#!/bin/bash

# Given a URL pointing to a git repo and a NAME deploys a static site
# containing the contents of the URL to https://NAME.negativefour.app.
#
# The expectation is that this is run on a server running apache2 and
# Tor with SSL certificates for *.negativefour.app. Information about
# how to configure this server can be found in docs/.
#
# Note that at the moment this will only deploy webpages at
# negativefour.app subdomains. In order to deploy webpages for custom
# domains we will need to add logic to automatically configure SSL
# certificates.

# Copyright (C) 2021  Zeke Medley
#
# This program is free software: you can redistribute it and/or
# modify it under the terms of the GNU Affero General Public License
# as published by the Free Software Foundation, either version 3 of
# the License, or (at your option) any later version.
#
# This program is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
# Affero General Public License for more details.
#
# You should have received a copy of the GNU Affero General Public
# License along with this program.  If not, see
# <https://www.gnu.org/licenses/>.

set -e
set -u
set -o pipefail

REPO=$1
NAME=$2
URL="$NAME.negativefour.app"

git clone "$REPO" "/home/admin/www/html/$URL"

PORT=$((3100 + `ls /etc/apache2/sites-available/ | wc -l`))

cat <<EOF >> "/etc/tor/torrc"
HiddenServiceDir /var/lib/tor/${URL}/
HiddenServicePort 80 127.0.0.1:${PORT}

EOF

systemctl restart tor

sleep 3

UNION_URL=$(sudo cat "/var/lib/tor/${URL}/hostname")

cat <<EOF > "/etc/apache2/sites-available/${URL}.conf"
Listen $PORT

# Listen on port 80 but redirect to 443.
<VirtualHost *:80>
	     ServerAdmin zekemedley@gmail.com
	     ServerName $URL
	     DocumentRoot /home/admin/www/html/$URL
	     DirectoryIndex index.html
	     ErrorLog \${APACHE_LOG_DIR}/${URL}_error.log
	     CustomLog \${APACHE_LOG_DIR}/${URL}_access.log combined
	     Redirect permanent / https://${URL}/
</VirtualHost>

<VirtualHost 127.0.0.1:${PORT}>
	     ServerAdmin zekemedley@gmail.com
	     ServerName ${URL}
	     DocumentRoot /home/admin/www/html/${URL}
	     DirectoryIndex index.html
	     ErrorLog \${APACHE_LOG_DIR}/${URL}_error.log
	     CustomLog \${APACHE_LOG_DIR}/${URL}_access.log combined
</VirtualHost>

<IfModule mod_ssl.c>
<VirtualHost *:443>
	     ServerAdmin zekemedley@gmail.com
	     ServerName $URL
	     DocumentRoot /home/admin/www/html/${URL}
	     DirectoryIndex index.html
	     ErrorLog \${APACHE_LOG_DIR}/${URL}_error.log
	     CustomLog \${APACHE_LOG_DIR}/${URL}_access.log combined

	     # We only set the union location header for the https
	     # version of the website as union location will not work
	     # for http. See:
	     # https://community.torproject.org/onion-services/advanced/onion-location/
	     Header set Onion-Location "http://${UNION_URL}%{REQUEST_URI}s"

	     SSLCertificateFile /etc/letsencrypt/live/negativefour.app/fullchain.pem
	     SSLCertificateKeyFile /etc/letsencrypt/live/negativefour.app/privkey.pem
	     Include /etc/letsencrypt/options-ssl-apache.conf
</VirtualHost>
</IfModule>
EOF

a2ensite "${URL}"

systemctl restart apache2