dehydrated-hook

# This Source Code Form is subject to the terms of the Mozilla Public
# License, v. 2.0. If a copy of the MPL was not distributed with this
# file, You can obtain one at https://mozilla.org/MPL/2.0/.

# Copyright 2024 MNX Cloud, Inc.

# shellcheck shell=bash

function restart_service() {
    local SERVICE="${1}"

    # This hook is called once for each service to restart
    #
    # Parameters:
    # - SERVICE
    #   The service identifier to restart

    if svcs -H "${SERVICE}" | grep ^online; then
        printf 'Restarting %s...' "${SERVICE}"
        svcadm restart "${SERVICE}"
        printf 'done.\n'
    else
        printf 'Service "%s" is not online, skipping.\n' "${service}"
    fi
}

function ensure_haproxy {
    haproxy_state=$(svcs -Ho state haproxy)
    case "$haproxy_state" in
        disabled)
            svcadm enable -s haproxy ;;
        maintenance)
            svcadm clear haproxy ;;
        online)
            # Graceful restart of haproxy to avoid disrupting any connections.
            # Don't let this fail so we don't get caught by errexit.
            pkill -USR2 -c "$(svcs -Ho ctid haproxy)" haproxy || true;;
        *)
            echo 'HAProxy non-actionable state: %s' "$haproxy_state"
            ;;
    esac
}

function deploy_cert {
    local domain="${1}" keyfile="${2}" certfile="${3}" fullchainfile="${4}" chainfile="${5}"

    if [[ -n "$OWNER" ]]; then
        chown -R "$OWNER" "${CERTDIR:?}"
    fi
    # Really, we don't expect users to be installing anything beyond haproxy
    # that is already present. But we'll still leave the possibility, just
    # in case.
    for service in "${SERVICES[@]:?}"; do
        restart_service "$service"
    done

    # We need a default symlink to CERTDIR so that haproxy doesn't need to know
    # the name.
    if [[ -L ${CERTDIR}/../default ]]; then
        ln -s "${CERTDIR}" "${CERTDIR}/../default"
    fi

    # Unlike other services, we will make every attempt to bring haproxy to
    # online state if it isn't, for whatever reason.
    ensure_haproxy
}

function unchanged_cert {
    # shellcheck disable=SC2034
    local domain="${1}" keyfile="${2}" certfile="${3}" fullchainfile="${4}" chainfile="${5}"

    echo "Certificate unchanged."
}

if [[ -f ${BASEDIR:?}/config.overrides ]]; then
    # shellcheck disable=SC1091
    source "${BASEDIR}/config.overrides"
fi