#!/bin/sh

have(){
    command -v $1 2> /dev/null && echo -n $1
}

WGET=$(have wget)
CURL=$(have curl)
APT=$(have apt-get)
APK=$(have apk)
YUM=$(have yum)
PACMAN=$(have pacman)


RED='\033[0;31m'
GREEN='\033[0;32m' 
NC='\033[0m' # No Color

red() {
    printf "${RED}$@${NC}\n"
}

green() {
    printf "${GREEN}$@${NC}\n"
}


install(){
    if   [ ! -z "$APT" ] ; then
        apt-get update
        apt-get install -y $1
    elif [ ! -z "$APK" ] ; then 
        apk upgrade
        apk add $1
    elif [ ! -z "$YUM" ] ; then 
        yum -y install $1
    elif [ ! -z "$PACMAN" ] ; then 
        yes | pacman -Syu $1
    fi
}

append_file(){
    #sh -c 'echo "$1" >> $2'
    touch "$2"
    echo "$1" | tee -a "$2" > /dev/null
}

set_env(){
    E=$1
    if [ ! -f  /etc/environment ] || ! grep -q -e "$E" /etc/environment ; then 
        append_file "$E" /etc/environment
    fi
    export "$E"
}

install_cert() {

    CERT="$1"

    if [ -z "$CURL" ] ; then
        install curl
        CURL=$(have curl)
    fi

    command -v "update-ca-certificates" 2> /dev/null || (
        install ca-certificates
        update-ca-certificates
    )

    BUNDLE=

    if [ -f /etc/pki/tls/certs/ca-bundle.crt ]; then 
        BUNDLE=/etc/pki/tls/certs/ca-bundle.crt
    fi

    if [ -f /etc/ssl/certs/ca-certificates.crt ]; then 
        BUNDLE=/etc/ssl/certs/ca-certificates.crt
    fi

    DIRCA=

    if [ -d /usr/local/share/ca-certificates ]; then 
        DIRCA=/usr/local/share/ca-certificates
    fi

    if [ -d /etc/pki/ca-trust/source/anchors ]; then 
        DIRCA=/etc/pki/ca-trust/source/anchors
    fi

    if [ -d /etc/ca-certificates/trust-source/anchors ]; then 
        DIRCA=/etc/ca-certificates/trust-source/anchors
    fi

    CERT1L=$(echo "$CERT" | tr -d \\n\\r)
    CERTS1L=$(cat "$BUNDLE" | tr -d \\n\\r)

    if echo "$CERTS1L" | grep -q -e "$CERT1L" ; then
        echo "installed"
    else
        
        
        append_file "$CERT" "$BUNDLE"

        append_file "$CERT" "${DIRCA}/netfree-ca.crt"

        update-ca-certificates
        update-ca-trust
        
        if [ ! -z "$APK" ]; then 
            append_file "$CERT" "$BUNDLE"
        fi

        ln -s "$BUNDLE" /etc/ca-bundle.crt
        # for nodejs
        set_env "NODE_EXTRA_CA_CERTS=/etc/ca-bundle.crt"

        # for requests python
        set_env "REQUESTS_CA_BUNDLE=/etc/ca-bundle.crt" 

        # for python
        set_env "SSL_CERT_FILE=/etc/ca-bundle.crt" 
    fi
}

test_install() {
 ## test
        TEST=
        if [ ! -z "$CURL" ] ; then
            TEST=$(curl https://test.internal.netfree.link/user/0 2>&1 )  
        else
            TEST=$(wget -O - https://test.internal.netfree.link/user/0 2>&1 )
        fi

        if echo "$TEST" | grep -q "userKey" ; then
            green "Certificate works successfully"
        elif echo "$TEST" | grep -q "unable to get local issuer" ; then
            red "Certificate error"
            exit 1
        else
            red "Some error"
        fi
}



CERT1=$(cat <<EOF
# ed25519 NetFree Root CA
-----BEGIN CERTIFICATE-----
MIIB2TCCAYugAwIBAgIFGZAiAAQwBQYDK2VwMHkxCzAJBgNVBAYTAklMMRUwEwYD
VQQIEwxNb2RpJ2luIElsaXQxEDAOBgNVBAoTB05ldEZyZWUxFTATBgNVBAsTDG5l
dGZyZWUubGluazEqMCgGA1UEAxMhTmV0RnJlZSBSb290IENBIDE5OTAtMjIwMCBF
RDI1NTE5MCAXDTkwMDEwMTAwMDAwMFoYDzIyMDAwMTAxMDAwMDAwWjB5MQswCQYD
VQQGEwJJTDEVMBMGA1UECBMMTW9kaSdpbiBJbGl0MRAwDgYDVQQKEwdOZXRGcmVl
MRUwEwYDVQQLEwxuZXRmcmVlLmxpbmsxKjAoBgNVBAMTIU5ldEZyZWUgUm9vdCBD
QSAxOTkwLTIyMDAgRUQyNTUxOTAqMAUGAytlcAMhAOKoGaqolRcXGSA3e9AOeVEg
XR1u/M8kF0pAER08SsJsozIwMDAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBRx
/pWjrNJFdvTPj1TyWLUfKSanMDAFBgMrZXADQQA6KlOZ5NLUfyUDn47fTyCDlnd4
vBDqwgEm8Dy+GQ4EuTSqOL0+71Q4XzytQ1uKJmwVvGZtTzIjHsk5WaRgypYG
-----END CERTIFICATE-----
EOF
)

