#!/bin/bash

apt update && apt dist-upgrade -y

apt install -y curl zip unzip bsd-mailx

echo "
export LS_OPTIONS='--color=auto -lha'
eval \"\`dircolors\`\"
alias ls='ls \$LS_OPTIONS'
alias rm='rm -i'
alias cp='cp -i'
alias mv='mv -i'
alias grep='grep --color'" >> /root/.bashrc

echo 'Europe/Paris' > /etc/timezone
dpkg-reconfigure tzdata

sed -i -e 's/^# fr_FR\.UTF-8 UTF-8$/fr_FR.UTF-8 UTF-8/g' /etc/locale.gen
echo 'LANG=fr_FR.UTF-8' > /etc/default/locale
echo 'LANG=fr_FR.UTF-8' > /etc/locale.conf
echo 'LC_ALL=fr_FR.UTF-8' >> /etc/environment
locale-gen && update-locale

postconf -e compatibility_level=2
postconf -e "mynetworks=127.0.0.0/8, localhost"

echo 'debug@yoopee.fr' > /root/.forward

apt install -y unattended-upgrades

sed -i -e 's/\/\/      "o=Debian,a=stable";/        "o=Debian,a=stable";/g' /etc/apt/apt.conf.d/50unattended-upgrades
sed -i -e 's/\/\/      "o=Debian,a=stable-updates";/        "o=Debian,a=stable-updates";/g' /etc/apt/apt.conf.d/50unattended-upgrades
sed -i -e 's/\/\/      "o=Debian,a=proposed-updates";/        "o=Debian,a=proposed-updates";/g' /etc/apt/apt.conf.d/50unattended-upgrades
sed -i -e 's/\/\/      "o=Debian Backports,a=${distro_codename}-backports,l=Debian Backports";/        "o=Debian Backports,a=${distro_codename}-backports,l=Debian Backports";/g' /etc/apt/apt.conf.d/50unattended-upgrades
sed -i -e 's/\/\/Unattended-Upgrade::Mail "";/Unattended-Upgrade::Mail "root";/g' /etc/apt/apt.conf.d/50unattended-upgrades

mkdir -p /etc/systemd/system/apt-daily.timer.d/
echo '[Timer]
OnCalendar=
OnCalendar=06:30
RandomizedDelaySec=15m' > /etc/systemd/system/apt-daily.timer.d/override.conf

mkdir -p /etc/systemd/system/apt-daily-upgrade.timer.d/
echo '[Timer]
OnCalendar=
OnCalendar=07:00
RandomizedDelaySec=1h' > /etc/systemd/system/apt-daily-upgrade.timer.d/override.conf

systemctl daemon-reload
systemctl restart apt-daily.timer
systemctl restart apt-daily-upgrade.timer

apt install -y mariadb-server

mysqladmin --user=root password

echo '[mysqld]
log-error = /var/log/mysql/mariadb.log' > /etc/mysql/conf.d/yoopee.cnf

service mysql reload

apt install -y software-properties-common dirmngr

echo "deb http://nginx.org/packages/mainline/debian/ buster nginx
deb-src http://nginx.org/packages/mainline/debian/ buster nginx" > /etc/apt/sources.list.d/nginx.list
wget -qO - https://nginx.org/keys/nginx_signing.key | apt-key add -
apt update

apt remove -y nginx nginx-common
apt install -y nginx

echo "include /etc/nginx/sites-enabled/*;" > /etc/nginx/conf.d/sites.conf
sed -i -e 's/^user  nginx;$/user  www-data;/g' /etc/nginx/nginx.conf

service nginx start

apt install -y php7.3-fpm php7.3-mysql php7.3-gd php7.3-intl php7.3-memcache php7.3-zip php7.3-xml php7.3-curl php7.3-mbstring

apt install -y php-dev libmcrypt-dev php-pear
pecl channel-update pecl.php.net
pecl install channel://pecl.php.net/mcrypt-1.0.2

sed -i -e 's/^;cgi\.fix_pathinfo=1$/cgi.fix_pathinfo=0/g' /etc/php/7.3/fpm/php.ini

echo 'memory_limit = 512M
upload_max_filesize = 100M
post_max_size = 100M
max_execution_time = 180
extension=mcrypt.so
mysql.allow_persistent = Off' > /etc/php/7.3/fpm/conf.d/30-yoopee.ini

cp /etc/php/7.3/fpm/conf.d/30-yoopee.ini /etc/php/7.3/cli/conf.d/30-yoopee.ini

echo 'client_max_body_size 100M;
fastcgi_send_timeout 180s;
fastcgi_read_timeout 180s;' > /etc/nginx/conf.d/yoopee.conf

mkdir -p /etc/nginx/snippets

echo '# regex to split $uri to $fastcgi_script_name and $fastcgi_path
fastcgi_split_path_info ^(.+\.php)(/.+)$;

