generate-vhosts

#!/bin/bash
PREFIX=${1:-com.example}
CONSUL=${CONSUL:-error}
if [ "${CONSUL}" == "error" ]
then
	echo "No consul server set." && exit 1
fi

GENERATOR=${GENERATOR:-disabled}
MYSQL_HOST=${MYSQL_HOST:-disabled}
HOSTMASTER=${HOSTMASTER:-disabled}

if [ "${MYSQL_HOST}" != "disabled" ]
then
	MYSQL_USER=${MYSQL_USER?user missing}
	MYSQL_PASS=${MYSQL_PASS?pass missing}
	MYSQL_DB=${MYSQL_DB?db missing}
fi

DOCKER_SOCK=/var/run/docker.sock

CONF_KEY=${PREFIX}.haproxy
CERT_KEY=${CONF_KEY}.certificates
FILE_KEY=${CONF_KEY}.files
DOMAINS_KEY=${CONF_KEY}.domains

CONF_SRC=${CONSUL}/v1/kv/${CONF_KEY}/
CERT_SRC=${CONSUL}/v1/kv/${CERT_KEY}/
FILE_SRC=${CONSUL}/v1/kv/${FILE_KEY}/
DOMAINS_SRC=${CONSUL}/v1/kv/${DOMAINS_KEY}/

CONFSTORE=/usr/local/etc/haproxy
CERTSTORE=${CONFSTORE}/certificates
FILESTORE=${CONFSTORE}/files

TEMPSTORE=/etc/swarm-gen

function cleanup { echo "SIGINT or SIGTERM hit." && exit 0; }

trap cleanup SIGINT SIGTERM

function join_by { local IFS="$1"; shift; echo "$*"; }

function get_service {
	local result=$1
	
	local id=${2?-error}
	if [ "${id}" == "error" ]
	then
		echo "No id set." && exit 1
	fi
	
	local content=$(curl -sg --unix-socket ${DOCKER_SOCK} http://docker/services/${id} | jq .)
	
	eval $result="'${content}'"
}

function get_filtered_services {
	local result=$1
	
	local LABEL=${2:-error}
	if [ "${LABEL}" == "error" ]
	then
		echo "No LABEL set." && exit 1
	fi
	
	local data=$(curl -s -g --unix-socket ${DOCKER_SOCK} http://docker/services?filters={%22label%22:[%22${LABEL}%22]} | jq .[].Spec.Name)
	
	eval $result="'${data}'"
}

function get_containers {
        local result=$1

        local SERVICE=${2:-error}
        if [ "$SERVICE" == "error" ]
        then
                echo "No SERVICE set." && exit 1
        fi

        local data=$(curl -s -g --unix-socket ${DOCKER_SOCK} http://docker/tasks?filters={%22service%22:[%22${SERVICE}%22]} | jq ".[] | select(.Status.State == \"running\") | .Status.ContainerStatus.ContainerID")

        eval $result="'${data}'"
}

function signal_container {
	local CONTAINER_ID=${1:-error}
	if [ "${CONTAINER_ID}" == "error" ]
	then
		echo "No LABEL set." && exit 1
	fi
	local SIGNAL=${2:-error}
	if [ "${SIGNAL}" == "error" ]
	then
		echo "No SIGNAL set." && exit 1
	fi
	
	local output=$(curl -s -X POST --unix-socket ${DOCKER_SOCK} http://docker/containers/${CONTAINER_ID}/kill?signal=${SIGNAL})
}

function swarm_force_service_reload {
	local id="${1?-error}"
	if [ "${id}" == "error" ]
	then
		echo "No id set." && exit 1
	fi
	get_containers CONTAINERS ${id}
	
	for CONTAINER in ${CONTAINERS}
	do
		signal_container ${CONTAINER} "HUP"
	done
}

function notify_containers {
	local FRONTEND_LABEL=${CONF_KEY}.frontend
	
	get_filtered_services SERVICES "${FRONTEND_LABEL}"
	
	for SERVICE in ${SERVICES}
	do
		SERVICE=$(echo ${SERVICE} | tr -d '"')
		swarm_force_service_reload ${SERVICE}
	done
}

function generate_new_file {
	local result=$1
	local TEMP_FILE=${2?filename missing}.new
	local TEMPLATE=${3?template missing}
	local INPUT=${4?data missing}
	
