setup-local-dirs

#!/usr/bin/perl
$| = 1;

use Digest::SHA qw(sha1_hex);

# Try a uname based approach first
# Simplistic but sufficient for now
my $osdir = "";
my $uname = `uname -a`;
my $osrel = "";

# Determine env type
my $is_rpm = 0;
my $is_deb = 0;
if ( ( -e "/bin/rpm" || -e "/usr/bin/rpm" ) && ( !-e "/usr/bin/apt-get" ) ) {
    $is_rpm = 1;
}
elsif ( -e "/usr/bin/apt-get" ) {
    $ENV{DEBIAN_FRONTEND} = "noninteractive";
    $is_deb = 1;
}

if ( -e "/etc/fedora-release" ) {
    $osrel = `cat /etc/fedora-release`;
}
elsif ( -e "/etc/os-release" ) {
    $osrel = `cat /etc/os-release`;
}

if (0) {
}
elsif ( $uname =~ /x86_64/ && $osrel =~ /Ubuntu 22/ ) {
    $osdir = "ub22.x86_64";
}
elsif ( $uname =~ /x86_64/ && $osrel =~ /Ubuntu 24/ ) {
    $osdir = "ub24.x86_64";
}
elsif ( $uname =~ /aarch64/ && $osrel =~ /Ubuntu 24/ ) {
    $osdir = "ub24.aarch64";
}
elsif ( $osrel =~ /Raspbian.*7/ ) {
    $osdir = "raspbian7";
}
elsif ( $uname =~ /x86_64/ && $osrel =~ /bookworm/ ) {
    $osdir = "deb12.x86_64";
}
elsif ( $uname =~ /x86_64/ && $osrel =~ /trixie/ ) {
    $osdir = "deb13.x86_64";
}
else {
    die;
}

if ( $is_deb && !-e "/usr/sbin/apache2" ) {
    system( "apt-get", "-y", "install", "apache2-bin" );
}

if ( $is_deb && !-e "/usr/share/apache2/icons/folder.png" ) {
    system( "apt-get", "-y", "install", "apache2-data" );
}

if ( $is_deb && !-e "/usr/bin/htpasswd" ) {
    system( "apt-get", "-y", "install", "apache2-utils" );
}

$osdir =~ s/\./-/go;

if ( !$osdir ) {
    print "Couldn't determine os directory.\n";
}

# Make sure we are running the most current code
if ( $ARGV[0] ne "--skip-git" && -e "/local/apache/.git" ) {
    my @tmp1 = stat("/local/apache/setup-local-dirs");
    chdir("/local/apache") || die "failed to switch to /local/apache";
    system("git pull");
    my @tmp2 = stat("/local/apache/setup-local-dirs");
    if ( $tmp1[9] != $tmp2[9] ) {
        print "Restarting update script, file changed.\n";
        exec( "/local/apache/setup-local-dirs", "--skip-git" );
        exit;
    }
}

if ( !-e "/local/apache/conf-$osdir" ) {
    print "No OS config dir for ($osdir).\n";
    exit;
}

print "Using OS Dir: $osdir\n";
print "Scanning for local apache directories to update...\n";

opendir( DIR, "/local" );
while ( $file = readdir(DIR) ) {
    if ( $file eq "apache-root" || $file =~ /apache-root-.*/ ) {
        if ( !-e "/local/$file/conf/httpd.conf" ) {
            print "$file must not be a server install, no httpd.conf\n";
            next;
        }

        print "Found install at: /local/$file\n";

        $user = undef;
        open( my $in, "/local/$file/conf/httpd.conf" );
        while ( $line = <$in> ) {
            if ( $line =~ /^\s*User\s+(.*?)\s*$/o ) {
                $user = $1;
            }
        }
        close($in);

        if ( $user eq "" ) {
            die "Unable to determine user for /local/$file.\n";
        }

        print "Overwriting common config files in /local/$file/conf.\n";
        system("cp -v /local/apache/conf-$osdir/* /local/$file/conf/");

        print "Cleaning known OLD files in /local/$file/conf.\n";
        unlink("/local/$file/conf/modjk.conf");
        unlink("/local/$file/conf/modfastcgi.conf");

        print "Updating CA chain.crt file.\n";
        system("mkdir -p /local/$file/ssl");

        print "Determining chain crt to populate based on httpd.crt:\n";
        my @certs_to_add = ();
        my $aia_issuer;

        if ( -e "/local/$file/ssl/httpd.crt" ) {
            if ( -e "/local/$file/ssl/httpd-chain.crt" ) {
                push( @certs_to_add, "/local/$file/ssl/httpd-chain.crt" );
            }
        }

