setup-local-dirs

#!/usr/bin/perl
$| = 1;

# Try a uname based approach first
# Simplistic but sufficient for now
my $osdir = "";
my $uname = `uname -a`;
my $osrel = "";

# Determine env type
my $is_rpm = 0;
my $is_deb = 0;
if ( ( -e "/bin/rpm" || -e "/usr/bin/rpm" ) && ( !-e "/usr/bin/apt-get" ) ) {
    $is_rpm = 1;
}
elsif ( -e "/usr/bin/apt-get" ) {
    $ENV{DEBIAN_FRONTEND} = "noninteractive";
    $is_deb = 1;
}

if ( -e "/etc/fedora-release" ) {
    $osrel = `cat /etc/fedora-release`;
}
elsif ( -e "/etc/os-release" ) {
    $osrel = `cat /etc/os-release`;
}

if ( $uname =~ /\.((fc|el|amzn)\d+\.(x86_64|i\d+))/ ) {
    $osdir = $1;
}
elsif ( $uname =~ /x86_64/ && $osrel =~ /Ubuntu 20/ ) {
    $osdir = "ub20.x86_64";
}
elsif ( $uname =~ /x86_64/ && $osrel =~ /Ubuntu 22/ ) {
    $osdir = "ub22.x86_64";
}
elsif ( $uname =~ /x86_64/ && $osrel =~ /Ubuntu 24/ ) {
    $osdir = "ub24.x86_64";
}
elsif ( $uname =~ /aarch64/ && $osrel =~ /Ubuntu 24/ ) {
    $osdir = "ub24.aarch64";
}
elsif ( $osrel =~ /Raspbian.*7/ ) {
    $osdir = "raspbian7";
}
elsif ( $uname =~ /x86_64/ && $osrel =~ /bookworm/ ) {
    $osdir = "deb12.x86_64";
}
elsif ( $uname =~ /x86_64/ && $osrel =~ /trixie/ ) {
    $osdir = "deb13.x86_64";
}
else {
    die;
}

if ( $is_deb && !-e "/usr/sbin/apache2" ) {
    system( "apt-get", "-y", "install", "apache2-bin" );
}

if ( $is_deb && !-e "/usr/share/apache2/icons/folder.png" ) {
    system( "apt-get", "-y", "install", "apache2-data" );
}

if ( $is_deb && !-e "/usr/bin/htpasswd" ) {
    system( "apt-get", "-y", "install", "apache2-utils" );
}

$osdir =~ s/\./-/go;

if ( !$osdir ) {
    print "Couldn't determine os directory.\n";
}

# Make sure we are running the most current code
if ( $ARGV[0] ne "--skip-git" && -e "/local/apache/.git" ) {
    my @tmp1 = stat("/local/apache/setup-local-dirs");
    chdir("/local/apache") || die "failed to switch to /local/apache";
    system("git pull");
    my @tmp2 = stat("/local/apache/setup-local-dirs");
    if ( $tmp1[9] != $tmp2[9] ) {
        print "Restarting update script, file changed.\n";
        exec( "/local/apache/setup-local-dirs", "--skip-git" );
        exit;
    }
}

if ( !-e "/local/apache/conf-$osdir" ) {
    print "No OS config dir for ($osdir).\n";
    exit;
}

print "Using OS Dir: $osdir\n";
print "Scanning for local apache directories to update...\n";

my %ca_map  = ();
my $ca_base = "/local/apache/ca-certs";
opendir( my $dir, $ca_base );
while ( my $file = readdir($dir) ) {
    next if ( $file eq "." || $file eq ".." );

    open( my $in, "-|" ) || exec( "openssl", "x509", "-in" => "$ca_base/$file", "-subject", "-noout" );
    while ( defined( my $line = <$in> ) ) {
        if ( $line =~ /subject=\s*(.*?)\s*$/o ) {
            my $subject = $1;
            my $pname   = $1;
            $pname =~ s|.*/|.../|go;
            print "Loaded CA ($pname) from ${ca_base}/${file}\n";
            $ca_map{$subject} = "${ca_base}/${file}";
        }
    }
    close($in);
}
closedir($dir);

opendir( DIR, "/local" );
while ( $file = readdir(DIR) ) {
    if ( $file eq "apache-root" || $file =~ /apache-root-.*/ ) {
        if ( !-e "/local/$file/conf/httpd.conf" ) {
            print "$file must not be a server install, no httpd.conf\n";
            next;
        }

        print "Found install at: /local/$file\n";

