webserver.xpl

import xmlpl.stdio;
import xmlpl.process;
import xmlpl.xml;
import xmlpl.unistd;
import xmlpl.gen;
import xmlpl.string;

element webserver;
element filenames;
string default_ip;
string default_ipv6;
string install;
string serial_tag;
string zone_dir;
string key_dir;
string named_user;

string<< config;
string<< certs;


element[] getEmails(element e, string domain) {
  if (webserver/@postmaster && e/email) {
    <email name="postmaster" domain=(domain) alias=(webserver/@postmaster)/>
    <email name="abuse" domain=(domain) alias=(webserver/@postmaster)/>
    <email name="dmarc" domain=(domain) alias=(webserver/@postmaster)/>
  }

  foreach (e/email)
    <email domain=(domain)>
      foreach (./@*) Attribute(name(.), value(.));
    </email>
}


element[] getEmails(element e) {
  <emails>
    foreach (e/domain) {
      element domain = .;
      string name = @name;
      getEmails(., name);

      foreach (./alias)
        getEmails(domain, value(@name));

      foreach (./host)
        getEmails(., value(@name) + "." + name);
    }
  </emails>
}


string getAddress(element email) {
  return value(email/@name) + "@" + value(email/@domain);
}


string[] getAddresses(element email) {
  if (email/@name == "") "@" + value(email/@domain);
  else
    foreach (tokenize(email/@name, ", \n\t"))
      . + "@" + value(email/@domain);
}


string getAliases(element email) {
  string result;

  foreach (tokenize(email/@alias, ", \n\t")) {
    if (result != "") result += ",";
    result += .;
    if (!contains(., "@")) result += "@" + value(email/@domain);
  }

  return result;
}


string[] getDNSServers(element e) {
  if (e/@ns) foreach(tokenize(e/@ns, ", \n\t")) .;
  else getDNSServers(e/..);
}


string getMailServer(element e) {
  if (e/@mx) return e/@mx;
  return getMailServer(e/..);
}


string[] doDomainFile(element e, string name) {
  string ip;
  if (e/@ip) ip = e/@ip;
  else if (!e/@ipv6) ip = default_ip;

  string ipv6;
  if (e/@ipv6) ipv6 = e/@ipv6;
  else if (!e/@ip) ipv6 = default_ipv6;

  "$TTL    1h\n";
  "$ORIGIN " + name + ".\n";
  "@  1D  IN        SOA " + getDNSServers(e)[0] + ". " + getMailServer(e) +
    ". (\n";
  "                              " + serial_tag + " ; serial\n";
  "                              3H ; refresh\n";
  "                             120 ; retry\n";
  "                              2w ; expire\n";
  "                              3h ; minimum\n";
  "                             )\n";

  "; name servers\n";
  foreach (getDNSServers(e))
    "       IN  NS     " + . + ".\n";

  "; certificate authority authorization\n";
  "@      IN  CAA    0 issue \"letsencrypt.org\"\n";
  "@      IN  CAA    0 issuewild \";\"\n";

  "; server host definitions\n";
  foreach (tokenize(ip, ", \n\t")) {
    name + ". IN A   " + . + "\n";

    if (!e/host[@name == "www"])
      "www    IN  A      " + . + " ;web server definition\n";

    if (!e/host[@name == "mail"])
      "mail   IN  A      " + . + " ;mail server definition\n";
  }
  foreach (tokenize(ipv6, ", \n\t")) {
    name + ". IN AAAA   " + . + "\n";

    if (!e/host[@name == "www"])
      "www    IN  AAAA      " + . + " ;web server definition\n";

    if (!e/host[@name == "mail"])
      "mail   IN  AAAA      " + . + " ;mail server definition\n";
  }

  foreach (e/dns-config) {
    "\n  ; Config Start\n";
    ./text();
    "\n  ; Config End\n";
  }

  foreach (e/host) {
    string host = @name;
    string host_ip;
    string host_ipv6;

    if (@ip) host_ip = @ip;
    else host_ip = ip;

    foreach (tokenize(host_ip, ", \n\t")) {
      host + "   IN  A      " + . + "\n";
      "www." + host + "   IN  A      " + . + "\n";
    }

    if (@ipv6) host_ip = @ipv6;
    else host_ipv6 = ipv6;

    foreach (tokenize(host_ipv6, ", \n\t")) {
      host + "   IN  AAAA      " + . + "\n";
      "www." + host + "   IN  AAAA      " + . + "\n";
    }

    foreach (./dns-config) {
      "\n  ; Config Start\n";
      ./text();
      "\n  ; Config End\n";
    }
  }

