0
}

## proxy_gateway_install_fstab
proxy_gateway_install_fstab () {
    # /etc/fstab

    options=noauto,rw,trans=virtio,version=9p2000.L,cache=none
    for elt in $SHARED_MNTS ; do
	[ -d /mnt/$elt ] || mkdir /mnt/$elt
	grep -q /mnt/$elt /etc/fstab && continue
	echo "$elt	/mnt/$elt	9p	$options	0	0" \
	     >> /etc/fstab
    done
    return 0
}

## proxy_gateway_install_gagent
proxy_gateway_install_gagent () {
    [ -e /dev/virtio-ports/org.qemu.guest_agent.0 ] || {
	ERROR /dev/virtio-ports/org.qemu.guest_agent.0 not found
	ERROR "check the host xml for <target type='virtio' name='org.qemu.guest_agent.0'/>"
	ERROR "or blame Pottyring's systemd"
	}
    [ -x /usr/sbin/qemu-ga ] && return 0

    # /mnt/shared/qemu-guest-agent_3.1+dfsg-8+deb10u8_amd64.deb
    if [ -f /var/cache/apt/archives/qemu-guest-agent_3.1+dfsg-8+deb10u8_amd64.deb ] ; then
	# /o/Cache/Apt/Debian/10.6/deb.debian.org/debian-security/pool/updates/main/q/qemu/qemu-guest-agent_3.1+dfsg-8+deb10u8_amd64.deb
	dpkg -i /var/cache/apt/archives/qemu-guest-agent_3.1+dfsg-8+deb10u8_amd64.deb
    fi

    false && \
    [ -f /lib/systemd/system/qemu-guest-agent.service ] && \
	[ ! -h /etc/systemd/system/multi-user.target/qemu-guest-agent.service ] && \
	ln -s /lib/systemd/system/qemu-guest-agent.service \
	   /etc/systemd/system/multi-user.target.wants
    return 0
}

## proxy_gateway_disable_services
proxy_gateway_disable_services () {
    [ -f /usr/local/etc/local.d/local.bash ] || \
      { ERROR loading /usr/local/etc/local.d/local.bash ; return 2; }
    local_systemd_stop_and_mask $DISABLE_SERVICES

    return 0
}

## proxy_gateway_test
proxy_gateway_test () {

    proxy_whonix_test gateway

    return 0
}

## proxy_gateway_config
proxy_gateway_config () {
    grep '^nameserver 127.0.0.1' /etc/resolv.conf || \
	echo 'nameserver 127.0.0.1' >> /etc/resolv.conf
    proxy_gateway_disable_services || return 1$?
    # /usr/local/sbin/proxy_whonix_gateway_tor.bash config || return 2$?
    gateway_tor_verify || return 3$?
    return 0
}

## proxy_gateway_config
proxy_gateway_config () {
    local dire=gateway
    local file

    proxy_dest_port_wlan_config $dire || return 1$?
    DEST=10.0.2.15
    PORT=9053
    [ -z "$PORT" -o -z "$DEST" ] && return 2
    #? proxy_whonix_polipo_config $dire
    proxy_ping_test_resolv $dire || return 4$?
    proxy_whonix_dnsmasq_config $dire || return 5$?

    return 0
}
## proxy_gateway_start_bg
proxy_gateway_start_bg () { proxy_gateway_start $* ; }
## proxy_gateway_start
proxy_gateway_start () {
    proxy_gateway_config || return 1$?
    proxy_whonix_guest_start gateway

    proxy_ping_dnsmasq_status || \
        proxy_ping_dnsmasq_start || return 2$?

    /usr/local/sbin/proxy_whonix_gateway_tor.bash start || return 3$?
    #? .     gateway_tor_start

    #? polipo
    # dnsmasq

    return 0
}

## proxy_gateway_stop
proxy_gateway_stop () {
    gateway_tor_stop stop || return 3$?

    return 0
}

## proxy_gateway_status
proxy_gateway_status () {

    if [ -f /etc/ssh/sshd_config ] ; then
	rc_service sshd status
    else
	WARN ssh not installed
    fi

    # tor_grep_log || return 2$?
    tor_status

    #? /usr/local/bin/proxy_ping_test.bash polipo || return 3$?
    /usr/local/bin/proxy_ping_test.bash gateway || return 3$?
    /usr/local/bin/proxy_ping_test.bash dns || return 4$?

    return 0
}

## proxy_gateway_config
proxy_gateway_config () {
    systemctl is-enabled rc.local || systemctl enable --now rc.local || return 1
# [ -f /etc/systemd/system/multi-user.target.wants/rc-local.service ] || \
#  ln -s /lib/systemd/system/rc-local.service \
#    /etc/systemd/system/multi-user.target.wants/rc-local.service

    systemctl is-enabled tor || systemctl disable --now tor
    tor_config_tor || return 1$?

    return 0
}

proxy_gateway_verify () {
    for elt in $( echo $USAGE | sed -e 's/|/ /' ) do ; grep ^$elt $0 ; done
    tor_do_verify || return 1

    return 0
}

## proxy_gateway_install
proxy_gateway_install () {
    proxy_gateway_config || return 0

    proxy_gateway_install_gagent
    proxy_gateway_fix_getty_timeout
    proxy_gateway_install_tor
    proxy_gateway_shutup_verbosity
    proxy_gateway_install_fstab
    proxy_gateway_disable_rads

    return 0
}

if [ "$#" -eq 0 ] ; then
      echo USAGE: $prog $USAGE
  elif [ "$1" = '-h'  ] || [ "$1" = '--help' ] ; then
    echo USAGE: $prog $USAGE or:
    grep '^## ' $0 | sed -e 's/^## //'

  elif [ "$1" = config -o "$1" -o "$1" = install ] ; then
    proxy_gateway_$1 || return 3$?

  elif [ "$1" = verify -o "$1" = status -o "$1" = test_from -o "$1" = test ] ; then
    proxy_gateway_$1 || return 4$?

  elif [ "$1" = start_bg -o "$1" = start -o "$1" = stop ] ; then
    proxy_gateway_$1 || return 5$?

  else
    INFO $prog "$@"
    eval "$@"
    exit $?

  fi
