#!/bin/bash
# =====================================================================
#  MuaSSL.com - cai / cap nhat lenh "muassl" tren may chu Linux
#
#    curl -fsSL https://muassl.com/api/automation/cli | bash
#    curl -fsSL https://muassl.com/api/automation/cli | bash -s -- --pin=<ma PIN>
#    curl -fsSL https://muassl.com/api/automation/cli | bash -s -- --apikey=<API key>
#
#  May chu cu (CentOS 6/7...) khong xac minh duoc chung chi TLS cua muassl.com: tai truoc roi chay,
#  se tu rot ve "curl -fsSLk" khi can (cac tep tai ve van duoc doi chieu SHA-256 in san trong tep nay):
#    T=$(mktemp /tmp/muassl-cli.XXXXXX.sh)
#    (curl -fsSL https://muassl.com/api/automation/cli -o "$T" || curl -fsSLk https://muassl.com/api/automation/cli -o "$T") \
#      && [ -s "$T" ] && bash "$T" --pin=<ma PIN>; rm -f "$T"
#  --loai=<plesk|cpanel|directadmin|nginx|apache|zimbra>: ep loai may chu (mac dinh tu nhan dien).
#  Chi tai phan loi + mo-dun cua dung loai may chu nay (+ dich vu di kem dang chay, vd coturn).
#  --tudong: do cron goi khi bat "Tu cap nhat" - KHONG bao gio bo qua xac minh chung chi.
#
#  AN TOAN: khong xoa gi. Ban cu doi ten thanh <ten>.truoc-<thoi diem>, moi buoc ghi nhat ky.
# =====================================================================
set -u
PHIENBAN="2.0.5-20261013"
NGUON="https://muassl.com/api/automation/cli"
THUMUC="/usr/local/muassl"
NHATKY="/var/log/muassl-ssl.log"
LUCNAY="$(date '+%Y%m%d-%H%M%S')"
LENH="/usr/local/bin/muassl"

THAM_PIN=""; THAM_KEY=""; TUDONG=0; THAM_LOAI=""
for a in "$@"; do
  case "$a" in
    --pin=*)    THAM_PIN="${a#--pin=}";;
    --apikey=*) THAM_KEY="${a#--apikey=}";;
    --tudong)   TUDONG=1;;
    --loai=*)   case "${a#--loai=}" in plesk|cpanel|directadmin|nginx|apache|zimbra) THAM_LOAI="${a#--loai=}";; esac;;
    --nguon=*)  # chi nhan dia chi phat hanh tren muassl.com
                case "${a#--nguon=}" in https://muassl.com/api/automation/*) NGUON="${a#--nguon=}";; esac;;
  esac
done

# tep|quyen|sha256|dieu kien (sha dien luc dong goi)
#   dieu kien trong    = luon tai (loi dung chung)
#   loai:<loai>        = chi tai khi may nhan dien la loai do (plesk, cpanel, directadmin, openlitespeed, nginx, apache, zimbra)
#   tientrinh:<ten>    = chi tai khi tien trinh <ten> dang chay (dich vu di kem, vd coturn)
DANHSACH="
muassl-cli.sh|700|471c02f5fdf285e4d898e61b60c5a0ea450e6f1e02de1ddd8dbd48d75231914a|
muassl-caidat.sh|700|f9243612f51db27a48941331c62e61dab924dcab9b2677a40e10b1c06c7e67f4|
lib/chung.sh|600|85b612a7d8b4b9e01fcd65f8d2b4748cbfb7ad3c1dcb0c7fc3b5c77c9966748e|
muassl-ca.pem|644|d767ffaebb1bb658d483eeb54bd8026767798da439ef3d27444c2285aaea3df2|
muassl-goc.pem|644|5e3b3ed81eb1d63bbf250d5980f3cc894ab324d40fb445fee5cdb4ef49ccf613|
mod/plesk.sh|600|3ab52f4ac57f164474c87432ddbf22d7e91d963be0453af9da9fe0cbe9e50a42|loai:plesk
mod/cpanel.sh|600|742734da27555bd761593d432611a322024630b568050b936682335d8ef76db5|loai:cpanel
mod/directadmin.sh|600|2c22659bbe72022aa2bc2b6d241ea0c66324ac633dd2fc7b3d95d6be78bd2871|loai:directadmin
mod/openlitespeed.sh|600|805d383f222140811fc1190fe586fe1fa9fc7a0fe47d0257a52da6e088e928bf|loai:openlitespeed
mod/nginx.sh|600|760188af9d118d6f5200eaaaa6042488cbfc1c2b663c3531caf153d16a0c0d74|loai:nginx
mod/apache.sh|600|56e212e98c4250a6c3efb6d4689cc4c79fdefebcf428fc21d9914a118059de83|loai:apache
mod/zimbra.sh|600|ef6169f704bb10e4d34a59522a8ca89ba28195dec52cfe197ce7d70c6cfa1460|loai:zimbra
mod/dichvu/tuybien.sh|600|2a99bc1db05df664d54b33e12e56a6d2c95edc469bd0b6161b24238f4bc614c3|
mod/dichvu/coturn.sh|600|784141eaea24471b5934105922c1d67b8a2b53ba61fc4150e1ebefb9342a48b5|tientrinh:turnserver
"