        $user = undef;
        open( my $in, "/local/$file/conf/httpd.conf" );
        while ( $line = <$in> ) {
            if ( $line =~ /^\s*User\s+(.*?)\s*$/o ) {
                $user = $1;
            }
        }
        close($in);

        if ( $user eq "" ) {
            die "Unable to determine user for /local/$file.\n";
        }

        print "Overwriting common config files in /local/$file/conf.\n";
        system("cp -v /local/apache/conf-$osdir/* /local/$file/conf/");

        print "Cleaning known OLD files in /local/$file/conf.\n";
        unlink("/local/$file/conf/modjk.conf");
        unlink("/local/$file/conf/modfastcgi.conf");

        print "Updating CA chain.crt file.\n";
        system("mkdir -p /local/$file/ssl");

        print "Determining chain crt to populate based on httpd.crt:\n";
        my @certs_to_add = ();
        my $aia_issuer;

        if ( -e "/local/$file/ssl/httpd.crt" ) {
            if ( -e "/local/$file/ssl/httpd-chain.crt" ) {
                push( @certs_to_add, "/local/$file/ssl/httpd-chain.crt" );
            }

            my $self_signed = 0;
            my $issuer;
            my $subject;
            open( my $in, "-|" ) || exec(
                "openssl", "x509",
                "-in" => "/local/$file/ssl/httpd.crt",
                "-issuer", "-subject", "-noout"
            );
            while ( defined( my $line = <$in> ) ) {
                if ( $line =~ /issuer=\s*(.*?)\s*$/o ) {
                    $issuer = $1;
                    print "Found cert issuer: $1\n";
                    if ( $ca_map{$1} ) {
                        push( @certs_to_add, $ca_map{$1} );
                    }
                }
                if ( $line =~ /subject=\s*(.*?)\s*$/o ) {
                    $subject = $1;
                    print "Found cert subject: $1\n";
                }
            }
            close($in);

            if ( $issuer && $issuer eq $subject ) {
                print "Certificate is self signed.\n";
            }
            elsif ( scalar(@certs_to_add) == 0 ) {
                print "No issuer CA matched, looking up Authority Information Access.\n";
                open( my $in, "-|" ) || exec(
                    "openssl", "x509",
                    "-in" => "/local/$file/ssl/httpd.crt",
                    "-text"
                );
                while ( defined( my $line = <$in> ) ) {
                    if ( $line =~ /CA Issuers - URI:(http.*?)\s+/ ) {
                        $aia_issuer = $1;
                        print "Found AIA Issuer: $1\n";
                    }
                }
                close($in);
            }
        }

        if ( scalar(@certs_to_add) == 0 && $aia_issuer ) {
            print "Retrieving AIA issuer certificate...\n";
            my $tmp_cert = "/tmp/tmpcert-$$-" . time;
            if ( -e "/usr/bin/wget" ) {
                system( "/usr/bin/wget", "-q", "-O$tmp_cert", $aia_issuer );
            }
            elsif ( -e "/usr/bin/curl" ) {
                system( "/usr/bin/curl", "-q", "--output", $tmp_cert, $aia_issuer );
            }
            else {
                die "Cannot retrieve upstream AIA issuer cert.";
            }
            system( "openssl", "x509", "-in", $tmp_cert, "-outform", "PEM", "-out", "/local/$file/ssl/issuer.crt" );
            push( @certs_to_add, "/local/$file/ssl/issuer.crt" );
        }

        # Insure it's not empty, otherwise error on startup
        if ( scalar(@certs_to_add) == 0 && -e "/local/$file/ssl/httpd.crt" ) {
            push( @certs_to_add, "/local/$file/ssl/httpd.crt" );
        }

        my $merge_count = 0;
        open( my $out, ">/local/$file/ssl/chain.crt" );
        foreach my $file (@certs_to_add) {
            print "  Merging $file...\n";
            open( my $in, "<$file" );
            while ( defined( my $line = <$in> ) ) {
                print $out $line;
            }
            close($in);
            print $out "\n";
            if ( $file =~ m|apache/ca-certs|io || $file =~ /issuer.crt/ ) {
                $merge_count++;
            }
        }
        close($out);

        if ( $merge_count < 1 ) {
            print "  ###\n";
            print
                "  ### WARNING: Only one chain file found to merge, check for missing chain in /local/apache/ca-certs\n";
            print "  ###\n";
        }

        open( my $out, ">/local/$file/ssl/httpd-with-chain.crt" );
        open( my $in,  "/local/$file/ssl/httpd.crt" );
        while ( defined( my $line = <$in> ) ) {
            print $out $line;
        }
        close($in);
        print $out "\n";
        open( my $in, "/local/$file/ssl/chain.crt" );
        while ( defined( my $line = <$in> ) ) {
            print $out $line;
        }
        close($in);
        close($out);

        print "Fixing perms for /local/$file for user $user.\n";
        &fix_perms( "/local/$file", $user );

        print "Updating scripts for /local/$file.\n";
        &setup_scripts("/local/$file");

        print "Removing any existing local-modules dir.\n";
        &mysystem("rm -rf /local/$file/local-modules");
    }
}

unlink("/home/local/adm/rc-start/rc.500.httpd");
open( OUT, ">/home/local/adm/rc-start/rc.500.httpd" );
print OUT "#!/bin/bash\n";
print OUT "/local/apache/stop-all\n";
print OUT "/local/apache/start-all\n";
close(OUT);
system("chmod 755 /home/local/adm/rc-start/rc.500.httpd");

unlink("/home/local/adm/rc-stop/rc.500.httpd");
open( OUT, ">/home/local/adm/rc-stop/rc.500.httpd" );
print OUT "#!/bin/bash\n";
print OUT "/local/apache/stop-all\n";
close(OUT);
system("chmod 755 /home/local/adm/rc-stop/rc.500.httpd");

sub mysystem {
    my ($cmd) = @_;
    print "+ $cmd\n";
    system($cmd);
}

sub fix_perms {
    my ( $dir, $user ) = @_;

