#!/usr/local/cpanel/3rdparty/bin/perl

# cpanel - scripts/setupnameserver                 Copyright 2022 cPanel, L.L.C.
#                                                           All rights reserved.
# [email protected]                                         http://cpanel.net
# This code is subject to the cPanel license. Unauthorized copying is prohibited

use strict;
use warnings;

use Config::Tiny                       ();
use Cpanel::Config::LoadCpConf         ();
use Cpanel::Config::CpConfGuard        ();
use Cpanel::ServerTasks                ();
use Cpanel::Chkservd::Manage           ();
use Cpanel::Chkservd::Tiny             ();
use Cpanel::Pkgr                       ();
use Cpanel::RPM::Versions::File        ();
use Cpanel::RPM::Versions::Directory   ();
use Cpanel::Services::Enabled          ();
use Cpanel::Services::Restart          ();
use Cpanel::Init                       ();
use Cpanel::OS                         ();
use Cpanel::NameServer::Utils::Enabled ();
use Cpanel::Usage                      ();
use Cpanel::PID                        ();
use Cpanel::Encoder::Tiny              ();
use Cpanel::RestartSrv::Systemd        ();
use Cpanel::ServerTasks                ();

my $force   = 0;
my $current = 0;
my $html    = 0;

delete $ENV{'cp_security_token'};
delete $ENV{'HTTP_REFERER'};

# Argument processing
my %opts = (
    'force'   => \$force,
    'current' => \$current,
    'html'    => \$html,
);

Cpanel::Usage::wrap_options( \@ARGV, \&usage, \%opts );

local @ARGV = ( grep( !/^--/, @ARGV ) );

my $dnstype = shift;
usage() unless ( $dnstype || $current );

if ( $> != 0 ) {
    die "Conversion process must be performed as root";
}

my $cpconf_ref = Cpanel::Config::LoadCpConf::loadcpconf_not_copy();

$cpconf_ref->{'local_nameserver_type'} ||= 'powerdns';
my $current_nameserver = Cpanel::Services::Enabled::is_enabled('dns') ? $cpconf_ref->{'local_nameserver_type'} : 'disabled';

if ($current) {
    print "Current nameserver type: $current_nameserver\n";
    exit 0;
}

if ( !$force && $current_nameserver eq $dnstype ) {
    print "Already configured.\n";
    exit 0;
}

my $valid_dnstypes = { map { $_ => 1 } qw(bind powerdns disabled) };
unless ( $valid_dnstypes->{$dnstype} ) {
    print "Unknown nameserver type specified.\nTry $0 --help\n";
    exit 1;
}

my ( $valid, $reason ) = Cpanel::NameServer::Utils::Enabled::valid_nameserver_type($dnstype);
unless ($valid) {
    print "The specified nameserver type is not available for your system:\n";
    print $reason, "\n";
    exit 1;
}

if ( !$force && $current_nameserver eq 'powerdns' && $dnstype ne 'powerdns' && -t STDIN ) {
    print "WARNING: If you switch your nameserver away from PowerDNS, your DNS server will no longer serve DNSSEC records.\n";
    print "You must ensure that the following records are not configured on your domains to avoid DNS resolution issues:\n";
    print "- An ALIAS record.\n";
    print "- A DS record at the domain's registrar.\n\n";
    my $msg = qq{Are you sure you want to switch to "$dnstype" [y/n]? };
    print $msg;
    my $count = 0;
    while ( my $read = <STDIN> ) {
        $count++;
        exit if ( $count >= 5 );
        exit if ( $read =~ m/^n/i );
        last if ( $read =~ m/^y/i );
        print $msg;
    }
}

# Check if the target service is currently unmanaged
# WARNING: GLOBAL VARIABLE

if ( !$force && $dnstype =~ m/^(powerdns)$/ ) {
    my $dir          = Cpanel::RPM::Versions::Directory->new( { 'dont_set_legacy' => 1 } );
    my $target_state = $dir->fetch( { 'section' => 'target_settings', 'key' => $dnstype } );
    if ( $target_state && $target_state =~ m/^(unmanaged|uninstalled)$/ ) {
        print "WARNING: You are attempting to switch to $dnstype, but it has explicitly been set to $target_state in /var/cpanel/rpm.versions.d/\n";

        print "This means its packages have been flagged to be left alone by cPanel. "   if ( $target_state eq 'unmanaged' );
        print "This means its packages have been explicitly blocked from installation. " if ( $target_state eq 'uninstalled' );

        print "If this was unintentional, you may be able to remove\nthis flag by running the following command and then re-running setupnameserver\n";
        print "\n    /usr/local/cpanel/scripts/update_local_rpm_versions --del target_settings.$dnstype\n\n";

        print "If you meant to do this, please re-run setupnameserver with --force\n\n";
        exit 2;
    }
}

my $pid_obj = Cpanel::PID->new( { 'pid_file' => '/var/run/setupnameserver.pid' } );
unless ( $pid_obj->create_pid_file() > 0 ) {
    print "Setupnameserver appears to be running already.\n";
    print "Please wait for the conversion to finish before attempting another.\n";
    exit 1;
}

