#!/usr/bin/env bash

set -e
set -u

## START STANDARD BUILD SCRIPT INCLUDE
# adjust relative paths as necessary
THIS_SCRIPT="$(greadlink -f "${BASH_SOURCE[0]}" 2>/dev/null || readlink -f "${BASH_SOURCE[0]}")"
. "$(dirname "$THIS_SCRIPT")/../../build/build-utils.sh"
## END STANDARD BUILD SCRIPT INCLUDE

. "$KEYMAN_ROOT/resources/shellHelperFunctions.sh"

echo_heading2() {
  echo ""
  builder_heading "$*"
}

if [[ $BUILDER_OS != win ]]; then
  builder_die "This script can only be run on Windows to setup IIS."
fi

builder_warn "Warning: this script requires Administrator permissions to install certificates."

# Generate CA key
echo_heading2 "Generating CA key"
if [ ! -f rootCA.key ]; then
  echo "Please create a password for the certification authority key"
  echo "This should be unique to your setup."
  winpty openssl genrsa -des3 -out rootCA.key 2048
else
  echo "Skipping, rootCA.key already present"
fi

# Generate CA certificate
echo_heading2 "Generating CA certificate"
if [ ! -f rootCA.pem ]; then
  winpty openssl req -x509 -new -nodes -key rootCA.key -sha256 -days 3650 -out rootCA.pem
else
  echo "Skipping, rootCA.pem already present"
fi

# Generate site certificate signing request
echo_heading2 "Generating site certificate signing request"
if [ ! -f server.csr ]; then
  winpty openssl req -new -sha256 -nodes -out server.csr -newkey rsa:2048 -keyout server.key -config server.csr.cnf
else
  echo "Skipping, server.csr already present"
fi

# Generate site certificate
echo_heading2 "Generating site certificate"
if [ ! -f server.crt ]; then
  winpty openssl x509 -req -in server.csr -CA rootCA.pem -CAkey rootCA.key -CAcreateserial -out server.crt -days 500 -sha256 -extfile v3.ext
else
  echo "Skipping, server.crt already present"
fi

# Convert site certificate to .pfx for IIS
echo_heading2 "Converting certificate to .pfx for IIS"
if [ ! -f server.pfx ]; then
  winpty openssl pkcs12 -export -out server.pfx -inkey server.key -in server.crt
else
  echo "Skipping, server.pfx already present"
fi

# Import the CA certificate into the Trusted Root Certification Authorities
echo_heading2 "Importing CA certificate to root store"
certutil -addstore Root rootCA.pem

# Import server.pfx to IIS certficate store
echo_heading2 "Importing site certificate to WebHosting store"
certutil -importPFX WebHosting server.pfx

# Add bindings to each site in IIS
echo_heading2 "Setup IIS bindings"
echo "Now, add a HTTPS binding for each site in IIS (this is painful to automate):"
echo "1. Open IIS Manager"
echo "2. For each site, click Bindings in Actions panel"
echo "3. Click Add:"
echo "   Select Type='https'"
echo "   Select Host name=per the existing binding (e.g. 'keymanweb.com.local')"
echo "   Select SSL certificate='keyman.com.local'"
echo "4. Click OK, Close, and repeat for each site."
echo ""
echo "This certificate can be used for all keyman.com sites and localhost; see"
echo "README.md / v3.ext for list of matching domains."

# Update PHP CACert
echo_heading2 "Setup PHP certificate authority"

curl -s https://curl.se/ca/cacert.pem > cacert.pem
echo "" >> cacert.pem
echo "Keyman Localhost CA" >> cacert.pem
echo "===================" >> cacert.pem
echo "## This is a local CA for Keyman localhost websites generated by" >> cacert.pem
echo "## https://github.com/keymanapp/keyman/tree/master/build/devbox/iis-https/setup-iis-https.sh" >> cacert.pem
cat rootCA.pem >> cacert.pem

echo "We also need to add our CA certificate to PHP so we can access our local"
echo "https sites from PHP scripts."
echo "1. Locate php.ini (e.g. C:\\tools\\php74\\php.ini)"
echo "2. Copy cacert.pem from here and save it alongside your PHP.ini file"
echo "3. Set curl.cainfo and openssl.cafile in php.ini to cacert.pem location, e.g."
echo "   curl.cainfo = \"C:\\tools\\php74\\cacert.pem\""
echo "4. Finally, you may need to restart IIS for changes to take effect."

echo_heading2 "Complete"
builder_warn "Please check logs above for errors and manual steps"