ghi(){ printf '[%s] [cai dat] %s\n' "$(date '+%Y-%m-%d %H:%M:%S')" "$*" | tee -a "$NHATKY"; }
dung(){ ghi "LOI: $*"; exit 1; }

[ "$(id -u)" = "0" ] || { echo "Can chay voi quyen root (sudo)."; exit 1; }
ghi "Bat dau cai MuaSSL CLI $PHIENBAN tren $(hostname)$( [ $TUDONG = 1 ] && echo ' (tu cap nhat)')"
for c in curl openssl sha256sum crontab; do
  command -v "$c" >/dev/null 2>&1 || dung "thieu lenh '$c' - cai goi tuong ung roi chay lai"
done
command -v python3 >/dev/null 2>&1 || command -v python2 >/dev/null 2>&1 || command -v python >/dev/null 2>&1 \
  || dung "thieu python (python3 hoac python2)"

MOI="$THUMUC/moi-$LUCNAY"
mkdir -p "$THUMUC/don.d" "$MOI/lib" "$MOI/mod/dichvu"; chmod 700 "$THUMUC" "$THUMUC/don.d" "$MOI"

taiVe(){   # taiVe <ten> <sha256>
  local ten="$1" sha="$2" ca=""
  [ -s "$THUMUC/muassl-ca.pem" ] && ca="--cacert $THUMUC/muassl-ca.pem"
  if ! curl -fsS $ca --max-time 120 -o "$MOI/$ten" "$NGUON/$ten" 2>/dev/null \
     && ! curl -fsS --max-time 120 -o "$MOI/$ten" "$NGUON/$ten" 2>/dev/null; then
    [ "$TUDONG" = 1 ] && return 1   # tu cap nhat: khong bao gio bo qua xac minh chung chi
    ghi "  $ten: khong xac minh duoc chung chi muassl.com - tai lai va doi chieu SHA-256"
    curl -fsSk --max-time 120 -o "$MOI/$ten" "$NGUON/$ten" || return 1
  fi
  local co; co=$(sha256sum "$MOI/$ten" | awk '{print $1}')
  [ "$co" = "$sha" ] || { ghi "  $ten: SHA-256 KHONG khop - huy"; return 1; }
  ghi "  tai $ten: OK (sha256 khop)"
}

# 1. loi dung chung (khong dieu kien) - can lib/chung.sh de nhan dien may chu
echo "$DANHSACH" | while IFS='|' read -r ten quyen sha dk; do
  [ -n "$ten" ] && [ -z "$dk" ] || continue
  taiVe "$ten" "$sha" || exit 1
done || dung "tai ve that bai - khong thay doi gi tren may chu. Tep dang do: $MOI"

