#!/bin/bash
#
# Script: mjact_jaildom
#
# Usage: mjact_jaildom domain.tld ip user
#
# Description: Set a domain under a specific system user and PHP pool for isolation.
#
# Author: Matias Eberhardt
#
# Changelog:
# * 11.28.2025: Matias Eberhardt
# - Initial write

if [ "$#" -ne 3 ]; then
  echo "Usage: mjact_jaildom domain.tld ip user"
  exit 1
fi

#Params: domain.tld ip user 
WWWUSR=$3
IP=$2
DOMAIN=$1

##TODO:
# If  the script is run without parametes, it should offer a prompt
# Option to definde the base path, /home default

#################################################################
# Check if the IP is on this server
#################################################################
if ! ip -o -4 addr show | grep -q "\s$IP/"; then
	echo "ERROR: The IP $IP is not here."
        exit 1;
fi

WWWUSR_HOME=""
#################################################################
# Valid username.
#################################################################
user_regex="^[a-z_][a-z0-9_-]{0,30}$"
if [[ "$WWWUSR" =~ $user_regex ]]; then
    # Check if user exists. If  it exists, just create the directory and apache vhost
    if id "$WWWUSR" &>/dev/null; then
	WWWUSR_HOME=$(eval echo ~$WWWUSR)
	echo "User '$WWWUSR' exists and has the following home dir: $WWWUSR_HOME"
	while true; do
            read -p "Would you like to create the domain under this user? [Y/n] " yn
            case $yn in
                [Yy]* ) echo "Setting $DOMAIN under user $WWWUSR"; break;;
                [Nn]* ) echo "Exiting."; exit;;
                * ) echo "Please answer yes or no.";;
            esac
        done
    else
        #read -p "Enter the path under the user's home will be created (Default: /home): " -i "/home" -e HOME_PATH
        #useradd $WWWUSR -b $HOME_PATH 
        useradd $WWWUSR 
        WWWUSR_HOME=$(eval echo ~$WWWUSR)
        chown :apache $WWWUSR_HOME
        chmod g+x $WWWUSR_HOME
        sudo -u $WWWUSR mkdir $WWWUSR_HOME/php-fpm
        sudo -u $WWWUSR mkdir $WWWUSR_HOME/tmp
        echo "User $WWWUSR created."
    fi
else
    echo "Invalid user $WWWUSR"
    exit 1
fi

#################################################################
#Docroot
#################################################################
if [ ! -d "$WWWUSR_HOME/domains/$DOMAIN/public_html" ]; then
    sudo -u $WWWUSR mkdir -p $WWWUSR_HOME/domains/$DOMAIN/public_html
    echo "$DOMAIN" | sudo -u $WWWUSR tee $WWWUSR_HOME/domains/$DOMAIN/public_html/index.php > /dev/null
    echo "The domain docroot has been created: $WWWUSR_HOME/domains/$DOMAIN/public_html"
else
    echo "The document root already exists. Skipping"
fi


# I put this block here and not inside the IF clause, as an user may not have a FPM config.
#################################################################
# PHP-FPM pool
#################################################################
# List the PHP versions running allow to select one.
php_version_list=($(ps aux  | grep php-fpm | grep 'master process' | sed -n 's/.*(\(.*\)).*/\1/p'))
phpfpm_cf=""
if [[ ${#php_version_list[@]} > 1 ]]; then
    PS3="Select PHP-FPM version: "
    select config in "${php_version_list[@]}"; do
        if [[ -f "$config" ]]; then
	    phpfpm_cf=$config
            echo "You selected: $config"
            break;
        else
            echo "Invalid selection. Try again"
        fi
    done
else
    phpfpm_cf=${php_version_list[0]}
    echo "Only one PHP-FPM running: $phpfpm_cf"
fi

phpfpm_path=$(grep ^include $phpfpm_cf)
phpfpm_path=${phpfpm_path#*=}
phpfpm_path=${phpfpm_path%/*}
echo " The pool config will be created under $phpfpm_path/"
socket_path=$(grep \.sock$ $phpfpm_path/www.conf)
socket_path=${socket_path#*=}
socket_path=${socket_path%/*}
socket_path="${socket_path// /}"
phpver=$(echo $socket_path | grep -oP 'php[0-9.]+')
if [ -z "$phpver" ]; then
    phpver="php-fpm"
fi
sudo -u $WWWUSR mkdir -p $WWWUSR_HOME/tmp/$phpver/{session,wsdlcache,opcache}

