#!/bin/sh -e

LDAP_CONF_DIR=/etc/openldap/slapd.d
LDAP_DATA_DIR=/var/lib/openldap/openldap-data
LDAP_URLPREFIX=ldap

export LDAP_IPC_URL=ldapi://%2Frun%2Fopenldap%2Fldapi

dc_str=$(echo ${LDAP_FQDN} | sed -e s:[.]:,dc=:g)
[ -z "$LDAP_SUFFIX" ] && export LDAP_SUFFIX=dc=$dc_str

# Set ulimit - See https://github.com/docker/docker/issues/8231
ulimit -n $LDAP_ULIMIT

INITIAL_START=0

if [ ! -d ${LDAP_CONF_DIR} ]; then
    INITIAL_START=1

    # At first startup, create directories and configurations
    [ -z "${LDAP_ROOTDN}" ] && LDAP_ROOTDN=cn=admin,${LDAP_SUFFIX}

    if [ ! -z "$LDAP_ROOTPW" ]; then
        LDAP_ROOTPW_HASH=$(slappasswd -o module-load=pw-pbkdf2.so \
           -h {PBKDF2-SHA512} -s "$LDAP_ROOTPW")
    elif [[ -z "$LDAP_ROOTPW_HASH" && -s /run/secrets/$LDAP_ROOTPW_SECRETNAME ]]; then
        LDAP_ROOTPW_HASH=$(slappasswd -o module-load=pw-pbkdf2.so \
           -h {PBKDF2-SHA512} -s "$(cat /run/secrets/$LDAP_ROOTPW_SECRETNAME)")
    fi
    
    if [ -z "$LDAP_ROOTPW_HASH" ]; then
        echo "** Secret LDAP_ROOTPW_SECRETNAME unspecified **"
        exit 1
    fi

    export LDAP_DATA_DIR

    mkdir -p -m 750 ${LDAP_CONF_DIR} /run/openldap

    if [[ "$(ls -A /etc/ssl/openldap)" ]]; then
        CA_CERT=/etc/ssl/openldap/ca_cert.pem
        SSL_KEY=/etc/ssl/openldap/tls.key
        SSL_CERT=/etc/ssl/openldap/tls.crt

        if [[ -f ${CA_CERT} ]]; then
            echo "TLSCACertificateFile ${CA_CERT}" >> /root/slapd.conf
        fi

        echo "TLSCertificateFile ${SSL_CERT}" >> /root/slapd.conf
        echo "TLSCertificateKeyFile ${SSL_KEY}" >> /root/slapd.conf
        echo "TLSCipherSuite HIGH:-SSLv2:-SSLv3" >> /root/slapd.conf
        LDAP_URLPREFIX=ldaps
    fi

    sed -i -e "s/^#BASE.*/BASE  ${LDAP_SUFFIX}/" /etc/openldap/ldap.conf
    export LDAP_DOMAIN=$(echo ${LDAP_FQDN} | cut -d . -f 1)
    export LDAP_EMAIL_DOMAIN=$(echo "$LDAP_FQDN" | awk -F. '{print $(NF-1)"."$NF}')


    if [[ -n "$LDAP_READONLY_USER_USERNAME" && -n "$LDAP_READONLY_USER_PASSWORD" ]]; then
	echo "encrypting readonly user password..";
	LDAP_READONLY_USER_PASSWORD_ENCRYPTED=$(slappasswd \
						    -o module-load=pw-pbkdf2.so \
						    -h '{PBKDF2-SHA512}' \
						    -s "$LDAP_READONLY_USER_PASSWORD")
	
	export LDAP_READONLY_USER_PASSWORD_ENCRYPTED
    else
	mv /root/ldif/20-readonly-user.ldif /root/ldif/20-readonly-user.ldif.unused
    fi

    # Database structure
    TMP=$(mktemp)
    for file in $(find /root/ldif -type f) /root/slapd.conf; do
        cat "${file}" | envsubst > $TMP
        mv $TMP "${file}"
    done

    cp /root/slapd.conf /etc/openldap/slapd.conf

    slaptest -f /etc/openldap/slapd.conf -F ${LDAP_CONF_DIR} -n0

    # Load LDIF base schemas with slapadd
    if [ ! -s ${LDAP_DATA_DIR}/data.mdb ]; then

	for file in $(find /root/ldif -maxdepth 1 -name '00-*.ldif' -type f | sort); do
            echo "Loading ${file}"
            slapadd -F "${LDAP_CONF_DIR}" -l "${file}" -n1
	done
	    
        if [[ -f /root/ldif/20-readonly-user.ldif ]]; then
            echo "Loading readonly LDAP user"
            slapadd -F "${LDAP_CONF_DIR}" -l /root/ldif/20-readonly-user.ldif -n1
        fi

    fi
fi

touch /var/log/slapd-audit.log

mkdir -p -m 750 /run/openldap

chown -R ldap:ldap ${LDAP_CONF_DIR} ${LDAP_DATA_DIR} /run/openldap \
  /var/log/slapd-audit.log

tail -f -n0 /var/log/slapd-audit.log |
    sed "s/^${LDAP_PWD_ATTRIBUTE}::.*/${LDAP_PWD_ATTRIBUTE}:: --redacted--/" &

# Load ldif files to cn=config, password policies and optional data with ldapadd   
(
    if [[ "${INITIAL_START}" = "1" ]]; then
        sleep 10

        echo 'Loading server additional config'
	for file in $(find /root/ldif -maxdepth 1 -name '01-*.ldif' -type f | sort); do
	    echo "Loading ${file}"
	    envsubst < "${file}" | \
            ldapmodify -Y EXTERNAL -H ${LDAP_IPC_URL}
	done
	
        echo 'Loading password policy'
        envsubst < /root/ldif/10-passwordDefaultPolicy.ldif | \
            ldapadd -Y EXTERNAL -H ${LDAP_IPC_URL}

        if [[ -d /etc/openldap/prepopulate ]]; then

            for file in `find /etc/openldap/prepopulate`; do
                echo "Loading optional file: ${file}"
                envsubst < "${file}" | \
                    ldapadd -Y EXTERNAL -H ${LDAP_IPC_URL}
            done
        fi
    fi

    echo 'Setting user passwords'

    PW_FILE=$(find /run/secrets/$LDAP_USERPW_SECRETNAME -type f | head -1)

    if [[ ! -z "${PW_FILE}" && -s "${PW_FILE}" ]]; then
        awk -F : -v dnattr=${LDAP_DN_ATTR} \
          -v suffix=,${LDAP_OU}${LDAP_SUFFIX} \
          -v pwdattr=${LDAP_PWD_ATTRIBUTE} \
          '{ print "dn: " dnattr "=" $1 suffix "\n" \
          "changetype: modify\n" \
          "replace: " pwdattr "\n" \
          pwdattr ": " $2 "\n" }' <${PW_FILE} | \
        ldapmodify -Y EXTERNAL -H ${LDAP_IPC_URL}
    fi
) &

exec slapd -h "${LDAP_URLPREFIX}:/// ${LDAP_IPC_URL}" \
      -F ${LDAP_CONF_DIR} -u ldap -g ldap -d "${LDAP_LOG_LEVEL}"