name: server

variables:
  - name: site_address
    required: true
  - name: backend
    required: true
  - name: tls
    value: internal
  - name: tls_email
    value: ''

fodder:
- name: server
  type: cloud-config
  content: |
    # Append (don't replace) write_files/runcmd when combined with other
    # cloud-config fodder on the same catlet, e.g. a co-located backend app.
    merge_how:
    - name: list
      settings: [append]
    - name: dict
      settings: [no_replace, recurse_list]
    write_files:
    - path: /opt/eryph-caddy-setup.sh
      permissions: '0755'
      content: |
        #!/bin/bash
        set -euo pipefail
        SITE='{{ site_address }}'
        BACKEND='{{ backend }}'
        TLS='{{ tls }}'
        TLS_EMAIL='{{ tls_email }}'

        . /etc/os-release
        FAMILY=rhel
        case " ${ID:-} ${ID_LIKE:-} " in
          *" debian "*|*" ubuntu "*) FAMILY=debian ;;
        esac

        # Install Caddy from the official repository (apt on Debian/Ubuntu, COPR on RHEL)
        if [ "$FAMILY" = debian ]; then
          export DEBIAN_FRONTEND=noninteractive
          apt-get update -qq
          apt-get install -y -qq debian-keyring debian-archive-keyring apt-transport-https curl gpg
          curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' \
            | gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg
          curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' \
            > /etc/apt/sources.list.d/caddy-stable.list
          apt-get update -qq
          apt-get install -y -qq caddy
        else
          dnf install -y -q 'dnf-command(copr)'
          dnf copr enable -y @caddy/caddy
          dnf install -y -q caddy
        fi

        # Build the Caddyfile (reverse proxy to the backend)
        case "$TLS" in
          off)
            SITE_LINE="http://$SITE"; TLS_LINE="" ;;
          auto)
            SITE_LINE="$SITE"
            if [ -n "$TLS_EMAIL" ]; then TLS_LINE="    tls $TLS_EMAIL"; else TLS_LINE=""; fi ;;
          *)
            SITE_LINE="$SITE"; TLS_LINE="    tls internal" ;;
        esac
        {
          printf '%s {\n' "$SITE_LINE"
          [ -n "$TLS_LINE" ] && printf '%s\n' "$TLS_LINE"
          printf '    reverse_proxy %s\n' "$BACKEND"
          printf '}\n'
        } > /etc/caddy/Caddyfile

        systemctl enable caddy >/dev/null 2>&1 || true
        systemctl restart caddy

        # Open the firewall only when one is active
        if command -v firewall-cmd >/dev/null 2>&1 && firewall-cmd --state >/dev/null 2>&1; then
          firewall-cmd --permanent --add-service=http >/dev/null
          firewall-cmd --permanent --add-service=https >/dev/null
          firewall-cmd --reload >/dev/null
        fi
        if command -v ufw >/dev/null 2>&1 && ufw status 2>/dev/null | grep -q "Status: active"; then
          ufw allow 80/tcp >/dev/null; ufw allow 443/tcp >/dev/null
        fi
    runcmd:
    - bash /opt/eryph-caddy-setup.sh