#!/bin/sh
# MyLogin.world: connects this firewall to your dashboard, then installs mylogin-pfsense 1.0.0 and runs `mylogin-pfsense setup`.
# Run the command your dashboard shows: --code is valid 24 hours, --address is where you open pfSense.
set -euf
usage() { echo "Usage: fetch -qo - https://mylogin.world.compas.cs.stonybrook.edu/install/pfsense | sh -s -- --code <code> --address <address>. Copy the command from your dashboard." >&2; exit 1; }
code= address=
while [ $# -gt 0 ]; do
  [ $# -ge 2 ] || usage
  case $1 in --code) code=$2 ;; --address) address=$2 ;; *) usage ;; esac
  shift 2
done
[ -n "$code" ] && [ -n "$address" ] || usage
[ "$(id -u)" = 0 ] || { echo "Run this as root (pfSense: Diagnostics > Command Prompt, or console option 8)." >&2; exit 1; }
[ -f /etc/inc/auth.inc ] || { echo "This is not pfSense." >&2; exit 1; }
arch=$(uname -p)
case $arch in
  amd64) file=mylogin-pfsense-1.0.0-amd64.tar.gz sum=794850132eff773a19cc600fdf1247553a805f2d180d4a08798c7f928e13fef0 ;;
  aarch64) file=mylogin-pfsense-1.0.0-aarch64.tar.gz sum=5a8c181389ecc6d795dffefa7e9b4478b31a4a5e8ca883ba4c0d62c165d4ad51 ;;
  *) echo "Unsupported architecture: $arch" >&2; exit 1 ;;
esac
# pfSense has no curl or JSON tool in its shell; its PHP has both
set -- $(/usr/local/bin/php -r '
$c = curl_init($argv[1]);
curl_setopt_array($c, [CURLOPT_POST => true, CURLOPT_RETURNTRANSFER => true, CURLOPT_TIMEOUT => 60, CURLOPT_HTTPHEADER => ["content-type: application/json"],
  CURLOPT_POSTFIELDS => json_encode(["code" => $argv[2], "address" => $argv[3], "hostname" => $argv[4]])]);
$body = curl_exec($c);
if ($body === false) { fwrite(STDERR, "Could not reach https://mylogin.world.compas.cs.stonybrook.edu.\n"); exit(1); }
$v = json_decode($body, true);
$status = curl_getinfo($c, CURLINFO_HTTP_CODE);
if ($status != 200) { fwrite(STDERR, ($v["error"]["message"] ?? "Setup failed (HTTP $status). Try again.") . "\n"); exit(1); }
echo $v["slug"], " ", $v["appUrl"], " ", $v["admin"], " ", ($v["relay"] ?? "") ?: "-", "\n";' -- https://mylogin.world.compas.cs.stonybrook.edu/install/pfsense "$code" "$address" "$(hostname)")
[ $# = 4 ] || exit 1
slug=$1 app_url=$2 admin=$3 relay=${4#-}
dir=$(mktemp -d); trap 'rm -rf "$dir"' EXIT
fetch -qo "$dir/$file" https://mylogin.world.compas.cs.stonybrook.edu/downloads/pfsense/"$file"
[ "$(sha256 -q "$dir/$file")" = "$sum" ] || { echo "Checksum mismatch; nothing installed." >&2; exit 1; }
tar -xzf "$dir/$file" -C "$dir"
install -m 755 "$dir/mylogin-pfsense" /usr/local/sbin/mylogin-pfsense
install -m 755 "$dir/mylogin-pfsense.sh" /usr/local/etc/rc.d/mylogin-pfsense.sh
/usr/local/sbin/mylogin-pfsense setup --slug "$slug" --relay "$relay" --app-url "$app_url" --admin "$admin"