        my $merge_count = 0;
        my @certs       = &extract_ca_hierarchy("/local/$file/ssl/httpd.crt");
        if ( !@certs ) {
            print "Cannot extract CA hierarchy, treating as self-signed.";
            system( "cp", "/local/$file/ssl/httpd.crt", "/local/$file/ssl/chain.crt" );
        }
        else {
            open( my $out, ">/local/$file/ssl/issuer.crt" );
            foreach my $cert (@certs) {
                print $out $cert, "\n";
            }
            close($out);
            push( @certs_to_add, "/local/$file/ssl/issuer.crt" );

            open( my $out, ">/local/$file/ssl/chain.crt" );
            foreach my $file (@certs_to_add) {
                print "Merging $file into chain.crt...\n";
                open( my $in, "<$file" );
                while ( defined( my $line = <$in> ) ) {
                    print $out $line;
                }
                close($in);
                print $out "\n";
                if ( $file =~ /issuer.crt/ ) {
                    $merge_count++;
                }
            }
            close($out);
        }

        if ( $merge_count < 1 ) {
            print "  ###\n";
            print "  ### WARNING: Unable to expand CA intermediate certificates.\n";
            print "  ###\n";
        }

        open( my $out, ">/local/$file/ssl/httpd-with-chain.crt" );
        open( my $in,  "/local/$file/ssl/httpd.crt" );
        while ( defined( my $line = <$in> ) ) {
            print $out $line;
        }
        close($in);
        print $out "\n";
        open( my $in, "/local/$file/ssl/chain.crt" );
        while ( defined( my $line = <$in> ) ) {
            print $out $line;
        }
        close($in);
        close($out);

        print "Fixing perms for /local/$file for user $user.\n";
        &fix_perms( "/local/$file", $user );

        print "Updating scripts for /local/$file.\n";
        &setup_scripts("/local/$file");

        print "Removing any existing local-modules dir.\n";
        &mysystem("rm -rf /local/$file/local-modules");
    }
}

unlink("/home/local/adm/rc-start/rc.500.httpd");
open( OUT, ">/home/local/adm/rc-start/rc.500.httpd" );
print OUT "#!/bin/bash\n";
print OUT "/local/apache/stop-all\n";
print OUT "/local/apache/start-all\n";
close(OUT);
system("chmod 755 /home/local/adm/rc-start/rc.500.httpd");

unlink("/home/local/adm/rc-stop/rc.500.httpd");
open( OUT, ">/home/local/adm/rc-stop/rc.500.httpd" );
print OUT "#!/bin/bash\n";
print OUT "/local/apache/stop-all\n";
close(OUT);
system("chmod 755 /home/local/adm/rc-stop/rc.500.httpd");

sub mysystem {
    my ($cmd) = @_;
    print "+ $cmd\n";
    system($cmd);
}

sub fix_perms {
    my ( $dir, $user ) = @_;

    &mysystem("chown -R root:root $dir");
    &mysystem("chown root:$user $dir");
    &mysystem("chown -R $user:$user $dir/logs");
    &mysystem("chown -R $user:$user $dir/htdocs*");
    &mysystem("mkdir -p $dir/logs");
    &mysystem("chown root:$user $dir/logs");
    &mysystem("chown root:root $dir/logs/pidfile");
    &mysystem("rm -rf $dir/locks");
    &mysystem("mkdir -p $dir/tmp");
    &mysystem("chown $user:$user $dir/tmp");
    &mysystem("chmod -R go-rwx $dir");

    my @pats = glob("$dir/*cgi*");
    if ( $#pats >= 0 ) {
        &mysystem("chmod -R go+rx $dir/*cgi*");
    }

    my @pats = glob("$dir/*cgi*/*cgiwrap*");
    if ( $#pats >= 0 ) {
        &mysystem("chown root:root $dir/*cgi*/*cgiwrap*");
        &mysystem("chmod 4755 $dir/*cgi*/*cgiwrap*");
    }

    &mysystem("chmod go+x $dir");
    &mysystem("chmod g+rx $dir");
    &mysystem("chmod go+x $dir/logs");
    &mysystem("chmod g+rx $dir/logs");

    foreach my $otherdir ( "sessions", "fastcgi", "dav", "mellon" ) {
        if ( -e "$dir/$otherdir" ) {
            if ( $user eq "" ) {
                die "Cannot set $otherdir permissions, no user specified.\n";
            }
            &mysystem("chown -R $user:$user $dir/$otherdir");
        }
    }
}

sub setup_scripts {
    my ($dir) = @_;

