#!/usr/bin/bash

stty sane 2>/dev/null || true

# enable job control
set -m

set -a

config_start_checksum() {
    START_CHECKSUM=$(sha512sum /etc/exaba/exaba-vars.env)
}

config_now_checksum() {
    NOW_CHECKSUM=$(sha512sum /etc/exaba/exaba-vars.env)
}

exaba_seedhash() {
    if [ "$EXABA_SEED" == "" ]; then
	EXABA_SEEDHASH="seed not set"
    else
	EXABA_SEEDHASH=$(/usr/bin/exaba-cli random generate -q -t hex -l 6 --seed $EXABA_SEED --key HASH)
    fi
}


create_iam_url() {
    if [ "$IAMFQDN" != "" ]; then
	IAM=$IAMFQDN
    else
	IAM=https://$IAMPREFIX.$DOMAIN:$IAMPORT
	IAMFQDN=$IAM
    fi
}


load_env() {
    for f in /etc/exaba/exaba-iam.env
    do
	source $f 
    done

    source /etc/exaba/exaba-maxio.env >/dev/null 2>&1

    exaba_seedhash

    if [ "$DOMAIN" == "" ]; then DOMAIN=example.com; fi
    if [ "$S3" == "" ]; then S3=s3; fi
    if [ "$UX" == "" ]; then UX=ux; fi
    if [ "$IAMPORT" == "" ]; then IAMPORT=443; fi
    if [ "$IAMPREFIX" == "" ]; then IAMPREFIX="iam"; fi

    if [ "$EXABA_MAXIO_S3_HOST" == "" ]; then EXABA_MAXIO_S3_HOST=0.0.0.0; fi
    if [ "$EXABA_MAXIO_S3_PORT" == "" ]; then PORT=$EXABA_MAXIO_S3_PORT; fi
    if [ "$EXABA_MAXIO_S3_PUBLICADDRESS" == "" ]; then EXABA_MAXIO_S3_PUBLICADDRESS=$S3URL; fi

    if [ "$PORT" == "" ]; then PORT=443;fi
    if [ "$PORTUX" == "" ]; then PORTUX=9000;fi
    if [ "$EXABA_MAXIO_S3_HOST" != "" ]; then ACCESS_NETWORK=$EXABA_MAXIO_S3_HOST; fi
    if [ "$EXABA_MAXIO_PROXY_SUBDOMAINMATCH" != "" ]; then  UX=$EXABA_MAXIO_PROXY_SUBDOMAINMATCH; EXABA_PATH_MODE="SNI"; else EXABA_PATH_MODE="$PORT/$PORTUX"; fi
    if [ "$EXABA_MAXIO_PROXY_SUBDOMAIN" != "" ]; then UX=$EXABA_MAXIO_PROXY_SUBDOMAIN; fi

    if [ "$EXABA_IAM_DEFAULTUSER_PASSWORD" != "" ]; then
	## IAM is on thi machine
	TOPOLOGY=Local
	DEFAULT_ITEM_AUTH=$TOPOLOGY
    fi

    if [ "$EXABA_MAXIO_IAM_URL" != "" ]; then
	TOPOLOGY=External
	DEFAULT_ITEM_AUTH=$TOPOLOGY
	IAMFQDN=$EXABA_MAXIO_IAM_URL
	IAM=$IAMFQDN
    fi
    
    
    if [ "$IAMFQDN" == "" ]; then
	# default
	IAMFQDN=https://127.0.0.1:9002
	IAM=$IAMFQDN
	DEFAULT_ITEM_AUTH=Local
    fi
	
    
    
    load_certmode

}

generate_ids_secrets() {
    EXABA_IAM_M2MUSERS_MAXIOID=$(/usr/bin/exaba-cli random generate -q -t base62 -l 30 --seed $EXABA_SEED --key EXABA_IAM_M2MUSERS_MAXIOID)
    EXABA_IAM_M2MUSERS_MAXIOSECRET=$(/usr/bin/exaba-cli random generate -q -t base62 -l 60 --seed $EXABA_SEED --key EXABA_IAM_M2MUSERS_MAXIOSECRET)

