#!/usr/bin/env bash
# Enroll-SguLinuxDomainClient.sh
#
# Idempotently joins a Debian/Ubuntu or RHEL-family Linux workstation to the
# SGU Active Directory laboratory. The join password is always requested by
# realmd; this script never accepts, logs, or stores it.

set -Eeuo pipefail
IFS=$'\n\t'

DOMAIN_NAME='lci.lasalle.mx'
DOMAIN_CONTROLLER=''
DOMAIN_DNS=''
COMPUTER_OU='OU=Laboratorio,DC=lci,DC=lasalle,DC=mx'
JOIN_USER='Administrator'
DOMAIN_INTERFACE=''
DOMAIN_ADDRESS=''
COMPUTER_NAME=''
ALLOW_GROUP=''
ENABLE_SSH=false

usage() {
    cat <<'EOF'
Usage:
  sudo ./Enroll-SguLinuxDomainClient.sh --domain-controller <IPv4-or-FQDN> [options]

Required:
  --domain-controller VALUE  Fixed IPv4 address or DNS name of the AD controller.

Options:
  --domain-name VALUE        AD DNS domain (default: lci.lasalle.mx).
  --domain-dns VALUE         DNS server for the AD network (default: domain controller).
  --computer-ou DN           Destination computer OU.
  --join-user USER           AD account permitted to join computers (default: Administrator).
  --computer-name NAME       NetBIOS host name; its FQDN becomes NAME.DOMAIN.
  --domain-interface IFACE   Private NIC connected to the AD network.
  --domain-address CIDR      Static IPv4 address for --domain-interface, e.g. 192.168.50.12/24.
  --allow-group GROUP        Restrict Linux sign-in to this AD group after joining.
  --enable-ssh               Install, enable, and (when active) permit OpenSSH in the local firewall.
  --help                     Show this help.

Network safety:
  --domain-interface and --domain-address must be supplied together. The selected
  interface must not own the default route, so the command cannot replace the
  Internet route while attaching a private AD NIC.

The AD password is requested interactively by realmd. It is never accepted as an
argument or written to a file, log, or command line.
EOF
}

fail() {
    printf 'ERROR: %s\n' "$*" >&2
    exit 1
}

need_command() {
    command -v "$1" >/dev/null 2>&1 || fail "Required command is unavailable: $1"
}

while (($#)); do
    case "$1" in
        --domain-controller) DOMAIN_CONTROLLER=${2:?Missing value for --domain-controller}; shift 2 ;;
        --domain-name) DOMAIN_NAME=${2:?Missing value for --domain-name}; shift 2 ;;
        --domain-dns) DOMAIN_DNS=${2:?Missing value for --domain-dns}; shift 2 ;;
        --computer-ou) COMPUTER_OU=${2:?Missing value for --computer-ou}; shift 2 ;;
        --join-user) JOIN_USER=${2:?Missing value for --join-user}; shift 2 ;;
        --computer-name) COMPUTER_NAME=${2:?Missing value for --computer-name}; shift 2 ;;
        --domain-interface) DOMAIN_INTERFACE=${2:?Missing value for --domain-interface}; shift 2 ;;
        --domain-address) DOMAIN_ADDRESS=${2:?Missing value for --domain-address}; shift 2 ;;
        --allow-group) ALLOW_GROUP=${2:?Missing value for --allow-group}; shift 2 ;;
        --enable-ssh) ENABLE_SSH=true; shift ;;
        --help|-h) usage; exit 0 ;;
        *) fail "Unknown argument: $1. Use --help for usage." ;;
    esac
done

[[ ${EUID} -eq 0 ]] || fail 'Run this command with sudo or as root.'
[[ -n $DOMAIN_CONTROLLER ]] || fail '--domain-controller is required.'

if [[ -z $DOMAIN_DNS ]]; then
    DOMAIN_DNS=$DOMAIN_CONTROLLER
fi

if [[ -n $DOMAIN_INTERFACE || -n $DOMAIN_ADDRESS ]]; then
    [[ -n $DOMAIN_INTERFACE && -n $DOMAIN_ADDRESS ]] || \
        fail '--domain-interface and --domain-address must be supplied together.'
fi

if [[ -z $COMPUTER_NAME ]]; then
    COMPUTER_NAME=$(hostname -s)
fi
COMPUTER_NAME=${COMPUTER_NAME^^}
HOST_FQDN="${COMPUTER_NAME,,}.${DOMAIN_NAME,,}"

install_prerequisites() {
    local -a packages=()
    if command -v apt-get >/dev/null 2>&1; then
        packages=(realmd sssd sssd-tools adcli libnss-sss libpam-sss krb5-user packagekit samba-common-bin)
        if [[ $ENABLE_SSH == true ]]; then
            packages+=(openssh-server)
        fi
        export DEBIAN_FRONTEND=noninteractive
        apt-get update
        apt-get install -y "${packages[@]}"
        pam-auth-update --enable mkhomedir --force
        return
    fi

    if command -v dnf >/dev/null 2>&1; then
        packages=(realmd sssd sssd-tools adcli oddjob oddjob-mkhomedir samba-common-tools krb5-workstation)
        if [[ $ENABLE_SSH == true ]]; then
            packages+=(openssh-server)
        fi
        dnf install -y "${packages[@]}"
        authselect select sssd with-mkhomedir --force
        return
    fi

