#!/usr/bin/perl
# cpanel - ensure_conf_dir_crt_key                Copyright(c) 2010 cPanel, Inc.
#                                                           All rights Reserved.
# copyright@cpanel.net                                         http://cpanel.net
# This code is subject to the cPanel license. Unauthorized copying is prohibited

BEGIN { unshift @INC, '/usr/local/cpanel'; }

use strict;
use warnings;
use Cpanel::Hostname  ();
use Cpanel::SSLPath   ();
use Cpanel::Logger    ();
use Cpanel::FileUtils ();

if ( !-e '/var/cpanel/ssl' ) {
    mkdir '/var/cpanel/ssl', 0755;
}
if ( !-e '/var/cpanel/ssl/cpanel' ) {
    mkdir '/var/cpanel/ssl/cpanel', 0755;
}


system '/usr/local/cpanel/bin/checkallsslcerts' if !-e '/var/cpanel/ssl/cpanel/cpanel.pem';

my $hostname = Cpanel::Hostname::gethostname();
my $ssl_root = Cpanel::SSLPath::getsslroot();
my $nobody_gid = ( getpwnam "nobody" )[3];

my %certificates = (
    'crt' => {
        'dir'  => '/usr/local/apache/conf/ssl.crt',
        'file' => 'server.crt',
    },
    'key' => {
        'dir'  => '/usr/local/apache/conf/ssl.key',
        'file' => 'server.key',
    },
);

foreach my $type ( keys %certificates ) {
    my $dir  = $certificates{$type}{'dir'};
    my $file = $certificates{$type}{'file'};
    mkdir $dir if !-d $dir;
    my $path = $dir . '/' . $file;
    my $initialized = 0;
    
    if ( !-e $path || -z _ ) {
        Cpanel::FileUtils::safecopy( '/var/cpanel/ssl/cpanel/cpanel.pem', $path );
        $initialized = 1;
    }
    else {
        if ( open my $look_fh, '<', $path ) {
            my $cont = do { local $/; <$look_fh> };
            close $look_fh;
            if ( $cont =~ m/SKIPME/m ) {
                Cpanel::FileUtils::safecopy( '/var/cpanel/ssl/cpanel/cpanel.pem', $path );
                $initialized = 1;
            }
        }
        else {
            Cpanel::Logger::logger(
                {
                    'message'   => "Unable to read $path: $!",
                    'level'     => 'warn',
                    'service'   => 'ensure_conf_dir_crt_key',
                    'output'    => 1,
                    'backtrace' => 0,
                }
            );
        }
    }

    if ($initialized) {

        if ( $type eq 'key' ) {
            chmod 0640, $path;
            chown 0, $nobody_gid, $path;
        }
        else {

            # remove key from this .pem
            if ( open my $crt_fh, '<', $path ) {
                my $cont = do { local $/; <$crt_fh> };
                close $crt_fh;
                if ( open my $new_fh, '>', $path ) {
                    $cont =~ s{
                             -----BEGIN(\s+\w+)*\s+PRIVATE\s+KEY-----
                             .*
                             -----END(\s+\w+)*\s+PRIVATE\s+KEY-----
                         }{}xms;
                    print {$new_fh} $cont;
                    close $new_fh;
                }
            }
            chmod 0644, $path;
            
        }
    }

    if ( $type eq 'key' ) {
        if ( !-e $ssl_root . '/private/' . $hostname . '.key' || -z _ ) {
            Cpanel::FileUtils::safecopy( $path, $ssl_root . '/private/' . $hostname . '.key' );
        }
        chmod 0640, $ssl_root . '/private/' . $hostname . '.key';
        chown 0, $nobody_gid, $ssl_root . '/private/' . $hostname . '.key';
    }
    else {
        if ( !-e $ssl_root . '/certs/' . $hostname . '.crt' || -z _ ) {
            Cpanel::FileUtils::safecopy( $path, $ssl_root . '/certs/' . $hostname . '.crt' );
        }
        chmod 0644, $ssl_root . '/certs/' . $hostname . '.crt';
    }    
}