    EXABA_IAM_M2MUSERS_SYNCID=$(/usr/bin/exaba-cli random generate -q -t base62 -l 30 --seed $EXABA_SEED --key EXABA_IAM_M2MUSERS_SYNCID)
    EXABA_IAM_M2MUSERS_SYNCSECRET=$(/usr/bin/exaba-cli random generate -q -t base62 -l 60 --seed $EXABA_SEED --key EXABA_IAM_M2MUSERS_SYNCSECRET)

    EXABA_IAM_M2MUSERS_KMSID=$(/usr/bin/exaba-cli random generate -q -t base62 -l 30 --seed $EXABA_SEED --key EXABA_IAM_M2MUSERS_KMSID)
    EXABA_IAM_M2MUSERS_KMSSECRET=$(/usr/bin/exaba-cli random generate -q -t base62 -l 60 --seed $EXABA_SEED --key EXABA_IAM_M2MUSERS_KMSSECRET)
}




join_site() {
    if [ "$EXABA_SEED" != "" ]; then
	whiptail --yesno "Are you sure? This will invalidate prior M2M auth" --defaultno 10 70
	if [ $? -ne 0 ]; then
	    return;
	fi
    fi

    local ad
    ad=$(whiptail --inputbox "Exaba Setup Seed (e.g. u128 number):" 10 60 "" 3>&1 1>&2 2>&3) || return 1

    EXABA_SEED=$(echo $ad | tr -d '[A-z] ')
    exaba_seedhash
}


update_dns_values() {
    wait

    (echo $S3.$DOMAIN; /usr/bin/exaba-cli host $S3.$DOMAIN -d $DOMAIN 2>/dev/null) >/tmp/exaba-s3.dat &
    (echo $UX.$DOMAIN; /usr/bin/exaba-cli host $UX.$DOMAIN -d $DOMAIN 2>/dev/null) >/tmp/exaba-ux.dat &
    if [ "$IAMFQDN" != "" ]; then
	(echo $IAMFQDN; /usr/bin/exaba-cli host $IAMFQDN -d $DOMAIN 2>/dev/null) >/tmp/exaba-iam.dat &
    else
	(echo $IAMPREFIX.$DOMAIN; /usr/bin/exaba-cli host $IAMPREFIX.$DOMAIN -d $DOMAIN 2>/dev/null) >/tmp/exaba-iam.dat &
    fi
}



domain_menu() {
    # Example: ask for domain name and store it in a global var
    local dom
    dom=$(whiptail --inputbox "Enter the domain with a prefix (e.g. example.com, not s3.example.com):" 10 60 "$DOMAIN" 3>&1 1>&2 2>&3) || return 1
    DOMAIN="$dom"
}

prefix_s3_menu() {
    local dom
    dom=$(whiptail --inputbox "S3 prefix: currently '$S3' ($S3.$DOMAIN)" 10 60 "$S3" 3>&1 1>&2 2>&3) || return 1
    S3="$dom"
}

prefix_ux_menu() {
    local dom
    dom=$(whiptail --inputbox "UX/login prefix: currently '$UX' ($UX.$DOMAIN)" 10 60 "$UX" 3>&1 1>&2 2>&3) || return 1
    UX="$dom"
}


validate() {
    wait

    local domain

    MSG1=$(cat /tmp/exaba-s3.dat)

    MSG2=$(cat /tmp/exaba-ux.dat)

    MSG3=$(cat /tmp/exaba-iam.dat)