    fail 'Supported package managers are apt-get (Debian/Ubuntu) and dnf (RHEL/Fedora/Rocky/AlmaLinux).'
}

configure_private_ad_interface() {
    [[ -n $DOMAIN_INTERFACE ]] || return
    need_command nmcli
    ip link show "$DOMAIN_INTERFACE" >/dev/null 2>&1 || \
        fail "Network interface does not exist: $DOMAIN_INTERFACE"

    local default_interface
    default_interface=$(ip route show default | awk 'NR == 1 { print $5 }')
    if [[ $default_interface == "$DOMAIN_INTERFACE" ]]; then
        fail "Refusing to reconfigure $DOMAIN_INTERFACE because it owns the default route. Use the private AD NIC."
    fi

    local connection_name="SGU-Lab-AD-${DOMAIN_INTERFACE}"
    if ! nmcli -t -f NAME connection show | grep -Fxq "$connection_name"; then
        nmcli connection add type ethernet ifname "$DOMAIN_INTERFACE" con-name "$connection_name"
    fi
    nmcli connection modify "$connection_name" \
        connection.autoconnect yes \
        ipv4.method manual \
        ipv4.addresses "$DOMAIN_ADDRESS" \
        ipv4.dns "$DOMAIN_DNS" \
        ipv4.dns-search "$DOMAIN_NAME" \
        ipv4.never-default yes \
        ipv6.method ignore
    nmcli connection up "$connection_name"
}

enable_sssd_dyndns() {
    [[ -n $DOMAIN_INTERFACE ]] || return
    local configuration_directory='/etc/sssd/conf.d'
    local configuration_path="${configuration_directory}/90-sgu-dyndns.conf"
    local temporary_path
    temporary_path=$(mktemp)
    printf '%s\n' \
        "[domain/${DOMAIN_NAME,,}]" \
        "ad_hostname = ${HOST_FQDN}" \
        'dyndns_update = True' \
        'dyndns_update_ptr = True' \
        "dyndns_iface = ${DOMAIN_INTERFACE}" \
        'dyndns_refresh_interval = 43200' >"$temporary_path"
    install -d -o root -g root -m 700 "$configuration_directory"
    install -o root -g root -m 600 "$temporary_path" "$configuration_path"
    rm -f "$temporary_path"
}

enable_ssh() {
    [[ $ENABLE_SSH == true ]] || return
    local service_name='sshd'
    if systemctl list-unit-files ssh.service >/dev/null 2>&1; then
        service_name='ssh'
    fi
    systemctl enable --now "$service_name"
    if command -v ufw >/dev/null 2>&1 && ufw status | grep -q '^Status: active'; then
        ufw allow OpenSSH
    elif command -v firewall-cmd >/dev/null 2>&1 && systemctl is-active --quiet firewalld; then
        firewall-cmd --permanent --add-service=ssh
        firewall-cmd --reload
    fi
}

verify_domain_connectivity() {
    need_command getent
    getent ahostsv4 "$DOMAIN_CONTROLLER" >/dev/null || \
        fail "Could not resolve the domain controller: $DOMAIN_CONTROLLER"
    if command -v resolvectl >/dev/null 2>&1; then
        resolvectl query --type=SRV "_ldap._tcp.dc._msdcs.${DOMAIN_NAME}" >/dev/null || \
            fail "AD DNS does not provide _ldap._tcp.dc._msdcs.${DOMAIN_NAME}."
    fi
}

configure_private_ad_interface
install_prerequisites
verify_domain_connectivity

# Establish a canonical host name before adcli creates or refreshes the
# computer object, SPNs, and keytab entries.
hostnamectl set-hostname "$HOST_FQDN"

if realm list --name-only 2>/dev/null | grep -Fxqi "$DOMAIN_NAME"; then
    printf 'Computer is already joined to %s; validating and refreshing configuration.\n' "$DOMAIN_NAME"
else
    realm discover "$DOMAIN_NAME" >/dev/null
    printf 'Joining %s. realmd will request the password for %s interactively.\n' "$DOMAIN_NAME" "$JOIN_USER"
    realm join \
        --membership-software=adcli \
        --client-software=sssd \
        --computer-ou="$COMPUTER_OU" \
        --user="$JOIN_USER" \
        "$DOMAIN_NAME"
fi

enable_sssd_dyndns
systemctl enable --now sssd
sssctl config-check
systemctl restart sssd
adcli update --domain="$DOMAIN_NAME" --host-fqdn="$HOST_FQDN" --computer-name="$COMPUTER_NAME"
adcli testjoin --domain="$DOMAIN_NAME"

if [[ -n $ALLOW_GROUP ]]; then
    realm deny --all
    realm permit --groups "$ALLOW_GROUP"
fi

enable_ssh

printf '\nLinux enrollment completed.\n'
printf '  Host: %s\n' "$HOST_FQDN"
printf '  Domain: %s\n' "$DOMAIN_NAME"
printf '  OU: %s\n' "$COMPUTER_OU"
printf '  Login format: %%U@%s\n' "$DOMAIN_NAME"
realm list