#!/bin/bash

# Funktion zum Konfigurieren des 389 Directory Servers
configure_389_ds() {
    local domain="$1"
    local admin_password="$2"
    local ldap_password="$3"
    local fqdn="$(hostname --fqdn)"

    cat <<EOL | sudo tee /tmp/ds_setup.inf
[General]
FullMachineName = $fqdn
SuiteSpotUserID = nobody
SuiteSpotGroup = nobody
AdminDomain = $domain

[slapd]
ServerPort = 389
ServerIdentifier = ldap
Suffix = dc=$(echo $domain | sed 's/\./,dc=/g')
RootDN = cn=Directory Manager
RootDNPwd = $admin_password
EOL

    sudo dscreate from-file /tmp/ds_setup.inf
    sudo rm /tmp/ds_setup.inf
}

# Funktion zum Konfigurieren von LDAPS mit vorhandenen Zertifikaten und Schlüsseln
configure_ldaps() {
    local cert_path="/etc/ssl/certs"
    local key_path="/etc/ssl/private"
    local fqdn="$(hostname --fqdn)"
    local cert_name="CERT_${fqdn//./_}.cer"
    local key_name="KEY_${fqdn//./_}.pem"

    # Annahme: Die Zertifikats- und Schlüsseldateien sind bereits vorhanden
    # und müssen nur in die richtigen Pfade verschoben/verlinkt werden
    sudo cp /path/to/existing_certificates/"$cert_name" "$cert_path/$cert_name"
    sudo cp /path/to/existing_certificates/"$key_name" "$key_path/$key_name"

    sudo dsconf -D "cn=Directory Manager" ldap:/// config replace nsslapd-security=on
    sudo dsconf -D "cn=Directory Manager" ldap:/// config replace nsslapd-ldaps-port=636
    sudo dsconf -D "cn=Directory Manager" ldap:/// tls set --cacertdir="$cert_path" --server-cert="$cert_name" --server-key="$key_name"
    sudo systemctl restart dirsrv@ldap
}

# Funktion zum Konfigurieren von BIND mit DLZ
configure_bind_dlz() {
    local domain="$1"
    local fqdn="$(hostname --fqdn)"

    cat <<EOL | sudo tee /etc/named/dlz-ldap.conf
uri ldaps://127.0.0.1:636
base "cn=dns,dc=$(echo $domain | sed 's/\./,dc=/g')"
auth_method sasl
sasl_mech EXTERNAL
EOL

    cat <<EOL | sudo tee /etc/named.conf
options {
    listen-on port 53 { any; };
    directory  "/var/named";
    dump-file  "/var/named/data/cache_dump.db";
    statistics-file "/var/named/data/named_stats.txt";
    memstatistics-file "/var/named/data/named_mem_stats.txt";
    allow-query     { any; };
    recursion yes;
};

include "/etc/named/dlz-ldap.conf";

dlz "ldap zone" {
    database "ldap ldaps://127.0.0.1:636/dc=$(echo $domain | sed 's/\./,dc=/g')?relativeDomainName?sub?(objectClass=dnsZone)";
};
EOL

    sudo systemctl restart named
    sudo systemctl enable named
}

# Funktion zum Hinzufügen der DNS-Zonen in LDAP
add_dns_zones() {
    local domain="$1"
    local ldap_password="$2"
    local fqdn="$(hostname --fqdn)"
    local ip_address="$(hostname -I | awk '{print $1}')"

    cat <<EOL | ldapadd -H ldaps://127.0.0.1:636 -x -D "cn=Directory Manager" -w "$ldap_password"
dn: dc=$(echo $domain | sed 's/\./,dc=/g')
objectClass: top
objectClass: domain
dc: $(echo $domain | cut -d'.' -f1)

dn: cn=dns,dc=$(echo $domain | sed 's/\./,dc=/g')
objectClass: top
objectClass: nsContainer
cn: dns

dn: ou=bind,dc=$(echo $domain | sed 's/\./,dc=/g')
objectClass: top
objectClass: organizationalUnit
ou: bind

dn: relativeDomainName=@,zoneName=$domain,cn=dns,dc=$(echo $domain | sed 's/\./,dc=/g')
objectClass: top
objectClass: dNSZone
relativeDomainName: @
zoneName: $domain
dNSClass: IN
dNSTTL: 3600
nSRecord: ns.$domain.

dn: relativeDomainName=ns,zoneName=$domain,cn=dns,dc=$(echo $domain | sed 's/\./,dc=/g')
objectClass: top
objectClass: dNSZone
relativeDomainName: ns
zoneName: $domain
dNSClass: IN
dNSTTL: 3600
aRecord: $ip_address

dn: relativeDomainName=$fqdn,zoneName=$domain,cn=dns,dc=$(echo $domain | sed 's/\./,dc=/g')
objectClass: top
objectClass: dNSZone
relativeDomainName: $fqdn
zoneName: $domain
dNSClass: IN
dNSTTL: 3600
aRecord: $ip_address
EOL
}

# Funktion zum Aktualisieren der /etc/hosts-Datei
update_hosts_file() {
    local domain="$1"
    local fqdn="$(hostname --fqdn)"
    local ip_address="$(hostname -I | awk '{print $1}')"

    sudo sed -i "/$fqdn/d" /etc/hosts
    echo "$ip_address    $fqdn $domain" | sudo tee -a /etc/hosts > /dev/null
}

# Funktion zum Einlesen von Benutzereingaben
read_input() {
    read -p "$1: " value
    echo "$value"
}

# Hauptfunktion zum Ausführen des Skripts
main() {
    local domain="$(hostname --domain)"
    local admin_password="$(read_input "Admin password")"
    local ldap_password="$(read_input "LDAP password")"

    configure_389_ds "$domain" "$admin_password" "$ldap_password"
    configure_ldaps
    configure_bind_dlz "$domain"
    add_dns_zones "$domain" "$ldap_password"
    update_hosts_file "$domain"
}

# Hauptprogramm starten
main