CERT2=$(cat <<EOF
# p-256 NetFree Root CA
-----BEGIN CERTIFICATE-----
MIICFjCCAb2gAwIBAgIFGZAiAAIwCgYIKoZIzj0EAwIweDELMAkGA1UEBhMCSUwx
FTATBgNVBAgTDE1vZGknaW4gSWxpdDEQMA4GA1UEChMHTmV0RnJlZTEVMBMGA1UE
CxMMbmV0ZnJlZS5saW5rMSkwJwYDVQQDEyBOZXRGcmVlIFJvb3QgQ0EgMTk5MC0y
MjAwIEVDQzI1NjAgFw05MDAxMDEwMDAwMDBaGA8yMjAwMDEwMTAwMDAwMFoweDEL
MAkGA1UEBhMCSUwxFTATBgNVBAgTDE1vZGknaW4gSWxpdDEQMA4GA1UEChMHTmV0
RnJlZTEVMBMGA1UECxMMbmV0ZnJlZS5saW5rMSkwJwYDVQQDEyBOZXRGcmVlIFJv
b3QgQ0EgMTk5MC0yMjAwIEVDQzI1NjBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IA
BPDj6XBPP1qJms+9SaEM/MLFF8hYzl62+VQ75h4f3P2fjl2lmCwHHPZNBx9wZ0Tl
uU87urMCuWC+ZK4+CTwL+1CjMjAwMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYE
FKuZotWrhs/16LExmLa1AZdHHugOMAoGCCqGSM49BAMCA0cAMEQCICn+iBiR2nh1
YubJg+jg5Ik9Fez0RDERCT7zBPDoOYJbAiAiGoxwGufKRj0a1Ic1gs9TooCVaOel
KBnJYvXN+rZPWQ==
-----END CERTIFICATE-----
EOF
)

CERT3=$(cat <<EOF
# p-384 NetFree Root CA
-----BEGIN CERTIFICATE-----
MIICVDCCAdqgAwIBAgIFGZAiAAMwCgYIKoZIzj0EAwMweDELMAkGA1UEBhMCSUwx
FTATBgNVBAgTDE1vZGknaW4gSWxpdDEQMA4GA1UEChMHTmV0RnJlZTEVMBMGA1UE
CxMMbmV0ZnJlZS5saW5rMSkwJwYDVQQDEyBOZXRGcmVlIFJvb3QgQ0EgMTk5MC0y
MjAwIEVDQzM4NDAgFw05MDAxMDEwMDAwMDBaGA8yMjAwMDEwMTAwMDAwMFoweDEL
MAkGA1UEBhMCSUwxFTATBgNVBAgTDE1vZGknaW4gSWxpdDEQMA4GA1UEChMHTmV0
RnJlZTEVMBMGA1UECxMMbmV0ZnJlZS5saW5rMSkwJwYDVQQDEyBOZXRGcmVlIFJv
b3QgQ0EgMTk5MC0yMjAwIEVDQzM4NDB2MBAGByqGSM49AgEGBSuBBAAiA2IABFM5
q55uB7nbAxn+1L+Ha7RhtT3d8ZKZmqxrjeHnWyUWYiU6NA15E89xbuIQN0jNTgPm
7R/U+vNz+kWQAovG3VkbebdhAoPrlspTFCJOQNEihLGUp/dRIkLhygEG+y0rUKMy
MDAwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUE1eRGvihK08KxwK6owVid7v9
x6UwCgYIKoZIzj0EAwMDaAAwZQIxAJX+aoHX9UxtWIu7D8UKB7qi0DYHOVgotvA+
Ctmo0p1ABD51/37KkATZ5QUWtoDEjgIwVDpR2JJQajvB7f+z9jFr/XJboCqbuOCh
1FwyoeJs9uOS6EpYINVwZS6ckdyO3tJ5
-----END CERTIFICATE-----
EOF
)

