#!/bin/sh
#
# PROVIDE: chessd
# REQUIRE: DAEMON NETWORKING postgresql
# KEYWORD: shutdown
#
# chessd_enable:           Set to YES to enable chessd on startup.
# chessd_user:             User to run as. Default: chess
# chessd_group:            Group to run as. Default: chess
# chessd_home:             Account home. Default: /home/chess
# chessd_bin:              Server binary. Default: ${chessd_home}/bin/chess-server
# chessd_logs:             Log file path. Default: /var/log/chessd.log
# chessd_host:             Listen address. Default: 0.0.0.0
# chessd_port:             Listen port. Default: 8080
# chessd_dsn:              PostgreSQL connection. Default: postgres:///chess?host=/tmp
#                          (database chess over the Unix socket, as the OS user)
# chessd_jwt_key:          JWT signing key, created on first start (mode 0600).
#                          Default: ${chessd_home}/jwt.key
# chessd_trusted_proxies:  Reverse-proxy address(es) whose X-Real-IP header is
#                          trusted as the client address. Default: none
# chessd_public_url:       The web client's public address, which emailed links
#                          open. Default: none
# chessd_smtp_host:        SMTP relay for password-reset email (the mail jail).
#                          Unset leaves password recovery off. Default: none
# chessd_smtp_port:        Relay port. Default: 25
# chessd_smtp_user:        Relay user name, when the relay authenticates
#                          this host. Default: none
# chessd_smtp_password_file: File holding that user's password, mode 0600.
#                          Default: ${chessd_home}/smtp.secret when it exists
# chessd_mail_from:        Sender address of server email. Default: none
# chessd_flags:            Additional flags passed to the binary. Default: ""
#
# Add the following to /etc/rc.conf to enable:
#   chessd_enable="YES"
#   chessd_trusted_proxies="<address nginx connects from>"
# and, for password recovery by email, once the mail jail relays for this one:
#   chessd_public_url="https://<site>/chess/web-client/"
#   chessd_smtp_host="<mail jail address>"
#   chessd_mail_from="Chess <chess@<site>>"

. /etc/rc.subr

name="chessd"
rcvar="chessd_enable"
desc="Chess Server Daemon"

load_rc_config "$name"

: ${chessd_enable:="NO"}
: ${chessd_user:="chess"}
: ${chessd_group:="chess"}
: ${chessd_home:="/home/chess"}
: ${chessd_bin:="${chessd_home}/bin/chess-server"}
: ${chessd_logs:="/var/log/chessd.log"}
: ${chessd_host:="0.0.0.0"}
: ${chessd_port:="8080"}
: ${chessd_dsn:="postgres:///chess?host=/tmp"}
: ${chessd_jwt_key:="${chessd_home}/jwt.key"}
: ${chessd_trusted_proxies:=""}
: ${chessd_public_url:=""}
: ${chessd_smtp_host:=""}
: ${chessd_smtp_port:="25"}
: ${chessd_smtp_user:=""}
: ${chessd_smtp_password_file:=""}
: ${chessd_mail_from:=""}
: ${chessd_flags:=""}

command="${chessd_bin}"
pidfile="/var/run/${name}.pid"

start_precmd="${name}_prestart"
start_cmd="${name}_start"
stop_cmd="${name}_stop"
status_cmd="${name}_status"

chessd_prestart()
{
    if [ ! -x "${command}" ]; then
        err 1 "${command} is missing or not executable"
    fi

    touch "${chessd_logs}"
    chown "${chessd_user}:${chessd_group}" "${chessd_logs}"
    chmod 640 "${chessd_logs}"

    # A stable signing key keeps sessions valid across restarts. The server
    # refuses a key readable by group or others.
    if [ ! -f "${chessd_jwt_key}" ]; then
        (umask 077 && /usr/bin/openssl rand -base64 48 > "${chessd_jwt_key}") ||
            err 1 "cannot create ${chessd_jwt_key}"
        chown "${chessd_user}:${chessd_group}" "${chessd_jwt_key}"
        echo "Created JWT signing key ${chessd_jwt_key}."
    fi
}

chessd_start()
{
    if chessd_status >/dev/null 2>&1; then
        echo "${desc} is already running as PID $(cat ${pidfile})."
        return 0
    fi

    set -- -api-host "${chessd_host}" -api-port "${chessd_port}" \
        -dsn "${chessd_dsn}" -jwt-secret-file "${chessd_jwt_key}"
    if [ -n "${chessd_trusted_proxies}" ]; then
        set -- "$@" -trusted-proxies "${chessd_trusted_proxies}"
    fi
    # Password recovery by email: relay, sender, and the client address the
    # link opens. The server refuses a relay without the other two.
    if [ -n "${chessd_smtp_host}" ]; then
        set -- "$@" -smtp-host "${chessd_smtp_host}" -smtp-port "${chessd_smtp_port}" \
            -mail-from "${chessd_mail_from}" -public-url "${chessd_public_url}"
        if [ -n "${chessd_smtp_user}" ]; then
            set -- "$@" -smtp-user "${chessd_smtp_user}"
            secret="${chessd_smtp_password_file:-${chessd_home}/smtp.secret}"
            if [ -f "${secret}" ]; then
                set -- "$@" -smtp-password-file "${secret}"
            fi
        fi
    fi

    echo "Starting ${desc}."
    # -r restarts the server 5 seconds after an unexpected exit (for example
    # when PostgreSQL is not yet accepting connections); -H reopens the log
    # file on SIGHUP so newsyslog can rotate it.
    /usr/sbin/daemon \
        -P "${pidfile}" \
        -r -R 5 \
        -H \
        -u "${chessd_user}" \
        -o "${chessd_logs}" \
        -f \
        /usr/bin/env \
            HOME="${chessd_home}" \
            PATH="${chessd_home}/bin:/usr/local/bin:/usr/bin:/bin" \
            "${command}" "$@" ${chessd_flags}
}

chessd_stop()
{
    if [ -f "${pidfile}" ]; then
        echo "Stopping ${desc}."
        kill -TERM "$(cat ${pidfile})" 2>/dev/null
        wait_for_pids "$(cat ${pidfile})"
        rm -f "${pidfile}"
    else
        echo "${desc} is not running (no pidfile)."
    fi
}

chessd_status()
{
    if [ -f "${pidfile}" ] && kill -0 "$(cat ${pidfile})" 2>/dev/null; then
        echo "${desc} is running as PID $(cat ${pidfile})."
    else
        echo "${desc} is not running."
        return 1
    fi
}

run_rc_command "$1"