#!/bin/bash

sudo chown $(whoami):root /var/www/html
rm -fR /var/www/html/*

#Static cert for the labs, generated with:
# sudo openssl req -x509 -nodes -days 3650 \
#   -subj "/C=US/ST=OK/L=Durant/O=RCI/OU=Information Technology/CN=lablocal.lab.local" \
#   -newkey rsa:2048 -keyout /etc/ssl/private/nginx.self.key \
#   -out /etc/ssl/certs/nginx.self.crt

sudo bash -c 'cat << EOF > /etc/ssl/certs/nginx.self.crt
-----BEGIN CERTIFICATE-----
[payload removed: 1340 characters in 21 lines]
-----END CERTIFICATE-----
EOF'

sudo bash -c 'cat << EOF > /etc/ssl/private/nginx.self.key
-----BEGIN PRIVATE KEY-----
[payload removed: 1624 characters in 26 lines]
-----END PRIVATE KEY-----
EOF'

#nginx setup
sudo bash -c 'cat << EOF >/etc/nginx/sites-available/default
server {
        listen 10.50.7.50:80 default_server;
        listen 10.50.7.50:443 ssl;
        
        server_name         lablocal.lab.local;
        ssl_certificate     /etc/ssl/certs/nginx.self.crt;
        ssl_certificate_key /etc/ssl/private/nginx.self.key;

        root /var/www/html;
        index index.html;
        server_name _;
        expires -1;
}
EOF'

#made static for labs
# sudo openssl req -x509 -nodes -days 3650 \
#   -subj "/C=US/ST=OK/L=Durant/O=RCI/OU=Information Technology/CN=juiceshop.lab.local" \
#   -newkey rsa:2048 -keyout /etc/ssl/private/js.self.key \
#   -out /etc/ssl/certs/js.self.crt

sudo bash -c 'cat << EOF > /etc/ssl/private/js.self.key
-----BEGIN PRIVATE KEY-----
[payload removed: 1624 characters in 26 lines]
-----END PRIVATE KEY-----
EOF'

sudo bash -c 'cat << EOF > /etc/ssl/certs/js.self.crt
-----BEGIN CERTIFICATE-----
[payload removed: 1308 characters in 21 lines]
-----END CERTIFICATE-----
EOF'

#Proxy for juice shop kubernetes service, websockets should work
sudo bash -c 'cat << EOF >/etc/nginx/sites-available/juiceshop
server {
  listen 10.50.7.20:80;
  server_name _;
  listen 10.50.7.20:443 ssl;
  server_name         juiceshop.lab.local;
  ssl_certificate     /etc/ssl/certs/js.self.crt;
  ssl_certificate_key /etc/ssl/private/js.self.key;

  location / {
    proxy_pass http://127.0.0.1:30020;
    proxy_set_header Upgrade \$http_upgrade;
    proxy_set_header Connection "Upgrade";
    proxy_set_header Host \$host;
  }
}

EOF'

#Proxy for dvwa kubernetes service
sudo bash -c 'cat << EOF >/etc/nginx/sites-available/dvwa
server {
        listen 10.50.7.24:80;
        server_name _;

        location / {
          proxy_pass http://127.0.0.1:30024;
        }
}
EOF'

#Proxy for bwapp kubernetes service
sudo bash -c 'cat << EOF >/etc/nginx/sites-available/bwapp
server {
        listen 10.50.7.22:80;
        server_name _;

        location / {
          proxy_pass http://127.0.0.1:30022;
        }
}
EOF'

#Proxy for bwapp kubernetes service
sudo bash -c 'cat << EOF >/etc/nginx/sites-available/wackopicko
server {
        listen 10.50.7.23:80;
        server_name _;

        location / {
          proxy_pass http://127.0.0.1:30023;
        }
}
EOF'

#create symlinks to make these sites active
sudo ln -s /etc/nginx/sites-available/juiceshop /etc/nginx/sites-enabled/juiceshop
sudo ln -s /etc/nginx/sites-available/dvwa /etc/nginx/sites-enabled/dvwa
sudo ln -s /etc/nginx/sites-available/bwapp /etc/nginx/sites-enabled/bwapp
sudo ln -s /etc/nginx/sites-available/wackopicko /etc/nginx/sites-enabled/wackopicko

ls -l /etc/nginx/sites-enabled

sudo systemctl restart nginx.service
sudo systemctl --no-pager status nginx.service

echo "Restarting Nessus service after IP changes"
sudo systemctl restart nessusd.service
sudo systemctl --no-pager status nessusd.service