    MSG=$MSG1"\n\n"$MSG2"\n\n"$MSG3"\n\n"

    whiptail --title "DNS Validation" --msgbox "$MSG" 20 75
}

ports3_menu() {
    local port
    port=$(whiptail --inputbox "Enter listening port for S3 (e.g. 443 or 9000):" 10 60 "$PORT" 3>&1 1>&2 2>&3) || return 1
    if [ $? -eq 0 ]; then PORT="$port"; fi
}


portux_menu() {
    local port
    port=$(whiptail --inputbox "Enter listening port for UX (e.g. 443 or 9000):" 10 60 "$PORTUX" 3>&1 1>&2 2>&3) || return 1
    if [ $? -eq 0 ]; then  PORTUX="$port"; fi
}


load_certmode() {
    if [ "$EXABA_MAXIO_CERTMODE" == "Exaba" ]; then
	a=1
    elif [ "$EXABA_MAXIO_CERTMODE" == "LE" ]; then
	a=2
    elif [ "$EXABA_MAXIO_CERTMODE" == "None" ]; then
	EXABA_MAXIO_CERTMODE=None
	EXABA_MAXIO_TLS_ENABLED=false
	unset EXABA_MAXIO_TLS_CERTPATH
	unset EXABA_MAXIO_TLS_KEYPATH
    else
	# no variable is set, figure it out
	if [ -f /etc/exaba/certs/certificate-chain.pem ]; then
	    EXABA_MAXIO_CERTMODE=Exaba
	    EXABA_MAXIO_TLS_ENABLED=true
	    EXABA_MAXIO_TLS_CERTPATH=/etc/exaba/certs/certificate-chain.pem
	    EXABA_MAXIO_TLS_KEYPATH=/etc/exaba/certs/private-key.pem
	fi
	    
    fi
}

menu_certs() {
    local menu

    OPTIONS=(
        "None"  "  No certificates"
    )
    # Add Exaba option if pem exists
    if [ -f /etc/exaba/certs/certificate-chain.pem ]; then
        OPTIONS+=(
            "Exaba" "  Self-signed Certs  (/etc/exaba/certs/)"
        )
    fi
    # Add LE option if pem exists
    if [ -f /etc/letsencrypt/live/*."$DOMAIN"/fullchain.pem ]; then
        OPTIONS+=(
            "LE"    "  Let's Encrypt      (/etc/letsencrypt/live/*.$DOMAIN)"
        )
    fi

    ret=$(whiptail --title "" \
               --default-item "$EXABA_MAXIO_CERTMODE" \
               --menu "Choose an option:" 17 70 0 \
               "${OPTIONS[@]}" \
               3>&1 1>&2 2>&3)

    exit_status=$?
    if [ $exit_status -ne 0 ]; then return; fi

    EXABA_MAXIO_CERTMODE=$ret
}


menu_path_split_or_sni() {
    local choice
    OPTIONS=(
        "Split"  "  Split S3/UX paths"
        "SNI"    "  Use prefix/SNI to split path   ($UX)"
    )
    ret=$(whiptail --title ""  --default-item "$EXABA_PATH_MODE" \
               --menu "Choose an option:" 17 70 0 \
               "${OPTIONS[@]}" \
               3>&1 1>&2 2>&3)

    exit_status=$?
    if [ $exit_status -ne 0 ]; then return; fi

    EXABA_PATH_MODE=$ret
}




menu_paths() {
    local paths


    while true
    do

	OPTIONS=(
            "Path"  "  Configure Path    ($EXABA_PATH_MODE)"
	)
	OPTIONS+=(
            "S3Port" "  S3 Port    ($PORT)"
	)

	if [ "$EXABA_PATH_MODE" != "SNI" ]; then
            OPTIONS+=(
		"UXPort" "  UX Port    ($PORTUX)"
            )
	fi

	ret=$(whiptail --title "" \
		       --default-item "$DEFAULT_ITEM_PATHS" --cancel-button "Back" \
		       --menu "Choose an option:" 17 70 0 \
		       "${OPTIONS[@]}" \
		       3>&1 1>&2 2>&3)

	exit_status=$?
	if [ $exit_status -ne 0 ]; then return; fi


	DEFAULT_ITEM_PATHS=$ret

	case "$ret" in
	    S3Port)
		ports3_menu
		;;
	    UXPort)
		portux_menu
		;;
	    Path)
		menu_path_split_or_sni
		;;
	esac

    done
}




interfaces_menu() {
    res=$(ip addr | grep UP)
    whiptail --msgbox "$res" 15 60
}




