entrypoint

#!/bin/bash
set -e

mkdir -p /config/fail2ban
mkdir -p /config/userkeys
mkdir -p /config/sshd/keys

# Modify default fail2ban.conf file
sed -i 's|^logtarget = /var/log/fail2ban.log|logtarget = /config/fail2ban/fail2ban.log|' /etc/fail2ban/fail2ban.conf
sed -i 's|^dbfile = /var/lib/fail2ban/fail2ban.sqlite3|dbfile = /config/fail2ban/fail2ban.sqlite3|' /etc/fail2ban/fail2ban.conf

# Copy default config files if removed
if [[ ! -e /config/fail2ban/fail2ban.conf ]]; then
	echo "$(date) [err] fail2ban.conf missing from /config/fail2ban/... Replacing with default backup!"
	cp "/etc/fail2ban/fail2ban.conf" "/config/fail2ban/fail2ban.conf"
else
        echo "$(date) [info] Existing fail2ban.conf found. Copying to container filesystem!"
	rm /etc/fail2ban/fail2ban.conf
	cp "/config/fail2ban/fail2ban.conf" "/etc/fail2ban/fail2ban.conf"
fi

# Copy default config files if removed
if [[ ! -e /config/fail2ban/jail.conf ]]; then
	echo "$(date) [err] jail.conf missing from /config/fail2ban/... Replacing with default backup!"
	cp "/etc/default/f2ban/jail.conf" "/config/fail2ban/jail.conf"
	rm /etc/fail2ban/jail.conf
	cp "/config/fail2ban/jail.conf" "/etc/fail2ban/jail.conf"
else
        echo "$(date) [info] Existing jail.conf found. Copying to container filesystem!"
	rm /etc/fail2ban/jail.conf
	cp "/config/fail2ban/jail.conf" "/etc/fail2ban/jail.conf"
fi

if [[ ! -e /config/sshd/sshd_config ]]; then
	echo "$(date) [err] sshd_config missing from /config/sshd/... Replacing with default backup!"
	cp "/etc/default/sshd/sshd_config" "/config/sshd/sshd_config"
	rm /etc/ssh/sshd_config
	cp "/config/sshd/sshd_config" "/etc/ssh/sshd_config"
else
        echo "$(date) [info] Existing sshd_config found. Copying to container filesystem!"
	rm /etc/ssh/sshd_config
	cp "/config/sshd/sshd_config" "/etc/ssh/sshd_config"
fi

# Paths
userConfPath="/config/sshd/users.conf"
userConfPathLegacy="/etc/sftp-users.conf"
userConfFinalPath="/var/run/sftp/users.conf"

# Extended regular expression (ERE) for arguments
reUser='[A-Za-z0-9._][A-Za-z0-9._-]{0,31}' # POSIX.1-2008
rePass='[^:]{0,255}'
reUid='[[:digit:]]*'
reGid='[[:digit:]]*'
reDir='[^:]*'
reArgs="^($reUser)(:$rePass)(:e)?(:$reUid)?(:$reGid)?(:$reDir)?$"
reArgsMaybe="^[^:[:space:]]+:.*$" # Smallest indication of attempt to use argument
reArgSkip='^([[:blank:]]*#.*|[[:blank:]]*)$' # comment or empty line

function log() {
    echo "[entrypoint] $@"
}

function validateArg() {
    name="$1"
    val="$2"
    re="$3"

    if [[ "$val" =~ ^$re$ ]]; then
        return 0
    else
        log "ERROR: Invalid $name \"$val\", do not match required regex pattern: $re"
        return 1
    fi
}

function createUser() {
    log "Parsing user data: \"$@\""

    IFS=':' read -a args <<< $@

    skipIndex=0
    chpasswdOptions=""
    useraddOptions="--no-user-group"

    user="${args[0]}"; validateArg "username" "$user" "$reUser" || return 1
    pass="${args[1]}"; validateArg "password" "$pass" "$rePass" || return 1

    if [ "${args[2]}" == "e" ]; then
        chpasswdOptions="-e"
        skipIndex=1
    fi

    uid="${args[$[$skipIndex+2]]}"; validateArg "UID" "$uid" "$reUid" || return 1
    gid="${args[$[$skipIndex+3]]}"; validateArg "GID" "$gid" "$reGid" || return 1
    dir="${args[$[$skipIndex+4]]}"; validateArg "dirs" "$dir" "$reDir" || return 1

    if getent passwd $user > /dev/null; then
        log "WARNING: User \"$user\" already exists. Skipping."
        return 0
    fi

    if [ -n "$uid" ]; then
        useraddOptions="$useraddOptions --non-unique --uid $uid"
    fi

    if [ -n "$gid" ]; then
        if ! getent group $gid > /dev/null; then
            groupadd --gid $gid "group_$gid"
        fi

        useraddOptions="$useraddOptions --gid $gid"
    fi

    useradd $useraddOptions $user
    mkdir -p /home/$user /home/$user/.ssh
    chown root:root /home/$user
    chmod 755 /home/$user

