#!/bin/bash
set -Eeuo pipefail
umask 077

fatal() { echo "FATAL: $*" >&2; exit 1; }

usage() {
cat<<EOF
Syntax: $0 client-name
Create an obfuscated URL for downloading the client profile via HTTPS.

EOF
exit 1
}

if [[ "$#" != "1" ]]; then
    usage
fi

client_name=$1
[[ ${#client_name} -le 64 && $client_name =~ ^[A-Za-z0-9][A-Za-z0-9_.-]*$ ]] ||
    fatal "client-name may contain only letters, numbers, dot, underscore and dash"

export EASYRSA='/etc/openvpn/easy-rsa'
export EASYRSA_PKI='/etc/openvpn/easy-rsa/keys'

TEMPLATE='/var/www/openvpn/template.html'
PROFILES='/var/www/openvpn/htdocs/profiles'

OVPN_PATH="$EASYRSA_PKI/$client_name.ovpn"
[ -e "$OVPN_PATH" ] || fatal "$OVPN_PATH does not exist"

SERVER_ADDR="$(grep remote "$OVPN_PATH" | awk '{print $2;exit}')"
[[ ${#SERVER_ADDR} -le 253 && $SERVER_ADDR =~ ^[[:alnum:]][[:alnum:].:-]*$ ]] ||
    fatal "invalid remote address in $OVPN_PATH"
PROFILE_TOKEN="$(openssl rand -hex 24)"
PROFILE_PATH="$PROFILES/$PROFILE_TOKEN"

install -d -o www-data -g www-data -m 750 "$PROFILE_PATH"
install -o www-data -g www-data -m 440 \
    "$OVPN_PATH" "$PROFILE_PATH/$client_name.ovpn"
sed "s|CLIENT_NAME|$client_name|" "$TEMPLATE" >"$PROFILE_PATH/index.html"
chown www-data:www-data "$PROFILE_PATH/index.html"
chmod 440 "$PROFILE_PATH/index.html"

echo "https://$SERVER_ADDR/profiles/$PROFILE_TOKEN/"