  :: MX
  name + ". IN MX 1 " + getMailServer(e) + ". ;MX entry\n";

  :: SPF
  string spf = "v=spf1 a mx ";
  foreach (tokenize(ipv6, ", \n\t"))
     spf += "ip6:" + . + " ";
  if (e/@spf) spf += value(e/@spf);
  name + ". IN TXT \"" + spf + " -all\" ;SPF entry\n";

  :: DKIM
  "_domainkey IN TXT \"o=~;\" ;DKIM policy entry\n";
  "_adsp._domainkey IN TXT \"dkim=all\" ;DKIM ADSP entry\n";

  :: DMARC
  if (e/@dmarc != "false")
    "_dmarc IN TXT \"v=DMARC1; p=quarantine; rua=mailto:dmarc@" + name +
      "; ruf=mailto:dmarc@" + name +"\" ;DMARC entry\n";
}


string[] doZone(string name, string file, boolean dnssec) {
  string zonefile = zone_dir + "/" + name + ".zone";
  string owner = "-o " + named_user + " -g " + named_user;

  "zone \"" + name + "\" {\n";
  "  type master;\n";
  "  allow-query {any;};\n";
  "  file \"" + zonefile + "\";\n";
  if (dnssec) {
    "  dnssec-policy default;\n";
    "  inline-signing yes;\n";
    "  key-directory \"" + key_dir + "/" + name + "\";\n";
  }
  "};\n";
  "\n";

  redirect (config) {
    if (dnssec)
      "install -d " + owner + " -m 750 \"" + key_dir + "/" + name + "\"\n";
    "install " + owner + " -m 644 \"" + file + "\" \"" + zonefile + "\"\n";
    "sed -i \"s/" + serial_tag + " ; serial/$NEW ; serial/\" \"" +
      zonefile + "\"\n";
  }
}


string[] doDomain(element e) {
  string name = e/@name;
  string directory = name + "/etc";
  string filename = directory + "/named.conf";
  string pdir = directory;

  if (!exists(pdir))
    (void)system("mkdir -p " + pdir);

  string<< stream = openStringStream(filename);
  redirect (stream) doDomainFile(e, name);
  flush(stream);
  close(stream);

  doZone(name, install + filename, e/@dnssec == "true");

  foreach (e/alias) {
    string name = @name;
    string filename = directory + "/" + name + ".named";

    string<< stream = openStringStream(filename);
    redirect (stream) doDomainFile(e, name);
    flush(stream);
    close(stream);

    doZone(@name, install + filename, @dnssec == "true");
  }
}


string[] doWebBaseConfig(element domain, string name, string root) {
  "  ServerName www." + name + "\n";
  "  ServerAlias " + name;
  foreach (domain/alias)
    " " + value(@name) + " www." + value(@name);
  "\n";

  "  DocumentRoot " + root + "\n";

  "  <Directory " + root + ">\n";
  if (domain/@allow_override)
    "    AllowOverride " + value(domain/@allow_override) + "\n";
  else "    AllowOverride FileInfo Options\n";
  "  </Directory>\n";

  string robots;
  if (domain/@robots) {
    robots = domain/@robots;
    if (left(robots, 1) != "/") robots = name + "/http/" + robots;
  } else if (filenames/@robots) robots = filenames/@robots;
  if (robots != "") {
    if (left(robots, 1) != "/") robots = install + robots;
    "  Alias /robots.txt " + robots + "\n";
  }

  if (domain/location[@proxy]) {
    :: Access restrictions applied later
    "  <Proxy *>\n";
    "    Allow from all\n";
    "  </Proxy>\n";
  }

  foreach (domain/config) {
    "\n  # Config Start\n";
    ./text();
    "\n  # Config End\n";
  }
}


