#!/bin/sh
#
# Univention Join
#  join script
#
# SPDX-FileCopyrightText: 2004-2026 Univention GmbH
# SPDX-License-Identifier: AGPL-3.0-only

## joinscript api: bindpwdfile

VERSION=23
. /usr/share/univention-join/joinscripthelper.lib
joinscript_init

. /usr/share/univention-lib/all.sh

eval "$(univention-config-registry shell)"

if [ "$server_role" = "domaincontroller_master" ]; then
	if test -e /etc/slave-join.secret; then
		slave_join_pwd=`cat /etc/slave-join.secret`
	else
		slave_join_pwd=$(create_machine_password)
		echo -n "$slave_join_pwd" >/etc/slave-join.secret
	fi
	if test -e /etc/backup-join.secret; then
		backup_join_pwd=`cat /etc/backup-join.secret`
	else
		backup_join_pwd=$(create_machine_password)
		echo -n "$backup_join_pwd" >/etc/backup-join.secret
	fi

	ucs_registerLDAPExtension "$@" \
		--ucsversionstart "5.2-5" --ucsversionend "5.99-0" \
		--data /usr/share/univention-join/ensure-minmum-ucs-version --data_type="join/pre-join" || die

	univention-directory-manager groups/group create "$@" --ignore_exists --position "cn=groups,$ldap_base" --set name="Backup Join"     --set description="Group for joining Backup Directory Node servers" || die
	univention-directory-manager groups/group create "$@" --ignore_exists --position "cn=groups,$ldap_base" --set name="Slave Join"      --set description="Group for joining Replica Directory Node servers" || die
	if [ ${#backup_join_pwd} -gt 7 ]; then
		univention-directory-manager users/user create "$@" --ignore_exists \
					--position "cn=users,$ldap_base" \
					--set username="join-backup" \
					--set primaryGroup="cn=Backup Join,cn=groups,$ldap_base" \
					--set unixhome="/dev/null" \
					--set password="$backup_join_pwd" \
					--set lastname="Joinuser" \
					--set objectFlag=hidden \
					--append groups="cn=Slave Join,cn=groups,$ldap_base" \
					--append groups="cn=DC Backup Hosts,cn=groups,$ldap_base" \
					--append groups="cn=DC Slave Hosts,cn=groups,$ldap_base" || die
	else
		echo "join-backup PWD too short"
	fi
	if [ ${#slave_join_pwd} -gt 7 ]; then
		univention-directory-manager users/user create "$@" --ignore_exists \
					--position "cn=users,$ldap_base"  \
					--set username="join-slave"  \
					--set primaryGroup="cn=Slave Join,cn=groups,$ldap_base"  \
					--set unixhome="/dev/null" \
					--set password="$slave_join_pwd"  \
					--set lastname="Joinuser"  \
					--set objectFlag=hidden \
					--append groups="cn=DC Slave Hosts,cn=groups,$ldap_base" || die
	else
		echo "join-slave PWD too short"
	fi

fi

if command -v sss_cache >/dev/null; then
	sss_cache -U
fi
if is_ucr_true nss/group/cachefile; then
	/usr/lib/univention-pam/ldap-group-to-file.py
else
	# test -x /usr/sbin/sss_cache && sss_cache -G
	test -x /usr/sbin/nscd && nscd -i group
fi

sleep 2

if [ "$server_role" = "domaincontroller_master" -o "$server_role" = "domaincontroller_backup" -o "$server_role" = "domaincontroller_slave" ]; then
	test -e /etc/backup-join.secret && chgrp "Backup Join" /etc/backup-join.secret && chmod 640 /etc/backup-join.secret
	test -e /etc/slave-join.secret  && chgrp "Slave Join"  /etc/slave-join.secret  && chmod 640 /etc/slave-join.secret

	chgrp "DC Backup Hosts" /etc/univention/ssl/

	test -e /etc/univention/ssl/openssl.cnf && chgrp "DC Backup Hosts" /etc/univention/ssl/openssl.cnf    && chmod g+rw /etc/univention/ssl/openssl.cnf

	test -e /etc/univention/ssl/password    && chgrp "DC Backup Hosts" /etc/univention/ssl/password       && chmod g+rw /etc/univention/ssl/password

	test -d "/etc/univention/ssl/$hostname" && chgrp -R "DC Backup Hosts" "/etc/univention/ssl/$hostname" && chmod g+rx "/etc/univention/ssl/$hostname" && find "/etc/univention/ssl/$hostname/" -type f | xargs chmod g+rw

	if [ -d /etc/univention/ssl/ucsCA ]; then
		chgrp -R "DC Backup Hosts" /etc/univention/ssl/ucsCA
		find /etc/univention/ssl/ucsCA/ -type d | xargs chmod g+rwx
		find /etc/univention/ssl/ucsCA/ -type f | xargs chmod g+rw
	fi

	test -e /etc/ldap-backup.secret && chgrp "DC Backup Hosts"  /etc/ldap-backup.secret && chmod 640 /etc/ldap-backup.secret
	test -e /etc/univention/ssl/ucsCA/CAcert.pem && chgrp "DC Slave Hosts"  /etc/univention/ssl/ucsCA/CAcert.pem && chmod 644 /etc/univention/ssl/ucsCA/CAcert.pem

	if [ -d "/etc/univention/ssl/univention-directory-manager" ]; then
		chgrp -R "DC Backup Hosts" /etc/univention/ssl/univention-directory-manager
		find /etc/univention/ssl/univention-directory-manager/ -type d | xargs chmod g+rwx
		find /etc/univention/ssl/univention-directory-manager/ -type f | xargs chmod g+rw
	fi

	test -e /etc/ldap.secret && chgrp "DC Backup Hosts" /etc/ldap.secret && chmod 640 /etc/ldap.secret

	if [ -d /var/lib/heimdal-kdc ]; then
		chgrp -R "DC Backup Hosts" /var/lib/heimdal-kdc
		find /var/lib/heimdal-kdc/ -type d | xargs chmod g+rwx
		find /var/lib/heimdal-kdc/ -type f | xargs chmod g+rw
	fi

	if [ -e /etc/univention/ssl ]; then
		res=`find /etc/univention/ssl/ -group root`
		if [ -n "$res" ]; then
			find /etc/univention/ssl/ -group root | xargs chown root:"DC Backup Hosts"
		fi
	fi
fi

udm computers/$server_role modify "$@" --dn "$ldap_hostdn" \
		--set operatingSystem="Univention Corporate Server" \
		--set operatingSystemVersion="$version_version-$version_patchlevel" || die

# create ssl/validity/... to avoid nagios UNIVENTION_SSL warnings
if [ -x /usr/sbin/univention-certificate-check-validity ]; then
	/usr/sbin/univention-certificate-check-validity
fi

joinscript_save_current_version

exit 0