CERT4=$(cat <<EOF
# rsa NetFree Root CA
-----BEGIN CERTIFICATE-----
MIIFnTCCA4WgAwIBAgIFGZAiAAEwDQYJKoZIhvcNAQELBQAwdTELMAkGA1UEBhMC
SUwxFTATBgNVBAgTDE1vZGknaW4gSWxpdDEQMA4GA1UEChMHTmV0RnJlZTEVMBMG
A1UECxMMbmV0ZnJlZS5saW5rMSYwJAYDVQQDEx1OZXRGcmVlIFJvb3QgQ0EgMTk5
MC0yMjAwIFJTQTAgFw05MDAxMDEwMDAwMDBaGA8yMjAwMDEwMTAwMDAwMFowdTEL
MAkGA1UEBhMCSUwxFTATBgNVBAgTDE1vZGknaW4gSWxpdDEQMA4GA1UEChMHTmV0
RnJlZTEVMBMGA1UECxMMbmV0ZnJlZS5saW5rMSYwJAYDVQQDEx1OZXRGcmVlIFJv
b3QgQ0EgMTk5MC0yMjAwIFJTQTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoC
ggIBAMHGjkX+mdqQUMYMjZaJH1ZNCotQdrXjpTOUep4p5E1F8GnJzlIzrtzX2ro3
CImv41+JYXuAQoY1stirrRfk1DrvxATg7GxYPCuN1ixgPw6IgPNAqYCSqM6s2q8T
pQFsDZPAgHeJyC2GSHxVVuZkJ/cLLMCRgk/Desc2HWune+u6HTeocgaM++R+E4DE
PQEiIX/iCyne4GyfoO1Mf8VyetcoDkktTNC41P8p98JGP/vcUOouqnUg+328+A7+
05AyXjDKJtThPEzj5c9YK0v2Z7LVHj8QOvgLgq9fZPfVLqXNG1ugPIJ8qK+ZbWLk
IOnEgWxojKKbJECdnzw6WcqtV7HlpEqUEo5yJPHwcRrzR/nG8YBUv0uYrMrCiOHZ
xz1KaecvoIf63plDN4a6TBJyuGn2QwYwP3N1TpsS2xoE2ahXsb6W2LX6gNa1qHmz
gc6d89jiqqvFYNz+oj38RavlJWd+wErKJIGGSuIy4QcMy1dMGWGaJjVYx6XHkEIi
bK6KiY1yjFTYha827KuohBaT3szC/oRLVSqofcaXsaB5gCEH9j36Pw3PyGkjgqZm
TYg6QTp2W4gbb/IcACnmhUdt0pS7jyBDnk40Or4uAQ55thZNcP5DA4NqbsY+rMuY
Ifj8avRobtNzye7eUUIBzxmp0w3VRCwrgo/kMbc+EbZIVNJ5AgMBAAGjMjAwMA8G
A1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFHXy8G5y93WPiZ3+D17I/4une8V2MA0G
CSqGSIb3DQEBCwUAA4ICAQCuopuja6uFks77VZ870R6Odj0qr4aZPXOyfFWDCgHF
ofWkg+4mG/I3pdnS0p4kmCrklBZwm7cG8aAcOkzJoOYTvMUgWSFD39RFm3i8VaZ9
noMf8bst5cmyWHPpmYUYP5XntivV4nJCBot5yBAvXfvf6ckFfkUjNAyo+gl0h+V0
em4j3iLRdc8OprGPFBkWCuZWEYQ65581wtFqRlQX65IKtJr1UW/XPCz/JQ1cew4V
+MXuQgSZutwOTGELJ8Dy9kX6yHDugoKrqn51oe/LXXu4TNnGptVmzQsflxJN5Y6c
YSXHEWSO8rKynDBQhqRHyPaCZtUEwnT5dowHM9A5/hs80ei+mt95ZLT8u2AYUspK
ceMgLyM64LCwDFJiOOpYIE6LtsFmfOQPASVy4L6vswXxoRXpfeQp7WUwAHTHSA88
Ob6JwcqM4hz5kSuRl5QI92ldjoxJQer8CjIQOWB+bkf8HVJWEzzbCn4N1ApReSNC
74rKQyFdiXr795fOmpnA4/oSoo/cuqoGJfGm+Y6OK5NH96iW8vMnJsaaG5aUFZ3q
P9KF7xgiuabJa+6og+Y7roAbMV76xqI0nZtdW8Vux7BUMc+i6hameGfXvLZlY0LD
OdtJ7yXPvewMJSdysW/nMXydpz8xnfMmTerEom39z/hxc4UPwjOqntpT8aYdxFUo
aQ==
-----END CERTIFICATE-----
EOF
)