string scopeAttr(element e, string n) {
  if (!e) return "";
  if (e/@*[name(.) == n]) return e/@*[name(.) == n];
  return scopeAttr(e/.., n);
}


string[] doWeb(element domain, string name) {
  string directory = name + "/etc";
  string httpdir = name + "/http";
  string filename = directory + "/apache2.conf";
  string pdir = directory;
  string ifile = install + filename;

  if (!exists(pdir)) (void)system("mkdir -p " + pdir);
  if (!exists(httpdir)) (void)system("mkdir -p " + httpdir);

  boolean webmail = domain/email[!@alias];
  boolean https = domain/@letsencrypt == "true";

  string cert;
  string private;
  string chain;

  if (https) {
    cert    = "/etc/letsencrypt/live/" + name + "/cert.pem";
    private = "/etc/letsencrypt/live/" + name + "/privkey.pem";
    chain   = "/etc/letsencrypt/live/" + name + "/chain.pem";

    if (domain/@cert) {
      cert = domain/@cert;
      if (left(cert, 1) != "/") cert = install + directory + "/" + cert;
    }

    if (domain/@private) {
      private = domain/@private;
      if (left(private, 1) != "/")
        private = install + directory + "/" + private;
    }

    if (domain/@cert_chain) {
      chain = domain/@cert_chain;
      if (left(chain, 1) != "/") chain = install + directory + "/" + chain;
    }
  }

  string<< stream = openStringStream(filename);
  redirect (stream) {
    if (https) {
      :: Skipped until the cert exists so a new domain cannot break the reload
      "<IfFile \"" + cert + "\">\n";
      "<VirtualHost *:443>\n";
      doWebBaseConfig(domain, name, install + name + "/http");

      "  <IfModule mod_headers.c>\n";
      "    Header always set Strict-Transport-Security \"max-age=300\"\n";
      "  </IfModule>\n\n";

      "  <IfModule mod_ssl.c>\n";
      "    SSLEngine on\n";
      "    SSLCertificateFile " + cert + "\n";

      if (private != "")
        "    SSLCertificateKeyFile " + private + "\n";

      if (chain != "")
        "    SSLCertificateChainFile " + chain + "\n";

      "    SetEnvIf User-Agent \".*MSIE.*\" nokeepalive ssl-unclean-shutdown\n";
      "  </IfModule>\n";

      if (webmail) {
        "  Alias /webmail /usr/share/squirrelmail\n\n";

        "  <Directory /usr/share/squirrelmail>\n";
        "    php_flag register_globals off\n";
        "    Options Indexes FollowSymLinks\n";
        "    <IfModule mod_dir.c>\n";
        "      DirectoryIndex index.php\n";
        "    </IfModule>\n";
        "  </Directory>\n";
      }

      if (domain/@dav == "true") {
        "  Alias /webdav " + install + httpdir + "\n";
        "  <Location /webdav>\n";
        "    DAV On\n";
        "    AuthType Digest\n";
        "    AuthName \"Web Dav\"\n";
        "    AuthDigestDomain /webdav\n";
        "    AuthDigestProvider file\n";
        "    AuthUserFile " + install + directory + "/webdav.passwd\n";
        "    Require valid-user\n";
        "  </Location>\n";
      }

      foreach (domain/location) {
        "  <Location " + value(@path) + ">\n";
        if (@proxy != "") {
          "    ProxyPass " + value(@proxy) + "\n";
          "    ProxyPassReverse " + value(@proxy) + "\n";
        }
        "  </Location>\n";
      }

      if (domain/@proxy_buffer != "")
        "  ProxyIOBufferSize " + value(domain/@proxy_buffer) + "\n";

      "</VirtualHost>\n";
      "</IfFile>\n";
    }

    "<VirtualHost *>\n";
    doWebBaseConfig(domain, name, install + name + "/http");

    foreach (domain/webalias) {
      "  Alias " + value(@src) + " " + value(@dst) + "\n";
      "  <Directory " + value(@dst) + ">\n";
      "    order allow,deny\n";
      "    allow from all\n";
      "  </Directory>\n";
    }

    if (https) {
      "  <IfFile \"" + cert + "\">\n";
      "    RewriteEngine On\n";
      "    RewriteCond %{HTTPS} off\n";
      "    RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]\n";
      "  </IfFile>\n";
    }

    foreach (domain/location) {
      "  <Location " + value(@path) + ">\n";
      if (@proxy != "") {
        "    ProxyPass " + value(@proxy) + "\n";
        "    ProxyPassReverse " + value(@proxy) + "\n";
      }