	touch ${TEMP_FILE}
	
	echo ${INPUT} | mustache - ${TEMPLATE} > ${TEMP_FILE}
	
	eval $result="'${TEMP_FILE}'"
}

function handle_file_change {
	local result=$1
	
	local FILE1="${2?missing file1}"
	local FILE2="${3?missing file2}"
	
	touch ${FILE1}
	touch ${FILE2}
		
	local CHANGED_LINES=$(comm -3 "${FILE1}" "${FILE2}" | wc -l)
		
	if [ ${CHANGED_LINES} -gt 0 ]
	then
		mv -f "${FILE1}" "${FILE2}"
		eval $result=1
	else
		rm "${FILE1}"
		eval $result=0
	fi
}

function fetch_files {
	rm -rf "${FILESTORE}"
	mkdir -p "${FILESTORE}"
	local FILE_DATA=$(curl -s --get --data-raw "recurse" "${FILE_SRC}" | jq -r ".[]? | [(.Key | split(\"/\") | del(.[0]) | join(\"/\")), (.Value)] | join(\":\")")
	for row in ${FILE_DATA}; do
		local CUR_FILE=$(echo "${row}" | cut -d ":" -f 1)
		echo "${row}" | cut -d ":" -f 2 | base64 -d > ${FILESTORE}/${CUR_FILE}
	done
}

function fetch_certs {
	rm -rf "${CERTSTORE}"
	mkdir -p "${CERTSTORE}"
	local FILE_DATA=$(curl -s --get --data-raw "recurse" "${CERT_SRC}" | jq -r ".[]? | [(.Key | split(\"/\") | del(.[0]) | join(\"/\")), (.Value)] | join(\":\")")
	for row in ${FILE_DATA}; do
		local CUR_FILE=$(echo "${row}" | cut -d ":" -f 1)
		echo "${row}" | cut -d ":" -f 2 | base64 -d > ${CERTSTORE}/${CUR_FILE}
	done
}

function put_file {
	local KEY=${1:-error}
	if [ "${KEY}" == "error" ]
	then
		echo "No KEY set." && exit 1
	fi
	local FILENAME=${2:-error}
	if [ "${FILENAME}" == "error" ]
	then
		echo "No FILENAME set." && exit 1
	fi
	local result=$(curl -s --request PUT --data-binary @$FILENAME "${CONSUL}/v1/kv/${KEY}")
}

function update_config {
	if [ "${GENERATOR}" != "disabled" ]
	then
		fetch_files
		fetch_certs

		local CONF_DATA=$(curl -s --get --data-raw "recurse" "${CONF_SRC}" | jq "[ .[]? | { key: .Key | split(\"/\") | del(.[0]), val: (.Value | if length > 0 then . | @base64d else \"\" end) } ] | [ group_by(.key[0])[] | { key: (.[0].key[0]), value: map([(del(.key[0]) | .key | join(\"/\")), .val] | join(\" \")) } ] | { data: . }")
		local CONF_TEMPLATE=${TEMPSTORE}/haproxy.cfg.mustache
		local CONF_OUTPUT=${CONFSTORE}/haproxy.cfg
		local H1_OUTPUT=${CONFSTORE}/http11.map
		local H2_OUTPUT=${CONFSTORE}/http2.map
		local H1_NEW=${H1_OUTPUT}.new
		local H2_NEW=${H2_OUTPUT}.new
				
		generate_new_file CONF_NEW ${CONF_OUTPUT} ${CONF_TEMPLATE} "${CONF_DATA}"
		
		local DOMAIN_DATA=$(curl -s --get --data-raw "recurse" "${DOMAINS_SRC}" | jq -r "[ .[] | .Key = (.Key | split(\"/\") | del(.[0]) | join(\"/\")) | .Domain = (.Key | split(\"/\") | .[0]) | .Key = (.Key | split(\"/\") | del(.[0]) | join(\"/\")) | .Value = (if .Value | length > 0 then .Value | @base64d else .Value end) ] | [ group_by(.Domain)[] | ([ {"domain": .[0].Domain}, (.[] | {(.Key): (.Value)}) ] | add) ]")
		
		echo "${DOMAIN_DATA}" | jq -r ".[] | [ .domain, .[\"backend/h1\"] ] | join(\" \")" > ${H1_NEW}
		echo "${DOMAIN_DATA}" | jq -r ".[] | [ .domain, .[\"backend/h2\"] ] | join(\" \")" > ${H2_NEW}