# Check that the PHP script exists before passing it
try_files $fastcgi_script_name =404;

# Bypass the fact that try_files resets $fastcgi_path_info
# see: http://trac.nginx.org/nginx/ticket/321
set $path_info $fastcgi_path_info;
fastcgi_param PATH_INFO $path_info;

fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;

fastcgi_index index.php;
include fastcgi_params;' > /etc/nginx/snippets/fastcgi-php.conf

echo "# Self signed certificates generated by the ssl-cert package
# Don't use them in a production server!

ssl_certificate /etc/ssl/certs/ssl-cert-snakeoil.pem;
ssl_certificate_key /etc/ssl/private/ssl-cert-snakeoil.key;" > /etc/nginx/snippets/snakeoil.conf

echo '# Global restrictions configuration file.
# Designed to be included in any server {} block.
location = /favicon.ico {
    log_not_found off;
    access_log off;
}

location = /robots.txt {
    allow all;
    log_not_found off;
    access_log off;
}

# Deny all attempts to access hidden files such as .htaccess, .htpasswd, .DS_Store (Mac).
# Keep logging the requests to parse later (or to pass to firewall utilities such as fail2ban)
location ~ /\. {
    deny all;
}
# Except for letsencrypt challenge
location ^~ /.well-known {
    allow all;
}' > /etc/nginx/snippets/restrictions.conf

mkdir -p /var/www/html

touch /var/www/html/index.html

mkdir -p /var/www/adminer && chown -R www-data:www-data /var/www/ && chmod 0775 /var/www

apt install -y git

git clone http://gitlab.yoopee.fr/tools/adminer.git /var/www/adminer/

echo '0 5 * * * root /usr/bin/git -C /var/www/adminer/ pull >/dev/null 2>&1' > /etc/cron.d/adminer-autoupdate

service cron reload

mkdir -p /etc/nginx/sites-{available,enabled}

echo '# Default server configuration
server {
    listen 80 default_server;
    listen [::]:80 default_server;

    root /var/www/html;

    server_name _;

    location / {
        # First attempt to serve request as file, then
        # as directory, then fall back to displaying a 404.
        try_files $uri $uri/ =404;
    }
}' > /etc/nginx/sites-available/default

ln -s /etc/nginx/sites-available/default /etc/nginx/sites-enabled/

echo 'server {
    listen 12345 ssl;
    root /var/www/adminer;
    access_log /var/log/nginx/adminer.access.log;
    error_log /var/log/nginx/adminer.error.log;
 
    index index.php index.html;
 
    location ~ \.php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/var/run/php/php7.3-fpm.sock;
    }

    include snippets/snakeoil.conf;
    error_page 497 https://$host:12345$request_uri;
}' > /etc/nginx/sites-available/adminer

ln -s /etc/nginx/sites-available/adminer /etc/nginx/sites-enabled/

service nginx restart && service php7.3-fpm restart

apt install -y python-certbot-nginx

apt install -y proftpd

echo 'SFTPEngine On
Port 22
SFTPAuthMethods password
RequireValidShell off
AllowOverwrite on
IdentLookups off
SFTPLog /var/log/proftpd-sftp.log
SFTPCryptoDevice all
SFTPCompression off
SFTPHostKey /etc/ssh/ssh_host_dsa_key
SFTPHostKey /etc/ssh/ssh_host_rsa_key

UseIPv6 off
ServerType standalone
ListOptions "-la"
DefaultRoot ~' > /etc/proftpd/conf.d/yoopee.conf

service proftpd restart

sed -i -e 's/Subsystem\tsftp\t\/usr\/lib\/openssh\/sftp-server/Subsystem\tsftp\tinternal-sftp/g' /etc/ssh/sshd_config

echo '
Match Group www-data
    ChrootDirectory %h
    X11Forwarding no
    AllowTcpForwarding no
    ForceCommand internal-sftp' >> /etc/ssh/sshd_config

chown root:root /var/www && chmod 755 /var/www

service sshd reload

echo '/bin/false' >> /etc/shells

useradd www --gid www-data --home /var/www/ --shell /bin/false && passwd www

#reboot

apt-get clean

rm -rf /tmp/*

> /root/.bash_history

exit 0