if [ ! -f "$phpfpm_path/$WWWUSR.conf" ]; then
cat <<EOF > $phpfpm_path/$WWWUSR.conf
[$WWWUSR]
user = $WWWUSR
group = $WWWUSR
listen = $socket_path/$WWWUSR.sock
listen.owner = $WWWUSR
listen.group = apache
listen.mode = 0660
listen.allowed_clients = 127.0.0.1
pm = ondemand
pm.max_children = 50
;pm.start_servers = 5
;pm.min_spare_servers = 5
;pm.max_spare_servers = 10
pm.process_idle_timeout = 10s
pm.max_requests = 100
slowlog = /home/$WWWUSR/php-fpm/${WWWUSR}_${phpver}_slow.log
clear_env = no
php_flag[display_errors] = off
php_admin_value[error_log] = /home/$WWWUSR/php-fpm/${WWWUSR}_${phpver}_error.log
php_admin_flag[log_errors] = on
php_value[session.save_handler] = files
php_value[session.save_path] = $WWWUSR_HOME/tmp/$phpver/session
;php_value[soap.wsdl_cache_dir] = $WWWUSR_HOME/tmp/$phpver/wsdlcache
;php_value[opcache.file_cache] = $WWWUSR_HOME/tmp/$phpver/opcache
EOF

    systemctl restart php-fpm.service
    echo "PHP FPM config created for user $WWWUSR".
else
    echo "The PHP-FPM config already exist. Skipping"
fi

#################################################################
# Apache vhost
#################################################################
if [ ! -f "/etc/httpd/sites-available/$DOMAIN.conf" ]; then
cat <<EOF > /etc/httpd/sites-available/$DOMAIN.conf
<VirtualHost $IP:80>
ServerName $DOMAIN
ServerAlias www.$DOMAIN
DocumentRoot /home/$WWWUSR/domains/$DOMAIN/public_html
CustomLog /var/log/httpd/domlog/${DOMAIN}_access_log combined
SuexecUserGroup $WWWUSR $WWWUSR
<Directory /home/$WWWUSR/domains/$DOMAIN/public_html>
     Options Indexes FollowSymLinks MultiViews
     AllowOverride all
     Require all granted
    <IfModule mod_proxy_fcgi.c>
        <FilesMatch .php$>
            SetHandler proxy:unix:$socket_path/$WWWUSR.sock|fcgi://localhost/
        </FilesMatch>
    </IfModule>
</Directory>
#RewriteEngine On
#RewriteCond %{HTTPS} off
#RewriteCond %{REQUEST_URI} !/.well-known
#RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R,L]
</VirtualHost>

#<VirtualHost $IP:443>
#ServerName $DOMAIN
#ServerAlias www.$DOMAIN
#DocumentRoot /home/$WWWUSR/domains/$DOMAIN/public_html
#CustomLog /var/log/httpd/domlog/${DOMAIN}_access_log combined
#SuexecUserGroup $WWWUSR $WWWUSR
#<Directory /home/$WWWUSR/domains/$DOMAIN/public_html>
#     Options Indexes FollowSymLinks MultiViews
#     AllowOverride all
#     Require all granted
#    <IfModule mod_proxy_fcgi.c>
#        <FilesMatch .php$>
#            SetHandler proxy:unix:$socket_path/$WWWUSR.sock|fcgi://localhost/
#        </FilesMatch>
#    </IfModule>
#</Directory>
#SSLEngine on
#SSLCertificateFile /etc/letsencrypt/live/$DOMAIN/cert.pem
#SSLCertificateKeyFile /etc/letsencrypt/live/$DOMAIN/privkey.pem
#SSLCertificateChainFile /etc/letsencrypt/live/$DOMAIN/chain.pem
#</VirtualHost>
EOF
    cd /etc/httpd/sites-enabled; ln -s ../sites-available/$DOMAIN.conf .
    apachectl configtest && apachectl graceful
    echo "Apache vhost created for $DOMAIN. Once the SSL certificate is issued, please enable the 443 vhost."
else
    echo "The apache vhost already exist. Skipping."
fi

echo "Done!"
exit 0;