# check bind rpm before any actions, as we are not going to autofix it, but le the admin take care of it
check_bind() if $dnstype eq 'bind';

{
    my $cpconf_guard = Cpanel::Config::CpConfGuard->new();
    print "Setting name server to $dnstype in /var/cpanel/cpanel.config\n";
    $cpconf_ref->{'local_nameserver_type'} = $cpconf_guard->{'data'}->{'local_nameserver_type'} = $dnstype;
    $cpconf_guard->save();
}

my $init = Cpanel::Init->new();

suspend_chksrvd_monitoring();

_disable_systemd_resolved_stub_resolver();

#branch to uninsall/install functions
if ( $dnstype eq 'bind' ) {
    disable_none();
    disable_powerdns();
    enable_bind();
    enable_chksrvd_monitoring();
}
elsif ( $dnstype eq 'powerdns' ) {
    disable_none();
    disable_bind();
    enable_powerdns();
    enable_chksrvd_monitoring();
}
else {
    disable_chksrvd_monitoring();
    enable_none();
    disable_bind();
    disable_powerdns();
    install_cpanel_rpms();
}

if ( $force && $dnstype && $dnstype ne 'disabled' && $dnstype ne 'bind' && !$ENV{'CPANEL_BASE_INSTALL'} ) {
    print "\nChecking status of installed packages for $dnstype\n";
    system( '/usr/local/cpanel/scripts/check_cpanel_pkgs', '--fix', '--long-list', '--targets', $dnstype );
}

restart_dnsadmin();

# Rebuild global cache so that the 'is_dnssec_supported' value is updated
Cpanel::ServerTasks::schedule_task( ['CpDBTasks'], 5, 'build_global_cache' );

$pid_obj->remove_pid_file();

print "\nNameserver conversion complete\n";

exit 0;

sub disable_bind {
    return unless Cpanel::OS::list_contains_value( 'dns_supported', 'bind' );
    print "\nHalting BIND\n";
    my $output = eval { $init->run_command( 'named', 'stop' ) };
    print "\nDisabling BIND in init system\n";
    $output = $init->run_command_for_one( 'disable', 'named' );

    return;
}

sub disable_powerdns {
    return unless Cpanel::OS::list_contains_value( 'dns_supported', 'powerdns' );
    if ( Cpanel::Pkgr::is_installed('cpanel-pdns') ) {
        print "\nHalting PowerDNS\n";
        eval { $init->run_command( 'pdns', 'stop' ) };
        print "\nDisabling PowerDNS in init system\n";
        $init->run_command_for_one( 'disable', 'pdns' );
    }
    unlink('/var/cpanel/usepowerdns') if ( -e '/var/cpanel/usepowerdns' );

    return;
}

sub disable_none {
    unlink('/etc/nameddisable')    if ( -e '/etc/nameddisable' );
    unlink('/etc/binddisable')     if ( -e '/etc/binddisable' );
    unlink('/etc/powerdnsdisable') if ( -e '/etc/powerdnsdisable' );

    return;
}

# Strictly speaking, touching /etc/nameddisable will cause chksrvd to skip over
# restarting BIND or PDNS, but this will stop it from even polling for these processes
sub disable_chksrvd_monitoring {
    my %monitored_services = Cpanel::Chkservd::Manage::getmonitored();
    return unless ( $monitored_services{'named'} );
    Cpanel::Chkservd::Manage::disable('named');
    local $@;
    eval { Cpanel::ServerTasks::queue_task( ['CpServicesTasks'], "restartsrv tailwatchd" ); };
    warn if $@;
    return;
}

sub check_bind {
    print "Checking that BIND is installed\n";

    return if Cpanel::Pkgr::is_installed('bind');

    my $advice = q[/scripts/sysup];
    $advice = q[yum install bind] if Cpanel::OS::is_yum_based();

    print STDERR <<"EOS";
Error: The 'bind' package is not installed on your system.
Run the '$advice' command to install it before you run this command again.
EOS
    exit 1;    ## no critic qw(Cpanel::NoExitsFromSubroutines)
}

