#!/bin/bash

CERT="/etc/lighttpd/server.pem"

op_disable ()
{
	[ -e "$CERT" ] || exit 0
	rm -f -- "$CERT" || exit 1
}

op_test ()
{
	[ $# -eq 2 ] || exit 1
	local K=$1
	local C=$2
	[ -r "$K" ] || exit 2
	[ -r "$C" ] || exit 3
	# Encrypt something, then decrypt again and compare
	local TEST_IN=$(mktemp --tmpdir bwlp-XXXXXXXX)
	local TEST_OUT=$(mktemp --tmpdir bwlp-XXXXXXXX)
	local TEST_DIFF=$(mktemp --tmpdir bwlp-XXXXXXXX)
	[ -z "$TEST_IN" ] && exit 4
	[ -z "$TEST_OUT" ] && exit 5
	[ -z "$TEST_DIFF" ] && exit 6
	date > "$TEST_IN"
	openssl smime -encrypt -binary -aes-256-cbc -in "$TEST_IN" -out "$TEST_OUT" -outform DER "$C" || exit 7
	openssl smime -decrypt -binary -in "$TEST_OUT" -inform DER -out "$TEST_DIFF" -inkey "$K" || exit 8
	diff -q "$TEST_IN" "$TEST_DIFF" || exit 9
	exit 0 # No restart either way
}

op_import ()
{
	[ $# -eq 2 ] || exit 1
	local K=$1
	local C=$2
	[ -r "$K" ] || exit 2
	[ -r "$C" ] || exit 3
	# Create server.pem
	cat "$C" "$K" > "$CERT"
	chmod 0600 "$CERT" || exit 4
	rm -f -- "$C" "$K"
}

op_random ()
{
	[ -z "$1" ] && exit 1
	openssl req -x509 -new -newkey rsa:4096 -keyout "$CERT" -out "$CERT" -days 5000 -nodes -subj "/C=DE/ST=Nowhere/L=Springfield/O=bwLehrpool/CN=$1" || exit 2
}

OP=$1
shift

case "$OP" in
	--random) op_random "$@" ;;
	--test) op_test "$@" ;;
	--import) op_import "$@" ;;
	--disable) op_disable ;;
	*)
		echo "Invalid operation: $1"
		exit 1
		;;
esac

service lighttpd restart

exit 0