      "  </Location>\n";
    }
    "</VirtualHost>\n";
  }

  redirect(config) {
    foreach (domain/alias) {
      "if [ ! -e " + value(@name) + " ]; then\n";
      "  ln -sf " + name + " " + value(@name) + "\n";
      "fi\n";
    }

    foreach (domain/location[@dav == "true"]) {
      string path = install + httpdir + "/" + value(@path);
      "mkdir -p \"" + path + "\"\n";
      "chown -R www-data \"" + path + "\"\n";
    }
  }

  if (https && !domain/@cert) {
    :: Cert names match ServerName and ServerAlias, so every alias must
    :: resolve to this server
    string sans = "-d www." + name + " -d " + name;
    foreach (domain/alias)
      sans += " -d www." + value(@name) + " -d " + value(@name);

    redirect (certs) {
      "\nif [ ! -e \"" + cert + "\" ]; then\n";
      "  echo \"Obtaining certificate for " + name + "\"\n";
      "  certbot certonly --non-interactive --agree-tos \\\n";
      "    --email " + value(webserver/@webmaster) + " \\\n";
      "    --webroot -w \"" + install + httpdir + "\" \\\n";
      "    --cert-name " + name + " " + sans + " ||\n";
      "    echo \"WARNING: certbot failed for " + name + "\"\n";
      "fi\n";
    }
  }

  flush(stream);
  close(stream);

  "Include " + ifile + "\n";
}


void doNamedConf(element e, string filename) {
  string serialFile = "/var/lib/bind/serial";
  string owner = "-o " + named_user + " -g " + named_user;

  redirect (config) {
    "\ninstall -d " + owner + " -m 750 \"" + zone_dir + "\"\n";
    "install -d " + owner + " -m 750 \"" + key_dir + "\"\n";
    "NEW=$(date +%Y%m%d%H)\n";
    "OLD=$(cat " + serialFile + " 2>/dev/null || echo 0)\n";
    "[ \"$NEW\" -le \"$OLD\" ] && NEW=$((OLD + 1))\n";
    "echo \"$NEW\" >" + serialFile + "\n\n";
  }

  string<< stream = openStringStream(filename);
  redirect (stream)
    foreach (e/domain) doDomain(.);
  flush(stream);
  close(stream);

  redirect (config) "\nsystemctl reload bind9\n";
}


node[] doWebIndex(string name) {
  <li><a href=("http://" + name + "/")>name;</a></li>
}


void doApache2Conf(element e, string filename) {
  string<< stream = openStringStream(filename);
  if (!exists("http")) system("mkdir -p http");
  node<< index = openNodeStream("http/index.html");

  redirect (index)
  <html>
    <head><title>"Cauldron Development - Websites";</title></head>
    <body>
      <h2>"Cauldron Development - Websites";</h2>
      <ul>

      redirect (stream) {
        foreach (e/domain) {
          string name = @name;
          if (@web != "false") {
            doWeb(., name);
            redirect(index) doWebIndex("www." + name);
          }

          foreach (./host[@web != "false"]) {
            doWeb(., value(@name) + "." + name);
            redirect(index) doWebIndex(value(@name) + "." + name);
          }
        }
      }
    </ul>
    </body>
  </head>

  flush(stream);
  close(stream);
  flush(index);
  close(index);

  redirect (config) {
    :: Reload first so new HTTP vhosts can answer the ACME challenges, then
    :: again to pick up the certs just issued
    "\nsystemctl reload apache2\n";
    "bash \"" + install + value(filenames/@letsencrypt) + "\"\n";
    "systemctl reload apache2\n";
  }
}


string[] doPostfixVhost(element domain, string name) {
  name + "\n";

