#! /bin/bash

# Install FreeIPA

# kernel cmdline check
read KCMDLINE < /proc/cmdline
grep -vq 'ipv6.disable=0' <<< $KCMDLINE && echo "В строке параметров ядра не найдено ipv6.disable=0" && exit 1
grep -vq 'selinux=0' <<< $KCMDLINE && echo "В строке параметров ядра не найдено selinux=0" && exit 1

DEFSCRIPT="/usr/sbin/ipa-install-defaults"

if [ $# -ne 1 ]; then
    echo "Отсутствует файл параметров"
    exit 1
fi

. $DEFSCRIPT
. $1

# Make server.*

if [ ! -d "$CERTDIR" ]; then
    echo "Каталог $CERTDIR не найден, продолжение невозможно!"
    exit 1
fi
[ -f "$CERTDIR/CA.key" ] &&  [ -f "$CERTDIR/CA.pem" ] || ( echo "CA.key или CA.pem не найдены в $CERTDIR"; exit 1 )

SUBJECT="/C=$COUNTRY/ST=$SERVER_PROV/L=$SERVER_CITY/O=$SERVER_O/CN=$SERVER_CN"

openssl req -new -newkey rsa:2048 -sha256 -nodes -keyout "$CERTDIR/server.key" -subj "$SUBJECT" \
-out "$CERTDIR/server.csr" >>$LOGFILE 2>&1

cat > "$CERTDIR/v3.ext" << EOF
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
subjectAltName = @alt_names

[alt_names]
DNS.1 = $HOSTNAME
EOF

openssl x509 -req -in "$CERTDIR/server.csr" -CA "/$CERTDIR/CA.pem" -CAkey "$CERTDIR/CA.key" -CAcreateserial \
-CAserial "$CERTDIR/ipa.srl" -out "$CERTDIR/server.crt" -days $SERV_DAYS -sha256 -extfile "$CERTDIR/v3.ext" \
-passin "file:$CERTDIR/pwdfile.txt" >>$LOGFILE 2>&1
echo "" >>$LOGFILE

# Make servercrt.p12

openssl pkcs12 -export -out "$CERTDIR/servercert.p12" -inkey "$CERTDIR/server.key" -in "$CERTDIR/server.crt" \
-certfile "$CERTDIR/CA.pem" -passout "file:$CERTDIR/pwdfile.txt" >>$LOGFILE 2>&1

# Install server

export PWORD
ipa-server-install --http-cert-file "$CERTDIR/servercert.p12" --dirsrv-cert-file "$CERTDIR/servercert.p12" \
--http-pin "$PWORD" --dirsrv-pin "$PWORD" --ca-cert-file "$CERTDIR/CA.pem" --no-pkinit \
--setup-dns --auto-forwarders 
