#
# Author:: Earth U (<sysadmin @ chromedia.com>)
# Cookbook Name:: cfe-server
# Attribute:: default
#
# Copyright 2016, Chromedia Far East, Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#

cb = 'cfe-server'

## Secret data bag stuff
##
## Necessary secret data bag key/s:
##   iptables_ssh_ports
##   iptables_add_rules
##   ip_zabbix

databag =
  case node.chef_environment
  when 'prod', 'staging'
    node.chef_environment
  else
    'dev'
  end
secret = Chef::EncryptedDataBagItem.load(databag, "#{cb}-secret")

default[cb]['db']['include_mongodb'] = true
default[cb]['db']['include_mariadb'] = true
default[cb]['db']['mariadb']['install'] = false

default[cb]['filesystem']['swapfile'] = false
default[cb]['filesystem']['swapsize'] = '2G'
default[cb]['filesystem']['perms'] = [
#  {
#    :path => '/path',
#    :owner => nil, # Optional
#    :group => nil, # Optional
#    :mode  => nil # Optional
#  }
]
default[cb]['filesystem']['symlinks'] = {
#  '/link/name' => '/target/path'
}

default[cb]['tls']['include_letsencrypt'] = true

default[cb]['app']['include_postfix'] = true
default[cb]['app']['include_php']     = true
default[cb]['app']['include_pma']     = false

default[cb]['app']['composer']['project_paths'] = [
#  '/composer/proj/path/to/install'
]

default[cb]['misc']['cronjobs'] = [
#  {
#    :name    => 'arbitrary_name_of_cronjob',
#    :command => 'command to perform',
#    :sched   => '0 0 * * *',
#    :mailto  => '""', # Optional. Default: ''
#    :enable  => true # Optional. Default: true
#  }
]
default[cb]['misc']['logrotatejobs'] = [
#  {
#    :name    => 'arbitrary_name_of_job', # a filename, no spaces
#    :path    => '/path/to/rotate/*.log',
#    :options => %w{ weekly rotate\ 12 missingok compress notifempty },
#    :enable  => true # Optional. Default true
#  }
]

default[cb]['misc']['logrotate']['conf_dir'] = '/etc/logrotate.d'
default[cb]['misc']['sshd']['ports']         = secret['iptables_ssh_ports']
default[cb]['misc']['sshd']['conf_path']     = '/etc/ssh/sshd_config'

default[cb]['web']['include_nginx'] = true

default[cb]['monitor']['include_zabbix_agent'] = true

# Wrapped attributes

rules_ssh = secret['iptables_ssh_ports'].inject([]) do |acc, sport|
  acc << "--proto tcp --dport #{sport} -m conntrack --ctstate NEW"
  acc
end

# Place additional iptables filter rules in a secret data bag
# according to the format for cfe-simple-iptables attribute:
#  "iptables_add_rules": [
#    {
#      "name": "example",
#      "rule": "example",
#      "weight": 21
#    }
#  ]
rules_add = secret['iptables_add_rules'].inject([]) do |acc1, rule|
  hrule = rule.inject({}) do |acc2, (k, v)|
    acc2[k.to_sym] = v
    acc2
  end
  acc1 << hrule
  acc1
end

rules_filter1 = [
  {
    :n => 'established',
    :r => '-m conntrack --ctstate ESTABLISHED,RELATED',
    :w => 1
  },
  {
    :n => 'icmp',
    :r => '--proto icmp',
    :w => 2
  },
  {
    :n => 'loopback',
    :r => '--in-interface lo',
    :w => 3
  },
  {
    :n => 'ssh',
    :r => rules_ssh,
    :w => 4
  },
  {
    :n => 'http',
    :r => ['--proto tcp --dport 80',
           '--proto tcp --dport 443'],
    :w => 20
  }
]
rules_filter2 = [
  {
    :n => 'reject',
    :j => 'REJECT --reject-with icmp-host-prohibited',
    :w => 90
  },
  {
    :n => 'reject',
    :c => 'FORWARD',
    :j => 'REJECT --reject-with icmp-host-prohibited',
    :w => 90
  }
]

default['cfe-simple-iptables']['filter'] =
  rules_filter1 + rules_add + rules_filter2

default['cookbook-zabbix']['agent']['server_ip'] = secret['ip_zabbix']