show_menu() {
    local s3
    local ux
    s3=$(cat /tmp/exaba-s3.dat | awk '{print $NF}' | sort | uniq)
    ux=$(cat /tmp/exaba-ux.dat | awk '{print $NF}' | sort | uniq)
    WARN=""
    if [ "$PORT" == "$PORTUX" ]
    then
	if [ "$s3" == "$ux" ]; then export WARN="IP/PORT OVERLAP";  fi
    fi

    create_iam_url

    whiptail --msgbox "Domain: $DOMAIN\n\nTLS: $EXABA_MAXIO_CERTMODE\n$WARN\nS3: $HTTP://$S3.$DOMAIN:$PORT    ->($s3)\nUX: $HTTP://$UX.$DOMAIN:$PORTUX    ->($ux)\nIAM: $IAM\n\nACCESS_NETWORK: $ACCESS_NETWORK\nDATA_NETWORK: $DATA_NETWORK\nDATA2_NETWORK: $DATA2_NETWORK" 20 60
}

menu_topology() {

    while true
    do

	ret=$(whiptail --title "Exaba Node Configuration"  --default-item "$DEFAULT_ITEM_TOPOLOGY" --menu "Choose an option:" --cancel-button "Back"  20 73 0  \
		       "Local" "Private/Solo. Internal IAM" \
		       "LAN" "Enterprise fortress. Separate IAM" \
		       "WAN" "Metro. Behind LB or Direct. Public IAM" \
		       "Federation" "Multiple clusters. Public IAM" \
		       "Multi" "Multiple domains. Multiple IAMs" \
		       3>&1 1>&2 2>&3)

	exit_status=$?

	DEFAULT_ITEM_TOPOLOGY="$ret"

	if [[ $exit_status -eq 0 ]]; then
	    TOPOLOGY="$ret"
	fi
	break

    done
}

menu_domains() {

    while true
    do

	ret=$(whiptail --title "Exaba Configuration"  --default-item "$DEFAULT_ITEM_DOMAINS" --menu "Choose an option:" --cancel-button "Back"  20 70 0  \
		       "Domain" "Setup domain names and prefixes ($DOMAIN)" \
		       "S3"     "Domain prefix for S3 service    ($S3)" \
		       "GUI"    "Domain prefix for Web GUI       ($UX)" \
		       3>&1 1>&2 2>&3)

	exit_status=$?

	DEFAULT_ITEM_DOMAINS="$ret"


	if [[ $exit_status -ne 0 ]]; then
	    break
	fi


	case "$ret" in
	    Domain)
		domain_menu
		;;
	    S3)
		prefix_s3_menu
		;;
	    GUI)
		prefix_ux_menu
		;;
	    *)
	esac

    done

    update_dns_values
}


find_networks() {
#!/usr/bin/env bash

# --- Default gateways per interface (IPv4 only) ---
declare -A GW

while IFS=$'\t' read -r dev gw; do
  [[ -n "$dev" ]] || continue
  GW["$dev"]="$gw"
done < <(
  ip -j route show default \
    | jq -r '.[] | "\(.dev)\t\(.gateway // "")"'
)

# --- Build OPTIONS array sorted by speed then IP ---
OPTIONS=()

while IFS=$'\t' read -r speed_key ip_key iface mtu ips speed; do
  # MODE: RDMA if this iface is an mlx5 device, else TCP
  if compgen -G "/sys/class/net/$iface/device/mlx5*" >/dev/null 2>&1; then
    mode="RDMA"
  else
    mode="TCP"
  fi

  gw="${GW[$iface]}"

  desc="$iface, $speed, $mode, MTU $mtu"
  [[ -n "$gw" ]] && desc="$desc GW=$gw"

