#!/bin/sh
#
# Run this as root on a freshly installed Debian machine to integrate
# it with the rest of the NUUG machines.

set -e

# Track changes in /etc
apt install -y etckeeper

# Keep track of correct time
apt install -y ntpsec

# Add some nice tools
apt install -y iotop iftop htop openssh-server vim sudo tmux rsync

# sshd-config
cat > /etc/ssh/sshd_config.d/custom.conf <<EOF
# Don't publish that this is a Debian system
DebianBanner no
EOF
systemctl restart ssh.service

# Make vim use dark mode
cat > /etc/vim/vimrc.local <<EOF
set background=dark
EOF


# Make sure ssh brute force attacs are blocked. We now use fail2ban, which needs rsyslog.
apt install -y fail2ban iptables rsyslog

# Bruk datoformatering i rsyslog som fail2ban skjønner
cat >/etc/rsyslog.d/timeformat.conf <<EOF
\$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
EOF

# Ekskluder vårt eget nettverk fra blokkering
cat > /etc/fail2ban/jail.local <<EOF
[DEFAULT]
ignoreip = 127.0.0.1/8 10.20.0.1/24 158.36.191.152/25
EOF
# Egendefinert ssh-blokkeringsoppsett
cat > /etc/fail2ban/jail.d/sshd.conf <<EOF
[ssh]
enabled = true
port    = ssh
filter  = sshd
logpath = %(sshd_log)s
backend = %(sshd_backend)s
maxretry = 6
findtime = 3600
bantime = 3600
EOF

# Enable munin
apt install -y munin-node
if [ -e /etc/munin/debian-edu-munin-node.conf ] ; then
    # Work on Debian Edu minimal profiles
    muninnodefile=/etc/munin/debian-edu-munin-node.conf
else
    muninnodefile=/etc/munin/munin-node.conf
fi
echo 'allow ^158\.36\.191\.213$' >> $muninnodefile
echo 'allow ^158\.36\.191\.217$' >> $muninnodefile
invoke-rc.d munin-node restart

# Set up NRPE / Nagios
apt install -y nagios-nrpe-server nagios-plugins-standard
mkdir -p /etc/nagios/nrpe.d
cat > /etc/nagios/nrpe.d/sitesummary-nrpe.cfg <<EOF
dont_blame_nrpe=1
include=/etc/nagios/sitesummary-nrpe-commands.cfg
allowed_hosts=sitesummary
EOF
service nagios-nrpe-server restart

# Set up sitesummary
apt install -y sitesummary-client cdpr
mkdir -p /etc/sitesummary/config.d
cat > /etc/sitesummary/config.d/00debconf <<EOF
serverurls="http://sitesummary.nuug.no/cgi-bin/sitesummary-collector.cgi"
EOF
sitesummary-client

# Set up automatic upgrades
echo unattended-upgrades unattended-upgrades/enable_auto_updates boolean true |\
     debconf-set-selections
apt install -y unattended-upgrades


#
# Configure automatic backup
# Script to add rdiff-backup client user and setup SSH access

echo ""
echo "Setter opp klient for daglig rdiff-backup mot Freebeast"
echo ""

set -euo pipefail

apt install -y rdiff-backup

USER="rdfbck"
SSH_DIR="/home/$USER/.ssh"
AUTHORIZED_KEYS="$SSH_DIR/authorized_keys"
SUDOERS_FILE="/etc/sudoers.d/rdiff-backup-client"
SSH_KEY='command="sudo /usr/local/sbin/snapback",from="158.36.191.154",no-port-forwarding,no-X11-forwarding,no-pty ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC/QHCeEKUfpzhVHJTEbVUFxf4npnXmF+/0bLAaYprpmHACzIBEto+k2/QT+amDatN12eTANVrcmycaWjfjrAXRNP9pyAWPrvBu7eRScXmrwaOkD3beenuyOu5MrZ+0OhUKW8UQp0bPxd+f4wrIdwZniYPVc88HnbzULyypACkIww/X5xRNwtZ2bLVn4h4MMfv6oE2Mp9lspLm4Lt7kZsTMSAnTc03GWFB9emru9lvlp4hBD4OEQrWU1lXCm3Rt7PID/5FGwkYjR9r17X5Vm36ybFwywUIIf31NVEqXp1jaLtYVsudEEK6codHybarqgAGqAoGwsC8SeOX6suuUI8rEX404b6MSkH6syBiin5Nd5S3gqdi3dIpvcJFvgluJUyvxk2rMtG1dM49j1MswdlBthY6q9G8UGNd1bhIwd+bqqnvC+f3qkyr3c42CMexEEz5jasNVpOddmDeN4nX7gUPmQBRA3zdkINHljRaWno5bKh2+N/U2tNLPMa1+RJxaaMU= rdfbck@freebeast.nuug.no (rdiff-backup)'

# 1. Create system user with a shell and group
if ! id -u "$USER" >/dev/null 2>&1; then
    adduser --shell /bin/bash --group "$USER"
    echo "User $USER created."
else
    echo "User $USER already exists."
fi

# 2. Create .ssh directory
mkdir -p "$SSH_DIR"
chown "$USER":"$USER" "$SSH_DIR"
chmod 700 "$SSH_DIR"

# 3. Add authorized key
echo "$SSH_KEY" > "$AUTHORIZED_KEYS"
chown "$USER":"$USER" "$AUTHORIZED_KEYS"
chmod 600 "$AUTHORIZED_KEYS"
echo "SSH key installed."

# 4. Setup sudoers for backup script
echo "$USER ALL = NOPASSWD: NOLOG_INPUT: NOLOG_OUTPUT: /usr/local/sbin/snapback" > "$SUDOERS_FILE"
chmod 440 "$SUDOERS_FILE"
echo "Sudoers entry added."

# 5. Fetch snapback script
wget --quiet https://www.nuug.no/tools/backup-script/snapback -O /usr/local/sbin/snapback && chmod +x /usr/local/sbin/snapback

if command -v etckeeper >/dev/null 2>&1; then
    etckeeper commit "rdiff-backup: Sett opp daglig backup"
fi

echo "Client Backup Installation completed successfully."