  foreach (domain/host)
    value(@name) + "." + name + "\n";
}


void doPostfixVhosts(element e, string filename) {
  string<< stream = openStringStream(filename);
  redirect (stream)
    foreach (e/domain[@mail != "false"]) {
      element domain = .;
      doPostfixVhost(domain, @name);

      foreach (domain/alias)
        doPostfixVhost(domain, @name);
    }
  flush(stream);
  close(stream);
}


void doPostfixVmaps(element emails, string filename) {
  string<< stream = openStringStream(filename);
  redirect (stream)
    foreach (emails/email[@alias == ""]) {
      getAddress(.) + " " + value(@domain) + "/" + value(@name) + "/\n";

      redirect (config) {
        string maildir =
          value(webserver/postfix/@maildir) + "/" + value(@domain) + "/" +
            value(@name);

        foreach ("new", "cur", "tmp") {
          string dir = "\"" + maildir + "/" + . + "\"";

          "if [ ! -e " + dir + " ]; then\n";
          "  mkdir -p " + dir + "\n";
          "  chmod 700 " + dir + "\n";
          "fi\n";
        }

        "chown -R " + value(webserver/postfix/@user) + ":" +
          value(webserver/postfix/@group) + " " + maildir + "\n";
      }
    }
  flush(stream);
  close(stream);
}


void doPostfixValias(element emails, string filename) {
  string<< stream = openStringStream(filename);
  redirect (stream)
    foreach (emails/email[@alias != ""]) {
      string aliases = getAliases(.);
      foreach (getAddresses(.)) . + " " + aliases + "\n";
    }

  flush(stream);
  close(stream);
}


string[] doPostfix(element webserver, element emails) {
  :: vhosts
  doPostfixVhosts(webserver, filenames/@vhosts);

  :: vmaps
  doPostfixVmaps(emails, filenames/@vmaps);

  :: valias
  doPostfixValias(emails, filenames/@valias);

  redirect (config) {
    "postmap \"" + install + value(filenames/@vmaps) + "\"\n";
    "postmap \"" + install + value(filenames/@valias) + "\"\n";
    "systemctl reload postfix\n";
  }
}


string[] doDovecot(element emails) {
  string userdb = filenames/@userdb;
  string passdb = filenames/@passdb;

  string<< userDBStream = openStringStream(userdb);

  foreach (emails/email[@alias == ""]) {
    string addr = getAddress(.);

    redirect (userDBStream)
      addr + "::" + value(webserver/dovecot/@uid) + ":" +
      value(webserver/dovecot/@gid) + "::" +
      value(webserver/postfix/@maildir) +
      "/" + value(@domain) + "/:/bin/false::\n";

    redirect (config)
      "if ! grep \"^" + addr + ":\" \"" + passdb + "\" >/dev/null; then\n" +
      "  PASS=\n" +
      "  while [ \"$PASS\" == \"\" ]; do\n" +
      "    echo -n \"Enter initial password for " + addr + ": \"\n" +
      "    read -s PASS\n" +
      "  done\n" +
      "  PASS=\"$(openssl passwd -1 \"$PASS\")\"\n" +
      "  echo \"" + addr + ":$PASS:\" >> \"" + passdb + "\"\n" +
      "fi\n\n";
  }

  flush(userDBStream);
  close(userDBStream);

  redirect (config) {
    "chgrp www-data \"$(dirname \"" + passdb + "\")\"\n";
    "chmod 775 \"$(dirname \"" + passdb + "\")\"\n";
    "chgrp www-data \"" + passdb + "\"\n";
    "chmod 660 \"" + passdb + "\"\n";
    "chmod 644 \"" + userdb + "\"\n";
    "systemctl restart dovecot\n";
  }
}


string[] doOpenDKIM(element webserver) {
  string keyTable = filenames/@opendkim_key_table;
  string signingTable = filenames/@opendkim_signing_table;
  string trustedHosts = filenames/@opendkim_trusted_hosts;

  string<< keyTableStream = openStringStream(keyTable);
  string<< signingTableStream = openStringStream(signingTable);
  string<< trustedHostsStream = openStringStream(trustedHosts);

  redirect(trustedHostsStream)
    "127.0.0.1\n" +
    "localhost\n" +
    value(webserver/@ip) + "\n";
    value(webserver/@ipv6) + "\n";