  OPTIONS+=("$ips" "$desc")
done < <(
  ip -j addr \
    | jq -r '
        # Skip lo, only ifaces with at least one IPv4 address
        map(
          select(
            .ifname != "lo"
            and ( .addr_info
                  | map(select(.family == "inet"))
                  | length > 0
                )
          )
        )[] |
        .ifname as $iface |
        .mtu as $mtu |
        # IP/CIDR list for display
        (
          .addr_info
          | map(
              select(.family == "inet" and .local != null)
              | "\(.local)/\(.prefixlen)"
            )
          | join(", ")
        ) as $ips |
        # First IPv4 for sort key
        (
          .addr_info
          | map(select(.family == "inet" and .local != null) | .local)
          | sort
          | .[0]
        ) as $first_ip |
        "\($iface)\t\($mtu)\t\($ips)\t\($first_ip)"
      ' \
    | while IFS=$'\t' read -r iface mtu ips first_ip; do
        # --- Speed: numeric key in Mb/s; unknown = 999999 (sorts last) ---
        raw_speed=$(ethtool "$iface" 2>/dev/null \
                      | awk -F'[: ]+' '/Speed:/ {print $2; exit}')
        if [[ $raw_speed =~ ^([0-9]+)Mb/s$ ]]; then
          speed_mbps="${BASH_REMATCH[1]}"
          speed="$raw_speed"
        else
          speed_mbps=999999
          speed="unknown"
        fi

        # --- IP sort key: zero-padded dotted quad; unknown last ---
        if [[ $first_ip =~ ^([0-9]+)\.([0-9]+)\.([0-9]+)\.([0-9]+)$ ]]; then
          printf -v ip_key "%03d%03d%03d%03d" \
            "${BASH_REMATCH[1]}" "${BASH_REMATCH[2]}" \
            "${BASH_REMATCH[3]}" "${BASH_REMATCH[4]}"
        else
          ip_key="999999999999"
        fi

        printf '%s\t%s\t%s\t%s\t%s\t%s\n' \
          "$speed_mbps" "$ip_key" "$iface" "$mtu" "$ips" "$speed"
      done \
    | sort -t $'\t' -k1,1n -k2,2
)

    export DEFAULT_ROUTE=$(ip -j route show default | jq -r '.[] | "gw=\(.gateway) dev=\(.dev) metric=\(.metric)"')

}




menu_access_network() {

    find_networks

    while true
    do

	ret=$(whiptail --title "Exaba Configuration" --default-item "$ACCESS_NETWORK"  --menu "Choose the access/upstream network:"  20 75 10 "${OPTIONS[@]}" 3>&1 1>&2 2>&3)
	exit_status=$?
	DEFAULT_ITEM_CERTS="$ret"

	if [[ $exit_status -eq 0 ]]; then
	    export ACCESS_NETWORK="$ret"
	fi
	break

    done
}


menu_data_networks() {
    find_networks

    while true
    do

	ret=$(whiptail --title "Exaba Configuration" --default-item "$DATA_NETWORK"  --menu "Choose the data network:"  20 75 10 "${OPTIONS[@]}" 3>&1 1>&2 2>&3)
	exit_status=$?
	DEFAULT_ITEM_CERTS="$ret"

	if [[ $exit_status -eq 0 ]]; then
	    export DATA_NETWORK="$ret"
	fi
	break

    done
}

menu_data2_networks() {
    find_networks

    while true
    do

	ret=$(whiptail --title "Exaba Configuration" --default-item "$DATA2_NETWORK"  --menu "Choose the data network:"  20 75 10 "${OPTIONS[@]}" 3>&1 1>&2 2>&3)
	exit_status=$?
	DEFAULT_ITEM_CERTS="$ret"

	if [[ $exit_status -eq 0 ]]; then
	    export DATA2_NETWORK="$ret"
	fi
	break

    done
}


menu_iam_prefix() {
    local iamprefix
    iamprefix=$(whiptail --inputbox "Enter IAM prefix (e.g. iam):" 10 60 "$IAMPREFIX" 3>&1 1>&2 2>&3) || return 1
    export IAMPREFIX="$iamprefix"
    unset IAMFQDN

    update_dns_values
}

menu_iam() {
    local iam
    iamfqdn=$(whiptail --inputbox "Enter FQDN IAM (e.g. iam.example.com):" 10 60 "$IAMFQDN" 3>&1 1>&2 2>&3) || return 1
    export IAMFQDN="$iamfqdn"