    #
    # First start
    #
    unlink("$dir/start");
    open( OUT, ">$dir/start" );
    print OUT "#!/bin/bash\n";
    print OUT "TZ=UTC\n";
    print OUT "export TZ\n\n";

    print OUT "if [ -e $dir/env.sh ]; then\n";
    print OUT ". $dir/env.sh\n";
    print OUT "fi\n\n";

    print OUT "ulimit -HSn 16000\n";

    print OUT "cd $dir\n";
    print OUT "echo Starting Apache in $dir\n";
    if ( -e "/usr/sbin/httpd" ) {
        print OUT "/usr/sbin/httpd -d $dir\n";
    }
    elsif ( -e "/usr/sbin/apache2" ) {
        print OUT "/usr/sbin/apache2 -d $dir -f conf/httpd.conf\n";
    }
    else {
        die "Cannot determine apache executable.\n";
    }
    close(OUT);
    &mysystem("chmod 700 $dir/start");

    #
    # And stop
    #
    unlink("$dir/stop");
    open( OUT, ">$dir/stop" );
    print OUT "#!/bin/bash\n";
    print OUT "cd $dir\n";
    print OUT "if [ -e logs/pidfile ]; then\n";
    print OUT "echo Stopping Apache in $dir with pid \`cat logs/pidfile\`\n";
    print OUT "touch $dir/logs/TMP\n";
    print OUT "kill \`cat logs/pidfile\`\n";
    print OUT "sleep 2\n";
    print OUT "fi\n";
    print OUT "rm -f $dir/logs/TMP $dir/logs/httpd.mm.* $dir/logs/ssl_mutex* $dir/logs/ssl_scache*\n";
    close(OUT);
    &mysystem("chmod 700 $dir/stop");

    #
    # And restart
    #
    unlink("$dir/restart");
    open( OUT, ">$dir/restart" );
    print OUT "#!/bin/bash\n";
    print OUT "cd $dir\n";
    print OUT "./stop\n";
    print OUT "sleep 1\n";
    print OUT "./start\n";
    close(OUT);
    &mysystem("chmod 700 $dir/restart");

    #
    # And reload
    #
    unlink("$dir/reload");
    open( OUT, ">$dir/reload" );
    print OUT "#!/bin/bash\n";
    print OUT "cd $dir\n";
    print OUT "if [ -e logs/pidfile ]; then\n";
    print OUT "echo Reloading Apache in $dir with pid \`cat logs/pidfile\`\n";
    print OUT "kill -HUP \`cat logs/pidfile\`\n";
    print OUT "fi\n";
    close(OUT);
    &mysystem("chmod 700 $dir/reload");
}

sub extract_ca_hierarchy {
    my $cert = shift @_;
    my @out  = ();

    my $tmp_cert  = "/tmp/cert-extract-$$-" . time . ".crt";
    my $tmp_cert2 = "/tmp/cert-extract2-$$-" . time . ".crt";

    my $cache = "/local/apache/ca-cache";
    if ( !-d $cache ) {
        mkdir( $cache, 0700 );
    }

    my $depth = 5;
    while ( $cert && $depth-- ) {
        my $aia_issuer;
        open( my $in, "-|" ) || exec(
            "openssl", "x509",
            "-in" => $cert,
            "-text"
        );
        while ( defined( my $line = <$in> ) ) {
            if ( $line =~ /CA Issuers - URI:(http.*?)\s+/ ) {
                $aia_issuer = $1;
                print "Found AIA Issuer: $1\n";
            }
        }
        close($in);
        if ($aia_issuer) {
            my $hash      = sha1_hex($aia_issuer);
            my $cachefile = "$cache/$hash.crt";

            my $raw;
            if ( -e $cachefile && -s $cachefile ) {
                print "Loading CA file from cache: $cachefile\n";
            }
            else {
                if ( -e "/usr/bin/wget" ) {
                    system( "/usr/bin/wget", "-q", "-O$tmp_cert", $aia_issuer );
                }
                elsif ( -e "/usr/bin/curl" ) {
                    system( "/usr/bin/curl", "-q", "--output", $tmp_cert, $aia_issuer );
                }
                else {
                    die "Cannot retrieve upstream cert.";
                }
                if ( $aia_issuer =~ /\.p7c/ ) {
                    system( "openssl", "pkcs7", "-in", $tmp_cert, "-inform", "DER", "-print_certs", "-out",
                        $cachefile );
                }
                else {
                    system( "openssl", "x509", "-in", $tmp_cert, "-outform", "PEM", "-out", $cachefile );
                }
            }
            open( my $in, "<$cachefile" );
            $raw = join( "", <$in> );
            close($in);
            $cert = $cachefile;
            push( @out, $raw );
        }
        else {
            $cert = undef;
        }
    }

    print "Returning ", scalar(@out), " intermediate certs.\n";
    return @out;
}