CERT5=$(cat <<EOF
# rsa 2037 NetFree Root CA
-----BEGIN CERTIFICATE-----
MIIFmzCCA4OgAwIBAgIFGZAgNwQwDQYJKoZIhvcNAQELBQAwdTELMAkGA1UEBhMC
SUwxFTATBgNVBAgTDE1vZGknaW4gSWxpdDEQMA4GA1UEChMHTmV0RnJlZTEVMBMG
A1UECxMMbmV0ZnJlZS5saW5rMSYwJAYDVQQDEx1OZXRGcmVlIFJvb3QgQ0EgMTk5
MC0yMDM3IFJTQTAeFw05MDAxMDEwMDAwMDBaFw0zNzAxMDEwMDAwMDBaMHUxCzAJ
BgNVBAYTAklMMRUwEwYDVQQIEwxNb2RpJ2luIElsaXQxEDAOBgNVBAoTB05ldEZy
ZWUxFTATBgNVBAsTDG5ldGZyZWUubGluazEmMCQGA1UEAxMdTmV0RnJlZSBSb290
IENBIDE5OTAtMjAzNyBSU0EwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoIC
AQDBxo5F/pnakFDGDI2WiR9WTQqLUHa146UzlHqeKeRNRfBpyc5SM67c19q6NwiJ
r+NfiWF7gEKGNbLYq60X5NQ678QE4OxsWDwrjdYsYD8OiIDzQKmAkqjOrNqvE6UB
bA2TwIB3icgthkh8VVbmZCf3CyzAkYJPw3rHNh1rp3vruh03qHIGjPvkfhOAxD0B
IiF/4gsp3uBsn6DtTH/FcnrXKA5JLUzQuNT/KffCRj/73FDqLqp1IPt9vPgO/tOQ
Ml4wyibU4TxM4+XPWCtL9mey1R4/EDr4C4KvX2T31S6lzRtboDyCfKivmW1i5CDp
xIFsaIyimyRAnZ88OlnKrVex5aRKlBKOciTx8HEa80f5xvGAVL9LmKzKwojh2cc9
SmnnL6CH+t6ZQzeGukwScrhp9kMGMD9zdU6bEtsaBNmoV7G+lti1+oDWtah5s4HO
nfPY4qqrxWDc/qI9/EWr5SVnfsBKyiSBhkriMuEHDMtXTBlhmiY1WMelx5BCImyu
iomNcoxU2IWvNuyrqIQWk97Mwv6ES1UqqH3Gl7GgeYAhB/Y9+j8Nz8hpI4KmZk2I
OkE6dluIG2/yHAAp5oVHbdKUu48gQ55ONDq+LgEOebYWTXD+QwODam7GPqzLmCH4
/Gr0aG7Tc8nu3lFCAc8ZqdMN1UQsK4KP5DG3PhG2SFTSeQIDAQABozIwMDAPBgNV
HRMBAf8EBTADAQH/MB0GA1UdDgQWBBR18vBucvd1j4md/g9eyP+Lp3vFdjANBgkq
hkiG9w0BAQsFAAOCAgEALM0kOPyWp3/pEFhlZrllsSOXo4K0pbg+QNuwRuFBskkq
iII4sOkb5pknq/ozXxXDP9F01GdY6o8WVPBsmdPxBNCAkvBwp3aepTZJbiuKD9nB
24W0azEuKGDDU2VOUe3ojGWML3zAK6xbitmtB0HZ4vNJPkfq+Wl2hqElMssWhK/P
gPgWvISuuFYMPtwk/fNII+vb8ModB5zH3dn7eqYy00budvKgXJzpVf1V4k0vBZ1z
y3SBEtWgaiN40TkHtw7dHlvyIRHzT7jsBj9f9e+31/RBhmeo9IohZULtqoOaQkop
AJCb6wL3dD4WdIkiylkhx14hoBha8JUYRKjuIwgQvPj7HXmwnQPx+n+pEXWK7CcI
Zu9EEreAhrxyKgyZM6iF+EnwekyVXPV8TNUFvmcuUtaj7C+yRXHCx1Q7uHszMLfN
Eo9Vj+mxr7IUiamf3AHwly5r/V9Cj1VvWR3YYLT98EXyoAHovFbysQ5ggQhPjAak
S4vrfjfQ6ji5Cr2A3niQQfrSWmyGOYL/DJqvVuGpB8c5JPo81GA2nSAwp40CZkT6
a+0O0pNauf0+fsRt12uXiTsDKEug7rSmBkRczj6i+QTTHaEibIsP6T2xtHV4zmeu
jxYFDgIEuORfgiKUI2udVq7hrSoJnxmw1rpKeh6hI/Eye7VuSLaADk6mNmnK5bM=
-----END CERTIFICATE-----
EOF
)

install_cert "$CERT1"
install_cert "$CERT2"
install_cert "$CERT3"
install_cert "$CERT4"
install_cert "$CERT5"

test_install