    update_dns_values
}


menu_iam_port() {
    local port
    port=$(whiptail --inputbox "Enter IAM port (e.g. 443):" 10 60 "$IAMPORT" 3>&1 1>&2 2>&3) || return 1
    if [ $? -eq 0 ]; then  export IAMPORT="$port"; fi
}


menu_auth() {
    while true
    do
	ret=$(whiptail --title "Exaba IAM ($IAM)"  --default-item "$DEFAULT_ITEM_AUTH" --menu "Choose an option:" --cancel-button "Back" 20 70 0  \
		       "Local"    "Local defaults   https://127.0.0.1:9002" \
		       "Prefix"   "Domain prefix    ($IAMPREFIX.$DOMAIN)" \
		       "Port"     "Set IAM port     ($IAMPORT)" \
		       "External" "External IAM     ($IAM)" \
		       3>&1 1>&2 2>&3)
	exit_status=$?
	DEFAULT_ITEM_AUTH="$ret"

	if [[ $exit_status -eq 1 ]]; then
	    break
	fi

	if [ "$ret" == "Local" ]; then
	    IAMFQDN="https://127.0.0.1:9002";
	    IAM=$IAMFQDN
	fi

	if [ "$ret" == "Prefix" ]; then
	    IAMFQDN=https://$IAMPREFIX.$DOMAIN:$IAMPORT
	    IAM=$IAMFQDN
	fi

	if [ "$ret" == "External" ]; then
	    menu_iam
	    IAM=$IAMFQDN
	fi

	if [ "$ret" == "Port" ]; then menu_iam_port; fi

	break
    done
}


load_env

if [ "$DOMAIN" != "example.com" ]
then
    update_dns_values
fi


#		   "Entropy"  "  Configure Entropy          (Quantum Hydration)" \


while true
do
    ret=$(whiptail --title "Exaba Node Configuration"  --default-item "$DEFAULT_ITEM" --menu "Choose an option:"   20 72 0  \
		   "Join"     " Join site / seed        (seed hash: $EXABA_SEEDHASH)" \
		   "Topology" " Installation            ($TOPOLOGY)" \
		   "Domains"  " Domain Menu             ($DOMAIN)" \
		   "Paths"    " Configure Paths         ($EXABA_PATH_MODE)" \
		   "KEM"      " Key exchange            (Post-quantum/KEM768)" \
		   "Certs"    " Configure Certificates  ($EXABA_MAXIO_CERTMODE)" \
		   "Upstream" " Configure Upstream Net  ($ACCESS_NETWORK)" \
		   "Data"     " Configure Data Network  ($DATA_NETWORK)" \
		   "Auth"     " Configure IAM / Auth    ($IAM)" \
		   "Validate" " Perform DNS lookups" \
		   "Show"     " Show the current configuration" \
		   "Save"     " Save/Update the .env files and Exit" \
		   3>&1 1>&2 2>&3)

    exit_status=$?

    DEFAULT_ITEM="$ret"


    if [[ $exit_status -ne 0 ]]; then
	echo "Cancelling"
	exit 1
    fi

    if [ "$ret" == "Save" ]; then
	break
    fi


    case $ret in
	Join)
	    join_site
	    ;;
	Topology)
	    menu_topology
	    ;;
	Domains)
	    menu_domains
	    ;;
	Paths)
	    menu_paths
	    ;;
	Certs)
	    menu_certs
	    ;;
	Upstream)
	    menu_access_network
	    ;;
	Data)
	    menu_data_networks
	    ;;
	Data2)
	    menu_data2_networks
	    ;;
	Auth)
	    menu_auth
	    ;;
	Validate)
	    validate
	    ;;
	Admin)
	    admin_menu
	    ;;
	Show)
	    show_menu
	    ;;
	*)
    esac