    # Retrieving user id to use it in chown commands instead of the user name
    # to avoid problems on alpine when the user name contains a '.'
    uid="$(id -u $user)"

    if [ -n "$pass" ]; then
        echo "$user:$pass" | chpasswd $chpasswdOptions
    else
        usermod -p "*" $user # disabled password
    fi

		# copy user key, if it exists
		key_file="/config/userkeys/$user.pub"
		if [ -f  $key_file ]; then
			chown $uid /home/$user/.ssh
			chmod 700 /home/$user/.ssh

			echo "Copying key for $user"
			dest_key_file="/home/$user/.ssh/$user.pub"
			if [ -f $dest_key_file ]; then
			    rm $dest_key_file
			fi
			cp $key_file $dest_key_file
			chown $uid $dest_key_file
			chmod 600 $dest_key_file

			# echo key into authorized_keys and set perms
			cat $key_file > /home/$user/.ssh/authorized_keys
			chown $uid /home/$user/.ssh/authorized_keys
			chmod 600 /home/$user/.ssh/authorized_keys
		fi

    # Make sure dirs exists
    if [ -n "$dir" ]; then
        IFS=',' read -a dirArgs <<< $dir
        for dirPath in ${dirArgs[@]}; do
            dirPath="/home/$user/$dirPath"
            if [ ! -d "$dirPath" ]; then
                log "Creating directory: $dirPath"
                mkdir -p $dirPath
                chown -R $uid:users $dirPath
            else
                log "Directory already exists: $dirPath"
            fi
        done
    fi
}

# Allow running other programs, e.g. bash
if [[ -z "$1" || "$1" =~ $reArgsMaybe ]]; then
    startSshd=true
else
	startSshd=false
fi

# Backward compatibility with legacy config path
if [ ! -f "$userConfPath" -a -f "$userConfPathLegacy" ]; then
    mkdir -p "$(dirname $userConfPath)"
    ln -s "$userConfPathLegacy" "$userConfPath"
fi

# Create host keys only on first run
if [ ! -f "$userConfFinalPath" ]; then
	# Generate unique ssh keys for this container, if needed
    if [ ! -f /config/sshd/keys/ssh_host_ed25519_key ]; then
        echo "Generating sshd key..."
        ssh-keygen -t ed25519 -f /config/sshd/keys/ssh_host_ed25519_key -N ''
    fi
    if [ ! -f /config/sshd/keys/ssh_host_rsa_key ]; then
          echo "Generating sshd rsa key..."
          ssh-keygen -t rsa -b 4096 -f /config/sshd/keys/ssh_host_rsa_key -N ''
    fi
fi

echo "Checking for new users..."
mkdir -p "$(dirname $userConfFinalPath)"

# Append mounted config to final config
if [ -f "$userConfPath" ]; then
    cat "$userConfPath" | grep -v -E "$reArgSkip" > "$userConfFinalPath"
fi

if $startSshd; then
    # Append users from arguments to final config
    for user in "$@"; do
        echo "$user" >> "$userConfFinalPath"
    done
fi

if [ -n "$SFTP_USERS" ]; then
    # Append users from environment variable to final config
    usersFromEnv=($SFTP_USERS) # as array
    for user in "${usersFromEnv[@]}"; do
        echo "$user" >> "$userConfFinalPath"
    done
fi

# Check that we have users in config
if [[ -f "$userConfFinalPath" && "$(cat "$userConfFinalPath" | wc -l)" > 0 ]]; then
    # Import users from final conf file
    while IFS= read -r user || [[ -n "$user" ]]; do
        createUser "$user"
    done < "$userConfFinalPath"
elif $startSshd; then
    log "FATAL: No users provided in /config/sshd/users.conf file see Github readme for help"
    touch /config/sshd/users.conf
    exit 3
fi

# Source custom scripts, if any
if [ -d /config/sshd/scripts ]; then
    for f in /config/sshd/scripts/*; do
        if [ -x "$f" ]; then
            log "Running $f ..."
            $f
        else
            log "Could not run $f, because it's missing execute permission (+x)."
        fi
    done
    unset f
fi

#sed -i 's/^backend = auto/backend = systemd/' /etc/fail2ban/jail.conf

if [[ -e /var/run/fail2ban/fail2ban.sock ]]; then
	rm /var/run/fail2ban/fail2ban.sock
fi

if [[ -e /var/run/sshd.pid ]]; then
	rm /var/run/sshd.pid
fi

if [[ -e /var/log/auth.log ]]; then
	> /var/log/auth.log
fi

if $startSshd; then
    echo "Executing syslog-ng"
    service syslog-ng start
    echo "Executing sshd"
    service ssh start
    if [ ! -e "/config/fail2ban/fail2ban.log" ]; then
    	touch "/config/fail2ban/fail2ban.log"
    fi
    if [ ! -e "/var/log/auth.log" ]; then
        touch "/var/log/auth.log"
    fi
    echo "Executing fail2ban"
    service fail2ban start
    tail -F /config/fail2ban/fail2ban.log -F /var/log/auth.log
else
    echo "Executing $@"
    exec "$@"
fi