		handle_file_change CONF_CHANGED ${CONF_NEW} ${CONF_OUTPUT}
		handle_file_change H1_CHANGED ${H1_NEW} ${H1_OUTPUT}
		handle_file_change H2_CHANGED ${H2_NEW} ${H2_OUTPUT}
		
		if [ "${CONF_CHANGED}" != "0" ] || [ "${H1_CHANGED}" != "0" ] || [ "${H2_CHANGED}" != "0" ]
		then
			echo "Configuration updated."
			notify_containers
		fi
	fi
}

function update_dns {
	if [ "${MYSQL_HOST}" != "disabled" ]
	then
		local DOMAIN_DATA=$(curl -s --get --data-raw "recurse" "${DOMAINS_SRC}" | jq -r "[ .[] | .Key = (.Key | split(\"/\") | del(.[0]) | join(\"/\")) | .Domain = (.Key | split(\"/\") | .[0]) | .Key = (.Key | split(\"/\") | del(.[0]) | join(\"/\")) | .Value = (if .Value | length > 0 then .Value | @base64d else .Value end) ] | [ group_by(.Domain)[] | ([ {"domain": .[0].Domain}, (.[] | {(.Key): (.Value)}) ] | add) ]")
		local DNS_DATA=$(echo "${DOMAIN_DATA}" | jq "{ recordtag: \"gmbh.bot.haproxy\" , hosts: [ .[] | { id: .id, domain: .domain, endpoint: .endpoint } ] }")
		local DNS_TEMPLATE=${TEMPSTORE}/updatepdns.sql.mustache
		local DNS_UPDATE=${TEMPSTORE}/updatepdns.sql
		local DNS_UPDATE_NEW=${DNS_UPDATE}.new
		
		generate_new_file DNS_UPDATE_NEW ${DNS_UPDATE} ${DNS_TEMPLATE} "${DNS_DATA}"
		
		handle_file_change CHANGED ${DNS_UPDATE_NEW} ${DNS_UPDATE}
		
		if [ "${CHANGED}" != "0" ]
		then
			mysql --host="${MYSQL_HOST}" --user="${MYSQL_USER}" --password="${MYSQL_PASS}" --database="${MYSQL_DB}" < ${DNS_UPDATE}
		fi
	fi
}

function update_certificates {
	if [ "${HOSTMASTER}" != "disabled" ]
	then
		local DOMAIN_DATA=$(curl -s --get --data-raw "recurse" "${DOMAINS_SRC}" | jq -r "[ .[] | .Key = (.Key | split(\"/\") | del(.[0]) | join(\"/\")) | .Domain = (.Key | split(\"/\") | .[0]) | .Key = (.Key | split(\"/\") | del(.[0]) | join(\"/\")) | .Value = (if .Value | length > 0 then .Value | @base64d else .Value end) ] | [ group_by(.Domain)[] | ([ {"domain": .[0].Domain}, (.[] | {(.Key): (.Value)}) ] | add) ]")
		mapfile -t REQUESTS <<< $(echo "${DOMAIN_DATA}" | jq -r "[ .[] | { domain: .domain, backend: .[\"backend/h1\"] }, { domain: .domain, backend: .[\"backend/h2\"] } ] | group_by(.backend)[] | unique_by(.domain) | [ .[] | .domain ] | join(\" \")")
		for ENTRIES in "${REQUESTS[@]}"
		do
			local ENTRY=(${ENTRIES})
			local DOMAINS=$(for k in "${ENTRY[@]}"; do echo "-d ${k}"; done)
			local DOMAINS=$(join_by " " ${DOMAINS})
			certbot certonly --noninteractive --agree-tos --standalone --http-01-port 80 --preferred-challenges http --email \"${HOSTMASTER}\" --expand ${DOMAINS}
			local CURRENT_FOLDER=/etc/letsencrypt/live/${ENTRY[0]}
			if [ -d ${CURRENT_FOLDER} ]
			then
				mkdir -p ${CERTSTORE}
				local CURRENT_CERT=${CERTSTORE}/${ENTRY[0]}
				cat ${CURRENT_FOLDER}/fullchain.pem ${CURRENT_FOLDER}/privkey.pem > ${CURRENT_CERT}
				put_file "${CERT_KEY}/${ENTRY[0]}" "${CURRENT_CERT}"
				rm -rf "${CURRENT_CERT}"
			fi
		done
	fi
}

while [ 1 ]
do
	update_dns
	update_certificates
	update_config
	sleep 60
done