resource_name :create_certs

property :ssl_filename, String, required: true
property :ssl_fqdn, String, default: 'localhost'
property :ssl_folder, String, required: true
property :ssl_databag, String, default: ''
property :ssl_databag_item, String, default: ''
property :skip_certificate_creation, kind_of: [TrueClass, FalseClass], default: true

default_action :nothing

action :run do
  directory ssl_folder do
    action :create
    recursive true
  end

  begin
    ssl = data_bag_item(ssl_databag, ssl_databag_item)
    ssl.each do |ssl_item_name, ssl_item_value|
      next if ssl_item_name == 'id'
      ssl_file = "#{ssl_folder}/#{ssl_filename}.#{ssl_item_name}"
      file ssl_file do
        action :create
        content ssl_item_value
        not_if { File.exist?(ssl_file) }
      end
    end
  rescue
    ssl_key_file = "#{ssl_folder}/#{ssl_filename}.key"
    ssl_crt_file = "#{ssl_folder}/#{ssl_filename}.crt"
    ssl_chain_file = "#{ssl_folder}/#{ssl_filename}.chain"
    ssl_nginxcrt_file = "#{ssl_folder}/#{ssl_filename}.nginxcrt"
    ssl_dhparam_file = "#{ssl_folder}/#{ssl_filename}.dhparam"
    unless skip_certificate_creation
      execute 'create-fake-ssl-keypair' do
        command "openssl req -subj '/C=UK/ST=Berkshire/L=Maidenhead/O=Alfresco/CN=#{ssl_fqdn}' -x509 -days 3650 -batch -nodes -newkey rsa:4096 -keyout #{ssl_key_file} -out #{ssl_crt_file}"
        not_if "test -f #{ssl_key_file}"
      end

      # TODO: .chain and .nginx are the same; use only .chain
      # TODO: ssh_trust_file should be created and concatenated to .chain file
      execute 'create-chain-file' do
        command "echo '\n' >> #{ssl_crt_file}; cat #{ssl_crt_file} #{ssl_key_file} > #{ssl_chain_file}"
        not_if "test -f #{ssl_chain_file}"
      end
      execute 'create-nginxcrt-file' do
        command "cat #{ssl_crt_file} #{ssl_key_file} > #{ssl_nginxcrt_file}"
        not_if "test -f #{ssl_nginxcrt_file}"
      end
      execute 'create-dhparam-file' do
        command "openssl dhparam -out #{ssl_dhparam_file} 4096"
        not_if "test -f #{ssl_dhparam_file}"
      end
    end
  end
end