    &mysystem("chown -R root:root $dir");
    &mysystem("chown root:$user $dir");
    &mysystem("chown -R $user:$user $dir/logs");
    &mysystem("chown -R $user:$user $dir/htdocs*");
    &mysystem("mkdir -p $dir/logs");
    &mysystem("chown root:$user $dir/logs");
    &mysystem("chown root:root $dir/logs/pidfile");
    &mysystem("rm -rf $dir/locks");
    &mysystem("mkdir -p $dir/tmp");
    &mysystem("chown $user:$user $dir/tmp");
    &mysystem("chmod -R go-rwx $dir");

    my @pats = glob("$dir/*cgi*");
    if ( $#pats >= 0 ) {
        &mysystem("chmod -R go+rx $dir/*cgi*");
    }

    my @pats = glob("$dir/*cgi*/*cgiwrap*");
    if ( $#pats >= 0 ) {
        &mysystem("chown root:root $dir/*cgi*/*cgiwrap*");
        &mysystem("chmod 4755 $dir/*cgi*/*cgiwrap*");
    }

    &mysystem("chmod go+x $dir");
    &mysystem("chmod g+rx $dir");
    &mysystem("chmod go+x $dir/logs");
    &mysystem("chmod g+rx $dir/logs");

    foreach my $otherdir ( "sessions", "fastcgi", "dav", "mellon" ) {
        if ( -e "$dir/$otherdir" ) {
            if ( $user eq "" ) {
                die "Cannot set $otherdir permissions, no user specified.\n";
            }
            &mysystem("chown -R $user:$user $dir/$otherdir");
        }
    }
}

sub setup_scripts {
    my ($dir) = @_;

    #
    # First start
    #
    unlink("$dir/start");
    open( OUT, ">$dir/start" );
    print OUT "#!/bin/bash\n";
    print OUT "TZ=UTC\n";
    print OUT "export TZ\n\n";

    print OUT "if [ -e $dir/env.sh ]; then\n";
    print OUT ". $dir/env.sh\n";
    print OUT "fi\n\n";

    print OUT "ulimit -HSn 16000\n";

    print OUT "cd $dir\n";
    print OUT "echo Starting Apache in $dir\n";
    if ( -e "/usr/sbin/httpd" ) {
        print OUT "/usr/sbin/httpd -d $dir\n";
    }
    elsif ( -e "/usr/sbin/apache2" ) {
        print OUT "/usr/sbin/apache2 -d $dir -f conf/httpd.conf\n";
    }
    else {
        die "Cannot determine apache executable.\n";
    }
    close(OUT);
    &mysystem("chmod 700 $dir/start");

    #
    # And stop
    #
    unlink("$dir/stop");
    open( OUT, ">$dir/stop" );
    print OUT "#!/bin/bash\n";
    print OUT "cd $dir\n";
    print OUT "if [ -e logs/pidfile ]; then\n";
    print OUT "echo Stopping Apache in $dir with pid \`cat logs/pidfile\`\n";
    print OUT "touch $dir/logs/TMP\n";
    print OUT "kill \`cat logs/pidfile\`\n";
    print OUT "sleep 2\n";
    print OUT "fi\n";
    print OUT "rm -f $dir/logs/TMP $dir/logs/httpd.mm.* $dir/logs/ssl_mutex* $dir/logs/ssl_scache*\n";
    close(OUT);
    &mysystem("chmod 700 $dir/stop");

    #
    # And restart
    #
    unlink("$dir/restart");
    open( OUT, ">$dir/restart" );
    print OUT "#!/bin/bash\n";
    print OUT "cd $dir\n";
    print OUT "./stop\n";
    print OUT "sleep 1\n";
    print OUT "./start\n";
    close(OUT);
    &mysystem("chmod 700 $dir/restart");

    #
    # And reload
    #
    unlink("$dir/reload");
    open( OUT, ">$dir/reload" );
    print OUT "#!/bin/bash\n";
    print OUT "cd $dir\n";
    print OUT "if [ -e logs/pidfile ]; then\n";
    print OUT "echo Reloading Apache in $dir with pid \`cat logs/pidfile\`\n";
    print OUT "kill -HUP \`cat logs/pidfile\`\n";
    print OUT "fi\n";
    close(OUT);
    &mysystem("chmod 700 $dir/reload");
}