
include_recipe 'build-essential::default'
include_recipe 'selinux::default'

timezone = node['image']['timezone']
disable_anacron = node['basic']['disable_anacron']

# http://bencane.com/2012/07/08/sar-sysstat-linux-performance-statistics-with-ease/
replace_or_add 'Limit sysstat log size' do
  path '/etc/systemd/journald.conf'
  pattern 'SystemMaxUse=*'
  line 'SystemMaxUse=16M'
  only_if 'test -f /etc/systemd/journald.conf'
  notifies :restart, 'service[systemd-journald]', :delayed
end

service 'systemd-journald' do
  action :nothing
end

# TODO: Not needed? And it takes a lot of time!
# ...
ohai 'reload' do
  action :nothing
end

# Remove postfix banner
delete_lines 'remove postfix banner' do
  path '/etc/postfix/main.cf'
  pattern 'smtpd_banner =*'
end

# Fix issue, issue.net and motd contents
file '/etc/issue' do
  content node['basic']['issue']
end
file '/etc/issue.net' do
  content node['basic']['issue']
end
file '/etc/motd' do
  content node['basic']['motd']
end

execute 'remove nullok from system-auth' do
  command "sed -i 's/\<nullok\>//g' /etc/pam.d/system-auth"
  not_if 'cat /etc/pam.d/system-auth | grep nullok'
end
append_if_no_line 'Set last logon/access notification' do
  path '/etc/pam.d/system-auth'
  line 'session required pam_lastlog.so showfailed'
end

# Fix grub.cfg permissions
file '/boot/grub2/grub.cfg' do
  mode 0600
end

# Fix max log size
replace_or_add 'Fix max log size' do
  path '/etc/audit/auditd.conf'
  pattern 'max_log_file =*'
  line "max_log_file = #{node['basic']['max_log_size']}"
end

# Fix max log size
append_if_no_line 'Disable core dumps for all users' do
  path '/etc/security/limits.conf'
  line '* hard core 0'
end

# Define Audit rules
template '/etc/audit/rules.d/audit.rules' do
  source 'audit.rules.erb'
  notifies :restart, 'service[auditd]', :delayed
end

service 'auditd' do
  action :nothing
  restart_command 'service auditd restart'
end

# Adding cloud Ohai hint
# TODO: find out which folder must be created (assuming it's only 1)
%w( /etc/chef/ohai/hints /opt/chef/embedded/apps/ohai/hints ).each do |ec2_hint_folder|
  directory ec2_hint_folder do
    owner 'root'
    group 'root'
    mode '0755'
    recursive true
    action :create
  end

  file "#{ec2_hint_folder}/ec2.json" do
    owner 'root'
    group 'root'
    mode '0755'
    action :create
    notifies :reload, 'ohai[reload]', :immediately
  end
end

execute 'enhance-history-with-timestamp' do
  command "echo 'export HISTTIMEFORMAT=\"%d/%m/%y %T \"' >> /etc/bashrc"
  not_if 'cat /etc/bashrc | grep HISTTIMEFORMAT'
end

execute 'enhance-prompt-with-date-and-color' do
  command "echo 'declare -x PS1=\"\\[\\033[36m\\][\\A]\\[\\033[33m\\]\\u\\[\\033[32m\\]@\\h:\\[\\033[35m\\]\\w\\\$\\[\\033[39m\\] \"' >> /etc/bashrc"
  not_if "cat /etc/bashrc | grep 'declare -x PS1'"
end

execute 'enhance-root-prompt-with-date-colours-prompt' do
  command "echo 'PS1=\"\\[\\033[36m\\][\\A]\\[\\033[33m\\]\\u\\[\\033[32m\\]@\\h:\\[\\033[35m\\]\\w#\\[\\033[39m\\] \"' >> /root/.bashrc"
  not_if "grep -q 'PS1' /root/.bashrc"
end

remote_directory '/usr/local/bin' do
  source 'usr_local_bin'
  purge false
  files_owner 'root'
  files_group 'root'
  files_mode 00755
end

user 'root' do
  action :lock
end

cookbook_file '/etc/sysconfig/clock' do
  source 'essentials/clock_sysconfig'
  owner 'root'
  group 'root'
  mode 00664
end

cookbook_file '/etc/modprobe.d/ECS.conf' do
  source 'essentials/modprobed.ECS.conf'
  owner 'root'
  group 'root'
  mode 00664
end

execute 'setup-localtime' do
  command "timedatectl set-timezone #{timezone}"
  not_if "timedatectl | grep 'Timezone: #{timezone}'"
end

# sticky bit +t
directory '/tmp' do
  owner 'root'
  group 'root'
  mode 01777
end

# alias files
cookbook_file '/root/.cshrc' do
  source 'essentials/cshrc'
  owner 'root'
  group 'root'
  mode 00644
end

file '/root/.tcshrc' do
  action :delete
end

if disable_anacron
  [
    '/etc/cron.hourly/0yum-hourly.cron',
    '/etc/cron.daily/0yum-daily.cron',
    '/etc/cron.hourly/0anacron',
    '/etc/anacrontab'
  ].each do |anacron_config_file|
    file anacron_config_file do
      action :delete
    end
  end
end