# dummy helper to use or not html
sub restartservice {
    my $service = shift or die;

    # We do not taskqueue here since we want bind up right away on fresh installs
    my @args = $html ? ( 1, 0, \&Cpanel::Encoder::Tiny::safe_html_encode_str ) : ();
    return Cpanel::Services::Restart::restartservice( $service, @args );
}

sub enable_bind {
    print "\nUninstalling unused nameservers\n";
    install_cpanel_rpms($force);

    print "\nEnabling the BIND service...\n";
    my $output = $init->run_command_for_one( 'enable', 'named' );

    # Setup rndc
    print "\nSetting up rndc configuration\n";
    my @args = $html ? ('--html') : ();
    system( '/usr/local/cpanel/scripts/fixrndc', '-f', '-v', @args );

    print "\nStarting BIND\n";
    $output = restartservice('named');
    return;
}

sub enable_powerdns {
    print "\nChecking that PowerDNS is installed\n";

    system( 'touch', '/var/cpanel/usepowerdns' );
    install_cpanel_rpms($force);

    # Ensure that the dnssec.db exists
    my $dnssec_db_file = '/var/cpanel/pdns/dnssec.db';
    if ( !-e $dnssec_db_file ) {
        my $rc = system( '/usr/bin/pdnsutil', 'create-bind-db', $dnssec_db_file );
        if ( !$rc ) {
            chmod 0600, $dnssec_db_file;
            my $uid = getpwnam 'named';
            my $gid = getgrnam 'named';
            chown $uid, $gid, $dnssec_db_file;
        }
        else {
            warn "Error creating $dnssec_db_file:  $rc";
        }
    }

    print "\nEnabling PowerDNS in init system\n";
    my $output = $init->run_command_for_one( 'enable', 'pdns' );

    print "\nStarting PowerDNS\n";
    $output = restartservice('named');
    return;
}

sub enable_none {
    system( 'touch', '/etc/nameddisable' );
    return;
}

# Both BIND and PDNS are monitored by chksrvd using restartsrv_named
sub enable_chksrvd_monitoring {
    my %monitored_services = Cpanel::Chkservd::Manage::getmonitored();
    return if ( $monitored_services{'named'} );
    Cpanel::Chkservd::Manage::enable('named');
    local $@;
    eval { Cpanel::ServerTasks::queue_task( ['CpServicesTasks'], "restartsrv tailwatchd" ); };
    warn if $@;
    unsuspend_chksrvd_monitoring();
    return;
}

sub unsuspend_chksrvd_monitoring {
    return Cpanel::Chkservd::Tiny::resume_service('named');
}

sub suspend_chksrvd_monitoring {
    return Cpanel::Chkservd::Tiny::suspend_service( 'named', 600 );
}

sub install_cpanel_rpms {

    # Cpanel::RPM::Versions::Directory intentionally avoids installing the configured DNS service in the initial installation environment so that it will only occur once, when this script runs.
    # It is necessary to hide the installation environment so that the installation happens now.
    local $ENV{'CPANEL_BASE_INSTALL'} = 0;

    # This object should always be re-instantiated here changing targets means Cpanel::RPM::Versions::Directory is invalid prior to now
    my $versions = Cpanel::RPM::Versions::File->new( { 'only_targets' => [qw/powerdns/] } );

    print "\nCalling package installer object\n";
    $versions->stage();
    $versions->commit_changes();
    return;
}

sub restart_dnsadmin {
    if ( Cpanel::Services::Enabled::is_enabled('dnsadmin') ) {
        local $@;
        eval { Cpanel::ServerTasks::queue_task( ['CpServicesTasks'], "restartsrv dnsadmin" ); };
        warn if $@;
    }

    return;
}

sub usage {
    print <<EO_USAGE;
setupnameserver [options] [nameserver type]

    Options:
      --help       Brief help message
      --force      Rerun configuration routines even if the selected
                   nameserver type is already configured
      --current    Show the currently selected nameserver type


    Nameserver Types:
      powerdns     Suggested. High performance. Supports DNSSEC. Functions
                   only as authoritative nameserver.
      bind         Functions as both authoritative and caching nameserver.
      disabled     Disable the local nameserver.
EO_USAGE
    exit 0;    ## no critic qw(Cpanel::NoExitsFromSubroutines) - existing sub
}

sub _disable_systemd_resolved_stub_resolver {
    my $conf_path = '/etc/systemd/resolved.conf';

    return if !-e $conf_path;

    print "\nDisabling systemd-resolved stub resolver\n";

    # I wanted to use Config::Simple to preserve comments, but it's not available on fresh install
    my $conf = Config::Tiny->read($conf_path) || return;

    # see `man resolved.conf`
    $conf->{'Resolve'} //= {};
    $conf->{'Resolve'}->{'DNSStubListener'} = 'no';
    $conf->write($conf_path);

    Cpanel::RestartSrv::Systemd::restart_via_systemd('systemd-resolved');

    return;
}