#!/bin/bash
set -e

LDAP_URI=${LDAP_URI:-"ldap://localhost:389"}
LDAP_BASE_DN=${LDAP_BASE_DN:-"dc=example,dc=com"}
LDAP_BIND_DN=${LDAP_BIND_DN:-"cn=admin,dc=example,dc=com"}
LDAP_BIND_PASSWORD=${LDAP_BIND_PASSWORD}
LDAP_SUDO_GROUP=${LDAP_SUDO_GROUP:-"sudo_users"}
SSSD_DEBUG=${SSSD_DEBUG_LEVEL:-0}

echo ">>> Erstelle SSSD Konfiguration..."
cat <<EOF > /etc/sssd/sssd.conf
[sssd]
config_file_version = 2
services = nss, pam, sudo
domains = LDAP

[domain/LDAP]
id_provider = ldap
auth_provider = ldap
sudo_provider = ldap
chpass_provider = ldap

ldap_uri = ${LDAP_URI}
ldap_search_base = ${LDAP_BASE_DN}
ldap_sudo_search_base = ou=SUDOers,${LDAP_BASE_DN}

ldap_default_bind_dn = ${LDAP_BIND_DN}
ldap_default_authtok = ${LDAP_BIND_PASSWORD}

ldap_schema = rfc2307bis
ldap_group_member = uniqueMember
ldap_auth_disable_tls_never_use_in_production = true
ldap_id_use_start_tls = false
ldap_tls_reqcert = never

cache_credentials = true
enumerate = false
EOF

chmod 600 /etc/sssd/sssd.conf
chown root:root /etc/sssd/sssd.conf

echo ">>> Erstelle Sudoers-Regel für Gruppe: ${LDAP_SUDO_GROUP}..."
echo "%${LDAP_SUDO_GROUP} ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers.d/ldap-admins
chmod 0440 /etc/sudoers.d/ldap-admins

echo ">>> Erzwinge TLS für xrdp (Guacamole Fix)..."
if [ -f /etc/xrdp/xrdp.ini ]; then
  sed -i 's/^security_layer=.*/security_layer=tls/' /etc/xrdp/xrdp.ini
fi

echo ">>> Bereinige alte PID-Dateien und SSSD Cache..."
rm -f /var/run/dbus/pid /run/dbus/dbus.pid /var/run/xrdp/*.pid /var/run/xrdp/xrdp-sesman.pid
rm -f /var/lib/sss/db/*
rm -f /var/lib/sss/mc/*

echo ">>> Starte D-Bus..."
mkdir -p /var/run/dbus /run/dbus
dbus-uuidgen --ensure
dbus-daemon --system --fork

echo ">>> Starte SSSD..."
sssd -D --debug-level=${SSSD_DEBUG}

echo ">>> Starte XRDP..."
xrdp-sesman
xrdp

echo ">>> Leite Logs an Docker weiter..."
mkdir -p /var/log/sssd /var/log/xrdp

touch /var/log/xrdp.log \
      /var/log/xrdp-sesman.log \
      /var/log/sssd/sssd.log \
      /var/log/sssd/sssd_LDAP.log \
      /var/log/sssd/sssd_nss.log \
      /var/log/sssd/sssd_pam.log

exec tail -F /var/log/xrdp.log \
             /var/log/xrdp-sesman.log \
             /var/log/sssd/sssd.log \
             /var/log/sssd/sssd_LDAP.log \
             /var/log/sssd/sssd_nss.log \
             /var/log/sssd/sssd_pam.log