# 2. nhan dien loai may chu bang chinh ham cua lenh muassl (co tinh LOAI_EPBUOC trong chung.conf)
LOAI_MAY="$THAM_LOAI"
[ -n "$LOAI_MAY" ] || LOAI_MAY=$(MUASSL_THUMUC="$THUMUC" bash -c '. "$1/lib/chung.sh" >/dev/null 2>&1; phatHienLoai' _ "$MOI" 2>/dev/null)
ghi "  may chu nhan dien: ${LOAI_MAY:-KHONG RO}"
[ -n "$LOAI_MAY" ] || ghi "  CHU Y: khong nhan dien duoc - chi cai phan loi. Ep loai: bash install.sh --loai=nginx (plesk|cpanel|directadmin|nginx|apache|zimbra)"

# 3. chi tai mo-dun cua loai may nay + dich vu di kem dang chay
canTai(){   # canTai <dieu kien> -> 0 neu tep can cho may nay
  case "$1" in
    "") return 0;;
    loai:*) [ "${1#loai:}" = "$LOAI_MAY" ];;
    tientrinh:*) pgrep -x "${1#tientrinh:}" >/dev/null 2>&1;;
    *) return 1;;
  esac
}
echo "$DANHSACH" | while IFS='|' read -r ten quyen sha dk; do
  [ -n "$ten" ] && [ -n "$dk" ] && canTai "$dk" || continue
  taiVe "$ten" "$sha" || exit 1
done || dung "tai mo-dun that bai - khong thay doi gi tren may chu. Tep dang do: $MOI"

# Dat vao cho: ban dang co (neu khac) doi ten, ban moi dat bang mv (inode moi -> tien trinh
# dang chay van doc ban cu tron ven)
echo "$DANHSACH" | while IFS='|' read -r ten quyen sha dk; do
  [ -n "$ten" ] && [ -e "$MOI/$ten" ] || continue
  dich="$THUMUC/$ten"; mkdir -p "$(dirname "$dich")"; chmod 700 "$(dirname "$dich")"
  if [ -e "$dich" ]; then
    if cmp -s "$dich" "$MOI/$ten"; then ghi "  $ten: khong doi"; continue; fi
    cp -p "$dich" "$dich.truoc-$LUCNAY" && ghi "  $ten: ban cu luu thanh $ten.truoc-$LUCNAY"
  fi
  chmod "$quyen" "$MOI/$ten" && cp -p "$MOI/$ten" "$dich.moi-$LUCNAY" && mv "$dich.moi-$LUCNAY" "$dich" && ghi "  $ten: da cai"
done

if [ -L "$LENH" ] && [ "$(readlink "$LENH")" = "$THUMUC/muassl-cli.sh" ]; then :
else
  { [ -e "$LENH" ] || [ -L "$LENH" ]; } && { mv "$LENH" "$LENH.truoc-$LUCNAY"; ghi "  $LENH cu doi ten thanh muassl.truoc-$LUCNAY"; }
  ln -s "$THUMUC/muassl-cli.sh" "$LENH" && ghi "  tao lenh $LENH"
fi
echo "$PHIENBAN" > "$THUMUC/PHIENBAN"
mkdir -p "$THUMUC/sao-luu"; mv "$MOI" "$THUMUC/sao-luu/goi-cai-$LUCNAY"

# Cron da bat thi viet lai tep chay cho khop ban moi
if crontab -l 2>/dev/null | grep -q muassl-cron.sh; then
  "$LENH" cron bat >/dev/null 2>&1 && ghi "  lich tu dong da duoc lam moi"
fi

ghi "Xong - MuaSSL CLI $PHIENBAN."
[ "$TUDONG" = 1 ] && exit 0
echo ""
echo "  Da cai MuaSSL CLI $PHIENBAN. May chu nhan dien: $("$LENH" phienban | sed 's/.*may chu: //')"
if [ -n "$THAM_KEY" ]; then "$LENH" apikey "$THAM_KEY"
elif [ -n "$THAM_PIN" ]; then "$LENH" pin "$THAM_PIN"; fi
echo "  Go 'muassl' de mo menu; 'muassl them' de them don hang cho cac site tren may."