#!/bin/sh
# postinst script for crashbox-nginx-config
#
# see: dh_installdeb(1)

set -e

# summary of how this script can be called:
#        * <postinst> `configure' <most-recently-configured-version>
#        * <old-postinst> `abort-upgrade' <new version>
#        * <conflictor's-postinst> `abort-remove' `in-favour' <package>
#          <new-version>
#        * <postinst> `abort-remove'
#        * <deconfigured's-postinst> `abort-deconfigure' `in-favour'
#          <failed-install-package> <version> `removing'
#          <conflicting-package> <version>
# for details, see https://www.debian.org/doc/debian-policy/ or
# the debian-policy package


case "$1" in
    configure)
	ln -f -s /etc/nginx/sites-available/default.conf /etc/nginx/sites-enabled/default
	usermod --append --groups ssl-cert www-data
	ufw allow 80/tcp
	ufw allow 443/tcp

	if [ ! -r /etc/ssl/private/server.key.pem ] \
		  || [ ! -r /etc/ssl/server.cert.pem ] \
		  || [ ! -r /etc/ssl/issuer.cert.pem ]; then
	    ln -f -s /etc/ssl/private/ssl-cert-snakeoil.key /etc/ssl/private/server.key.pem
	    ln -f -s /etc/ssl/certs/ssl-cert-snakeoil.pem /etc/ssl/server.cert.pem
	    ln -f -s /etc/ssl/certs/ssl-cert-snakeoil.pem /etc/ssl/issuer.cert.pem
	    echo "WARNING: no certificates found, falling back to snakeoil certificates!" >&2
	fi
	
	deb-systemd-invoke restart nginx
    ;;

    abort-upgrade|abort-remove|abort-deconfigure)
    ;;

    *)
        echo "postinst called with unknown argument \`$1'" >&2
        exit 1
    ;;
esac

# dh_installdeb will replace this with shell code automatically
# generated by other debhelper scripts.

#DEBHELPER#

exit 0