done

mkdir -p /etc/exaba

if [ "$EXABA_MAXIO_CERTMODE" == "Exaba" ]; then

    EXABA_MAXIO_TLS_CERTPATH=/etc/exaba/certs/certificate-chain.pem
    EXABA_MAXIO_TLS_KEYPATH=/etc/exaba/certs/private-key.pem
    HTTP=https
    EXABA_MAXIO_TLS_ENABLED=true
elif [ "$EXABA_MAXIO_CERTMODE" == "LE" ]; then
     EXABA_MAXIO_TLS_CERTPATH=$(ls "/etc/letsencrypt/live/"*.$DOMAIN"/fullchain.pem")
     EXABA_MAXIO_TLS_KEYPATH=$(ls "/etc/letsencrypt/live/"*.$DOMAIN"/privkey.pem")
     HTTP=https
     EXABA_MAXIO_TLS_ENABLED=true
else
    unset EXABA_MAXIO_TLS_CERTPATH
    unset EXABA_MAXIO_TLS_KEYPATH
    HTTP=http
    EXABA_MAXIO_TLS_ENABLED=false
fi

generate_ids_secrets

echo EXABA_MAXIO_IAM_URL=${IAM} > /etc/exaba/exaba-maxio.env
echo EXABA_MAXIO_IAM_CLIENTID=$EXABA_IAM_M2MUSERS_MAXIOID >> /etc/exaba/exaba-maxio.env
echo EXABA_MAXIO_IAM_CLIENTSECRET=$EXABA_IAM_M2MUSERS_MAXIOSECRET >> /etc/exaba/exaba-maxio.env
echo EXABA_MAXIO_S3_HOST=0.0.0.0 >> /etc/exaba/exaba-maxio.env
echo EXABA_MAXIO_S3_PORT=$PORT >> /etc/exaba/exaba-maxio.env
echo EXABA_MAXIO_S3_PUBLICADDRESS=$HTTP://$S3.$DOMAIN:$PORT >> /etc/exaba/exaba-maxio.env
echo TOPOLOGY=$TOPOLOGY >> /etc/exaba/exaba-maxio.env

echo IAMPORT=$IAMPORT >> /etc/exaba/exaba-maxio.env
echo IAMPREFIX=$IAMPREFIX >> /etc/exaba/exaba-maxio.env
echo IAMPORT=$IAMPORT >> /etc/exaba/exaba-maxio.env
if [ "$IAMFQDN" != "" ]; then
    echo IAMFQDN=$IAMFQDN >> /etc/exaba/exaba-maxio.env
fi
echo EXABA_SEED=$EXABA_SEED >> /etc/exaba/exaba-maxio.env
echo DOMAIN=$DOMAIN >> /etc/exaba/exaba-maxio.env
echo S3=$S3 >> /etc/exaba/exaba-maxio.env
echo UX=$UX >> /etc/exaba/exaba-maxio.env

#[Proxy]
#Enabled=%EXABA_MAXIO_PROXY_ENABLED%
#SubdomainMatch=%EXABA_MAXIO_PROXY_SUBDOMAIN_MATCH%
#Host=%EXABA_MAXIO_PROXY_HOST%
#Port=%EXABA_MAXIO_PROXY_PORT%
#ManagementAddress=%EXABA_MAXIO_PROXY_MGMT_ADDRESS%
#IamAddress=%EXABA_MAXIO_PROXY_IAM_ADDRESS%



if [ "$EXABA_PATH_MODE" == "SNI" ]; then
    echo EXABA_MAXIO_PROXY_ENABLED=true        >> /etc/exaba/exaba-maxio.env
    echo EXABA_MAXIO_PROXY_SUBDOMAINMATCH=$UX  >> /etc/exaba/exaba-maxio.env
fi

