#!/usr/bin/env bash
# script create ssl certs
#

##!! manual values
# Set the TLD domain we want to use
BASE_DOMAIN="mydomain.ru"

# Days for the cert to live
DAYS=3600

# A blank passphrase
PASSPHRASE=""

# Generated configuration file
CONFIG_FILE="config.txt"

Country="RU";
City="MyCity";
Fname="myfirm";
Demail="admin@mydomain.ru"

## script values
version="0.0.5";
sname="creatcert";

# - options
cmd=$1;
opt=$2;

# script path
path_script=$( cd -- $( dirname -- "${BASH_SOURCE[0]}" ) &> /dev/null && pwd );

# SSL path
path_ssl="/etc/ssl";

function createSSL() {

cat > $CONFIG_FILE <<-EOF
[req]
default_bits = 2048
prompt = no
default_md = sha256
x509_extensions = v3_req
distinguished_name = dn

[dn]
C = CA
ST = $Country
L = $City
O = $Fname
OU = $Fname
emailAddress = $Demail
CN = $BASE_DOMAIN

[v3_req]
subjectAltName = @alt_names

[alt_names]
DNS.1 = *.$BASE_DOMAIN
DNS.2 = $BASE_DOMAIN
EOF

# The file name can be anything
FILE_NAME="$BASE_DOMAIN"

# Remove previous keys
echo "Removing existing certs like $FILE_NAME.*"
find -maxdepth 1 -type f -name $FILE_NAME.crt -exec rm -rv "{}" + >/dev/null
find -maxdepth 1 -type f -name $FILE_NAME.key -exec rm -rv "{}" + >/dev/null
find -maxdepth 1 -type f -name $FILE_NAME.info -exec rm -rv "{}" + >/dev/null

echo "Generating certs for $BASE_DOMAIN"

# Generate our Private Key, CSR and Certificate
# Use SHA-2 as SHA-1 is unsupported from Jan 1, 2017

openssl req -new -x509 -newkey rsa:2048 -sha256 -nodes -keyout "$FILE_NAME.key" -days $DAYS -out "$FILE_NAME.crt" -passin pass:$PASSPHRASE -config "$CONFIG_FILE"

# OPTIONAL - write an info to see the details of the generated crt
openssl x509 -noout -fingerprint -text < "$FILE_NAME.crt" > "$FILE_NAME.info"

# Protect the key
chmod 400 "$FILE_NAME.key"

## Registred from ssl
if [ -d $path_ssl ]; then
  cat $FILE_NAME.key > $path_ssl/private/privkey_$FILE_NAME.pem;
  cat $FILE_NAME.crt > $path_ssl/private/fullchain_$FILE_NAME.pem;
  cat $FILE_NAME.crt > $path_ssl/certs/$FILE_NAME.pem;
  cat $FILE_NAME.key >> $path_ssl/certs/$FILE_NAME.pem;
  cd $path_ssl/certs;
  chmod 600 $FILE_NAME.pem
  ln -sf $FILE_NAME.pem `openssl x509 -noout -hash < $FILE_NAME.pem`.0
  cd $path_ssl
fi
if [ "$opt" == "pve" ];then
  pve_name="$HOSTNAME"
  if [ -d /etc/pve/nodes/$pve_name ];then
    cat $path_script/$FILE_NAME.crt >/etc/pve/nodes/$pve_name/pve_ssl.pem
    cat $path_script/$FILE_NAME.key >/etc/pve/nodes/$pve_name/pve_ssl.key
    sudo pveproxy restart
  fi
fi
}

case "$cmd" in
  ## create cert
  "--create" | "--create" )
  createSSL;
  ;;

  ## start defaults
  * )
  echo "script - $sname"
  echo "version- $version"
  echo "start create ssl certs: creatcert --create"
  echo "start create ssl cert for poroxmox pve node: --create pve"
  echo " Vanted: write from script manual values for domain!"
  ;;
esac

exit