#!/bin/bash

# Set hostname
hostnamectl set-hostname ds389.heim.lan
DOMAIN=$(hostname -d)
# Set IP address (Assuming RHEL 8+ with NetworkManager)
nmcli connection modify eth0 ipv4.addresses 192.168.44.200/24
nmcli connection up eth0

# Install required packages
dnf install epel-release -y
dnf install 389-ds-base -y

# Angaben für erstellung CSR
C="DE"              # Country ANgabe
ST="TH"             # State Angabe
L="ILM"             # Location Angabe
# Extrahiere OU (Organizational Unit) und O (Organization) und wandele sie in Großbuchstaben um
O=$(echo "${DOMAIN#*.}" | tr '[:lower:]' '[:upper:]')       # Organisation Angabe
OU=$(echo "${DOMAIN%%.*}" | tr '[:lower:]' '[:upper:]')     # Organisation Unit Angaben 


# Read IP address dynamically from active network interface
IP_ADDRESS=$(nmcli -t -f IP4.ADDRESS device show | awk -F: '{split($2,a,"/"); print a[1]; exit}')
echo "IP Address: ${IP_ADDRESS}"

# Read DNS name dynamically
HOST_FQDN=$(hostname -f)
echo "DNS Name: ${HOST_FQDN}"

# Read Hostname dynamically
HOST_NORMAL=$(hostname -s)
echo "Hostname: ${HOST_NORMAL}"

# Set paths to your CA certificates and CSR files
CA_ROOT_CERT="/path/to/root_ca.crt"
CA_INTERMEDIATE_CERT="/path/to/intermediate_ca.crt"
SERVER_CERT="/path/to/server_cert.crt"
CSR_FILE="/tmp/ds389.heim.lan.csr"
KEY_FILE="/tmp/ds389.heim.lan.key"

# Generate CSR and private key with IP address as SAN
openssl req -new -newkey rsa:4096 -nodes \
    -keyout "$KEY_FILE" -out "$CSR_FILE" \
    -subj "/C=${C}/ST=${ST}/L=${L}/O=${O}/OU=${OU}/CN=${HOST_FQDN}" \
    -reqexts SAN -config <(cat /etc/pki/tls/openssl.cnf \
        <(printf "[SAN]\nsubjectAltName=IP:${IP_ADDRESS},DNS:${HOST_FQDN}"))

# Install CA certificates
cp "$CA_ROOT_CERT" /etc/pki/ca-trust/source/anchors/
cp "$CA_INTERMEDIATE_CERT" /etc/pki/ca-trust/source/anchors/
update-ca-trust extract

# Setup Directory Server
setup-ds-admin --silent \
    --hostname ${HOST_FQDN} \
    --domain "$DOMAIN" \
    --rootdn "cn=Directory Manager" \
    --rootpw your_password_here \
    --admin "admin" \
    --enable ldaps \
    --fips off \
    --addn add

# Configure SSL/TLS for Directory Server using CSR
dsconf -D "cn=Directory Manager" ldap://localhost ssl import-cert "$SERVER_CERT" "$CA_INTERMEDIATE_CERT" "$CA_ROOT_CERT" 
dsconf -D "cn=Directory Manager" ldap://localhost ssl on

# Start and enable Directory Server
systemctl start dirsrv@ds389
systemctl enable dirsrv@ds389