echo EXABA_MAXIO_PROXY_HOST=0.0.0.0  >> /etc/exaba/exaba-maxio.env
echo EXABA_MAXIO_PROXY_PORT=9006      >> /etc/exaba/exaba-maxio.env
echo EXABA_MAXIO_PROXY_MANAGEMENTADDRESS=https://127.0.0.1:9001  >> /etc/exaba/exaba-maxio.env
echo EXABA_MAXIO_PROXY_IAMADDRESS=$IAM                     >> /etc/exaba/exaba-maxio.env
echo EXABA_MAXIO_PROXY_CONSOLEADDRESS=https://127.0.0.1:9003       >> /etc/exaba/exaba-maxio.env
echo EXABA_MAXIO_PROXY_KMSADDRESS=https://127.0.0.1:9005       >> /etc/exaba/exaba-maxio.env
echo EXABA_MAXIO_PROXY_SYNCADDRESS=https://127.0.0.1:9010       >> /etc/exaba/exaba-maxio.env
echo S3=$S3 >> /etc/exaba/exaba-maxio.env
echo UX=$UX >> /etc/exaba/exaba-maxio.env



echo EXABA_MAXIO_MANAGEMENT_HOST=0.0.0.0                       >> /etc/exaba/exaba-maxio.env
echo EXABA_MAXIO_MANAGEMENT_PORT=9001                        >> /etc/exaba/exaba-maxio.env

if [ "$EXABA_MAXIO_CERTMODE" != "None" ]; then
echo EXABA_MAXIO_TLS_CERTPATH=$EXABA_MAXIO_TLS_CERTPATH >> /etc/exaba/exaba-maxio.env
echo EXABA_MAXIO_TLS_KEYPATH=$EXABA_MAXIO_TLS_KEYPATH >> /etc/exaba/exaba-maxio.env
echo EXABA_MAXIO_TLS_ENABLED=$EXABA_MAXIO_TLS_ENABLED >> /etc/exaba/exaba-maxio.env
fi



### kms

cat <<EOF >/etc/exaba/exaba-kms.env
EXABA_KMS_KEY_LISTENADDRESS=0.0.0.0
EXABA_KMS_KEY_LISTENPORT=9004
EXABA_KMS_MANAGEMENT_LISTENADDRESS=0.0.0.0
EXABA_KMS_MANAGEMENT_LISTENPORT=9005
EXABA_KMS_IAM_URL=$IAM
EXABA_KMS_TLS_ENABLED=$EXABA_MAXIO_TLS_ENABLED
EXABA_KMS_TLS_CERTPATH=$EXABA_MAXIO_TLS_CERTPATH
EXABA_KMS_TLS_KEYPATH=$EXABA_MAXIO_TLS_KEYPATH
EXABA_KMS_IAM_CLIENTID=$EXABA_IAM_M2MUSERS_KMSID
EXABA_KMS_IAM_CLIENTSECRET=$EXABA_IAM_M2MUSERS_KMSSECRET
EOF


### pty
cat <<EOF >/etc/exaba/exaba-pty.env
EXABA_PTY_PTY_HOST=0.0.0.0
EXABA_PTY_PTY_PORT=9003
EXABA_PTY_TLS_ENABLED=$EXABA_MAXIO_TLS_ENABLED
EXABA_PTY_TLS_CERTPATH=$EXABA_MAXIO_TLS_CERTPATH
EXABA_PTY_TLS_KEYPATH=$EXABA_MAXIO_TLS_KEYPATH
EXABA_PTY_IAM_URL=$IAM
EOF

### pty
cat <<EOF >/etc/exaba/exaba-sync.env
EXABA_SYNC_SERVER_HOST=0.0.0.0
EXABA_SYNC_SERVER_PORT=9010
EXABA_SYNC_TLS_ENABLED=$EXABA_MAXIO_TLS_ENABLED
EXABA_SYNC_TLS_CERTPATH=$EXABA_MAXIO_TLS_CERTPATH
EXABA_SYNC_TLS_KEYPATH=$EXABA_MAXIO_TLS_KEYPATH
EXABA_SYNC_IAM_URL=$IAM
EXABA_SYNC_IAM_CLIENTID=$EXABA_IAM_M2MUSERS_SYNCID
EXABA_SYNC_IAM_CLIENTSECRET=$EXABA_IAM_M2MUSERS_SYNCSECRET
EOF


### console
cat <<EOF >/etc/exaba/exaba-console.env
EXABA_IAM=$IAM
EOF


