#!/bin/bash

## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
## See the file COPYING for copying conditions.

## usage:
## sudo client=1 anon-server-to-client-install

#set -x

set -o errexit
set -o nounset
set -o pipefail
set -o errtrace
shopt -s inherit_errexit
shopt -s shift_verbose

# shellcheck source=../../../../kicksecure/helper-scripts/usr/libexec/helper-scripts/has.sh
## Sibling repo: absent in an isolated CI checkout, so shellcheck cannot
## follow it there. The source= path above still documents where it lives.
##
## TODO: Only run shellcheck when we have a full derivative-maker source tree.
# shellcheck disable=SC1091
source /usr/libexec/helper-scripts/has.sh

# shellcheck source=../../../../kicksecure/helper-scripts/usr/libexec/helper-scripts/strings.bsh
source /usr/libexec/helper-scripts/strings.bsh

error_handler() {
   local exit_code="$?"
   printf '%s\n' "ERROR: exit_code: ${exit_code} | BASH_COMMAND: ${BASH_COMMAND}"
   exit 1
}

trap error_handler ERR

SCRIPTNAME="$(basename "${BASH_SOURCE[0]}")"

if [ "$(id -u)" != "0" ]; then
    printf '%s\n' "ERROR: This must be run as root (sudo)!"
    printf '%s\n' "INFO: You can start ${SCRIPTNAME} by entering..."
    printf '%s\n' "      sudo ${SCRIPTNAME}"
    exit 1
fi

default_if_empty torconfdir "/usr/local/etc/torrc.d"

default_if_empty torconffile "${torconfdir}/43_clientonionauthdir.conf"

default_if_empty torunit "tor@default"

default_if_empty unitaction "reload"
default_if_empty unitruntest "is-active"

default_if_empty unittool "systemctl"

default_if_empty unitcmd "${unittool} ${unitaction} ${torunit}"

default_if_empty unitruntestcmd "${unittool} ${unitruntest} ${torunit}"

default_if_empty user_name "${SUDO_USER:-}"

default_if_empty tor_user "debian-tor"
default_if_empty tor_group "debian-tor"

default_if_empty client "1"

default_if_empty tor_dir "/var/lib/tor"

default_if_empty client_onion_auth_dir "${tor_dir}/authdir"

default_if_empty auth_private_file_name "${client}.auth_private"

default_if_empty sourcefile "/home/${user_name}/${auth_private_file_name}"

default_if_empty auth_private_file_full_target_path "${client_onion_auth_dir}/${auth_private_file_name}"

default_if_empty client_onion_auth_full_path "${client_onion_auth_dir}/${auth_private_file_name}"

default_if_empty tor_user_sudo "sudo --non-interactive -u ${tor_user}"

has touch tee mkdir chmod chown cp sudo id groups "${unittool}" sleep

id "${tor_user}" >/dev/null
groups "${tor_group}" >/dev/null

if ! ${unitruntestcmd} &>/dev/null ; then
   printf '%s\n' "ERROR: Tor is not running. Start Tor first."
   exit 1
fi

if ! test -r "${sourcefile}" ; then
   printf '%s\n' "ERROR: sourcefile '${sourcefile}' does not exist!" >&2
   exit 1
fi

if ! test -d "${tor_dir}" ; then
   printf '%s\n' "ERROR: tor_dir '${tor_dir}' does not exist!" >&2
   exit 1
fi

mkdir -p "${client_onion_auth_dir}"
chown "${tor_user}:${tor_group}" "${client_onion_auth_dir}"

## Tighten permissions on existing key files.
shopt -s nullglob
for existing_auth_private_file in "${client_onion_auth_dir}"/*.auth_private ; do
   chmod 0600 -- "${existing_auth_private_file}"
done
shopt -u nullglob

cp "${sourcefile}" "${auth_private_file_full_target_path}"
chown "${tor_user}:${tor_group}" "${auth_private_file_full_target_path}"
chmod 0600 -- "${auth_private_file_full_target_path}"

printf '%s\n' "INFO: Installed \".auth_private\" file (private key) '${sourcefile}' to '${auth_private_file_full_target_path}'."

test -d "${torconfdir}"
safe-rm -f -- "${torconffile}"
touch "${torconffile}"

printf '%s\n' "\
# This file is generated by by $0
# User configuration should go to /usr/local/etc/torrc.d/50_user.conf, not here.
# However, deleting this file will be fine since a new plain file will be generated the next time you run ${SCRIPTNAME}

# Also Whonix package anon-gw-anonymizer-config already ships file
# /etc/torrc.d/65_gateway.conf which also includes
# ClientOnionAuthDir /var/lib/tor/authdir
ClientOnionAuthDir ${client_onion_auth_dir}
" | tee "${torconffile}" >/dev/null

printf '%s\n' "INFO: Created torconffile '${torconffile}'."

printf '%s\n' "INFO: Reloading Tor to activate \".auth_private\" file (private key)."

## Reload Tor to so Tor will load client_authorization_full_path.
## by default:
## systemctl reload tor@default
${unitcmd}

printf '%s\n' "INFO: Success."