  foreach (webserver/domain) {
    if (@mail == "false") continue;

    string name = @name;
    string directory = install + name + "/etc";
    string keysDir = directory + "/opendkim";

    redirect(config) {
      :: Create domain key
      "\n";
      "if [ ! -e \"" + keysDir + "/default.private\" ]; then\n";
      "  echo \"Generating domain key for " + name + "\"\n";
      "  mkdir -p \"" + keysDir + "\"\n";
      "  opendkim-genkey -D \"" + keysDir + "\" -r -d \"" + name + "\"\n";
      "  chown opendkim:opendkim \"" + keysDir + "/default.private\"\n";
      "fi\n";

      :: Add domain key TXT entry to domain file
      string domainFile = directory + "/named.conf";
      "if [ -e \"" + domainFile + "\" ]; then\n";
      "  if ! grep ^default._domainkey \"" + domainFile +
        "\" >/dev/null; then\n";
      "    cat \"" + keysDir + "/default.txt\" >> \"" + domainFile + "\"\n";
      "  fi\n";
      "fi\n";
    }

    :: Add domain to trusted hosts
    redirect(trustedHostsStream) name + "\n";

    :: Add domain to keys table
    redirect(keyTableStream)
      "default._domainkey." + name + " " + name + ":default:" + keysDir +
      "/default.private\n";

    :: Add domain to signing table
    redirect(signingTableStream)
      name + " default._domainkey." + name + "\n";
  }

  flush(keyTableStream);
  flush(signingTableStream);
  flush(trustedHostsStream);

  close(keyTableStream);
  close(signingTableStream);
  close(trustedHostsStream);

  redirect(config) "\nsystemctl restart opendkim\n";
}


string[] main(document in, string[] args) {
  webserver      = in/webserver;
  filenames      = webserver/filenames;
  element emails = getEmails(webserver);
  default_ip     = webserver/@ip;
  default_ipv6   = webserver/@ipv6;
  install        = webserver/@install;
  serial_tag     = "2002022401";
  zone_dir       = "/var/lib/bind/zones";
  key_dir        = "/var/lib/bind/keys";
  named_user     = webserver/named/@user;

  :: Move to prefix directory
  string cwd = getcwd();
  string pre = ".";
  if (size(args) > 1) {
    pre = args[1];

    if (!exists(pre))
      (void)system("mkdir -p \"" + pre + "\"");

    if (!chdir(pre))
      throw "Could not open dir '" + pre + "'!";
  }

  :: create directories
  foreach (filenames/@*) {
    string name = dirname(.);
    if (!exists(name))
      (void)system("mkdir -p \"" + name + "\"");
  }

  :: open config script
  config = openStringStream(filenames/@config);
  (void)system("chmod +x \"" + value(filenames/@config) + "\"");

  redirect (config) {
    "#!/bin/bash\n";
    "# Autogenerated webserver configuration script\n\n";

    "OLDDIR=\"$PWD\"\n";
    "cd $(dirname $0)\n";
  }

  :: open Let's Encrypt script
  certs = openStringStream(filenames/@letsencrypt);
  (void)system("chmod +x \"" + value(filenames/@letsencrypt) + "\"");

  redirect (certs) {
    "#!/bin/bash\n";
    "# Autogenerated Let's Encrypt certificate script\n";
  }

  try {
    :: opendkim
    doOpenDKIM(webserver);

    :: named.conf
    doNamedConf(webserver, filenames/@named);

    :: apache2.conf
    doApache2Conf(webserver, filenames/@apache2);

    :: postfix
    doPostfix(webserver, emails);

    :: dovecot
    if (emails/email[@alias == ""]) doDovecot(emails);
  } catch {}

  redirect (config) {
    "cd \"$OLDDIR\"\n";
  }
  flush(config);
  close(config);
  flush(certs);
  close(certs);

  if (size(args) > 1) (void)chdir(cwd);

  "Web server configuration generated successfully.\n";
  "Now copy the files in '" + pre + "' to '" + value(webserver/@install);
  "'\non the target machine with ip address '" + value(webserver/@ip);
  "'\nand run '" + value(webserver/@install) + "/" + value(filenames/@config);
  "' as root.\n";
}