#!/bin/bash

# Exit on any error
set -e

# Variables
DOMAIN=$(hostname -d)                           # Holt sich die Domain des Systems
REALM=$(echo $DOMAIN | tr 'a-z' 'A-Z')          # Realm ist die Domain in Großbuchstaben
HOSTNAME=$(hostname -f)                         # Holt den vollständigen Hostnamen (FQDN)
IP_ADDRESS=$(hostname -I | awk '{print $1}')    # Holt die primäre IP-Adresse des Systems
DNS_FORWARDER="8.8.8.8"                         # Externer DNS-Forwarder (Google in diesem Fall)
PASSWORD="ipaAdminPassword"                     # Admin-Passwort (in der Praxis sicher speichern)
DIRMAN_PASSWORD="dirmanPassword"                # Directory Manager Passwort
AD_REALM=$REALM                                 # Active Directory Realm in Großbuchstaben
AD_DOMAIN=$DOMAIN                               # Active Directory Domain in Kleinbuchstaben
AD_ADMIN_USER="administrator"                   # Administrator-Account der AD-Domäne
AD_ADMIN_PASS="adAdminPassword"                 # Passwort des Administrator-Accounts

LOGFILE="/var/log/idm_install.log"

# Function to check if running as root
function check_root {
  if [[ $EUID -ne 0 ]]; then
    echo "Dieses Skript muss als Root ausgeführt werden!" 1>&2
    exit 1
  fi
}

# Function to install the necessary packages
function install_packages {
  echo "Installiere benötigte Pakete..." | tee -a $LOGFILE
  yum update -y | tee -a $LOGFILE

  echo "Installiere erforderliche Pakete..." | tee -a $LOGFILE
  yum -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm | tee -a $LOGFILE
  dnf -y install @idm:DL1 | tee -a $LOGFILE
  yum install -y ipa-server ipa-server-dns bind samba samba-client bind-pkcs11-utils | tee -a $LOGFILE
}

# Function to install the IDM server with DNS
function install_idm_server {
  echo "Installiere IdM-Server mit DNS..." | tee -a $LOGFILE

  ipa-server-install --hostname=$HOSTNAME --domain=$DOMAIN --realm=$REALM \
    --ds-password=$DIRMAN_PASSWORD --admin-password=$PASSWORD \
    --ip-address=$IP_ADDRESS --no-pkinit \
    --setup-dns --auto-reverse --forwarder=$DNS_FORWARDER --no-ntp -U | tee -a $LOGFILE
}

# Function to configure AD trust
function configure_ad_trust {
  echo "Konfiguriere AD-Trust..." | tee -a $LOGFILE

  yum install -y ipa-server-trust-ad | tee -a $LOGFILE

  ipa-adtrust-install --add-sids --netbios-name=$(echo $REALM | cut -d. -f1) --no-msdcs --admin-password=$PASSWORD -U | tee -a $LOGFILE

  ipa trust-add --type=ad $AD_REALM --admin=$AD_ADMIN_USER --password=$AD_ADMIN_PASS | tee -a $LOGFILE
}

# Function to configure Samba
function configure_samba {
  echo "Konfiguriere Samba..." | tee -a $LOGFILE

  cat <<EOF > /etc/samba/smb.conf
[global]
    workgroup = $(echo $REALM | cut -d. -f1)
    realm = $REALM
    security = ADS
    idmap config * : backend = tdb
    idmap config * : range = 1000-9999
    idmap config $REALM : backend = ad
    idmap config $REALM : range = 10000-99999
    log file = /var/log/samba/%m.log
    log level = 1
    kerberos method = system keytab
    dedicated keytab file = /etc/samba/samba.keytab
    map to guest = Bad User
    winbind use default domain = true
    template shell = /bin/bash
    template homedir = /home/%U
EOF

  # Restart Samba services
  systemctl restart smb nmb winbind
}

# Function to configure firewall
function configure_firewall {
  echo "Konfiguriere Firewall..." | tee -a $LOGFILE

  firewall-cmd --add-service=freeipa-ldap --permanent
  firewall-cmd --add-service=freeipa-ldaps --permanent
  firewall-cmd --add-service=freeipa-replication --permanent
  firewall-cmd --add-service=freeipa-trust --permanent
  firewall-cmd --add-service=dns --permanent
  firewall-cmd --add-port=88/tcp --permanent    # Kerberos
  firewall-cmd --add-port=88/udp --permanent    # Kerberos
  firewall-cmd --add-port=464/tcp --permanent   # Kerberos kpasswd
  firewall-cmd --add-port=464/udp --permanent   # Kerberos kpasswd
  firewall-cmd --add-port=123/udp --permanent   # NTP
  firewall-cmd --add-port=135/tcp --permanent   # DCE/RPC locator service
  firewall-cmd --add-port=138/udp --permanent   # NetBIOS Datagram Service
  firewall-cmd --add-port=139/tcp --permanent   # NetBIOS Session Service
  firewall-cmd --add-port=445/tcp --permanent   # Microsoft-DS Active Directory, Windows shares
  firewall-cmd --add-port=1024-1300/tcp --permanent   # High ports for AD trust
  firewall-cmd --add-port=1024-1300/udp --permanent   # High ports for AD trust
  firewall-cmd --reload | tee -a $LOGFILE
}

# Function to configure DNS settings without DNSSEC
function configure_dns {
  echo "Konfiguriere DNS..." | tee -a $LOGFILE

  cat <<EOF > /etc/named.conf
options {
    directory "/var/named";
    forwarders {
        $DNS_FORWARDER;
    };
};
zone "$DOMAIN" IN {
    type master;
    file "$DOMAIN.zone";
};
EOF

  cat <<EOF > /var/named/$DOMAIN.zone
\$TTL 86400
@   IN  SOA $HOSTNAME. admin.$DOMAIN. (
    2024090701 ; Serial
    3600       ; Refresh
    1800       ; Retry
    1209600    ; Expire
    86400 )    ; Minimum TTL

@   IN  NS  $HOSTNAME.
@   IN  A   $IP_ADDRESS
EOF

  # Restart DNS service
  systemctl restart named
}

# Main function
function main {
  check_root
  install_packages
  install_idm_server
  configure_ad_trust
  configure_samba
  configure_firewall
  configure_dns
  echo "IdM-Server Installation und Konfiguration abgeschlossen." | tee -a $LOGFILE
}

# Run the script
main