# Role: server (shron - Arch, headless, mail/web/cloud)
#
# The theme and DISABLE_AUTO_UPDATE are in 05-pre-omz.zsh, because oh-my-zsh
# reads them while it is being sourced.

# The prompt, in a file of its own because there is more to it than a colour.
# Sourced here rather than earlier: this is the point at which oh-my-zsh has
# loaded powerlevel10k, which is where p10k expects its configuration.
#
# beastix keeps its own ~/.p10k.zsh, sourced from 30-path.zsh. This one is
# separate because a server is reached from whatever terminal is at hand and
# cannot assume the desktop's Nerd Font.
[[ -r "$HOME/.config/zsh/p10k-server.zsh" ]] && source "$HOME/.config/zsh/p10k-server.zsh"

# German locale. The base does not set one, since the desktop inherits it from
# the session and the Mac has its own; an SSH session brings only what the
# client sends, which is usually nothing useful.
export LANG=de_DE.UTF-8
export LANGUAGE=de_DE.UTF-8
export LC_MESSAGES=de_DE.UTF-8
export LC_ALL=de_DE.UTF-8

# vim rather than the base's nvim. Both are installed here; this is the
# existing preference and there is no reason to change it from a distance.
alias vi="vim"

# Colours for ls, from a file that only exists on this machine.
[[ -f "$HOME/.dircolors" ]] && eval "$(dircolors "$HOME/.dircolors")"

# Block a single address permanently.
ipt-block() {
  sudo iptables -A INPUT -s "$1" -j DROP
  echo "permblocked $1"
}

# Lift a CrowdSec ban and whitelist the address for a while. The message says
# one hour, the command says twelve - left as it was rather than guessing which
# one was meant.
whitelist() {
    if [[ -z "$1" ]]; then
        echo "Bitte geben Sie eine IP-Adresse an."
        return 1
    fi

    local ip="$1"
    sudo cscli decisions delete --ip "$ip"
    sudo cscli decisions add --ip "$ip" --duration 12h --type whitelist --reason "Manuell whitelisted"
    echo "IP $ip wurde für 1 Stunde whitelisted und entbannt."
}

# Is the running kernel still the installed one?
reboot_required() {
  local installed running
  installed=$(pacman -Q linux-lts | sed 's/linux-lts //')
  running=$(uname -r | sed 's/-lts//')

  if [[ "$installed" == "$running" ]]; then
    echo "no reboot required."
  else
    echo "reboot required!"
  fi
}

# Pull the OpenBL list into an iptables chain.
#
# Carried over unchanged, but it does not work: www.openbl.org answers 301 and
# the curl call has no -L, so the download returns nothing and the function
# reports "Blacklist download failed" every time. Kept rather than deleted
# because the iptables chain it manages may still exist and be worth cleaning
# up deliberately - CrowdSec covers this ground now.
update-blacklist() {
  local CHAINLIST BLACKLIST IPCOUNT
  CHAINLIST=$(sudo /sbin/iptables -nL | grep 'Chain block-traffic-from-openbl' | cut -d' ' -f 2)

  if [ -z "$CHAINLIST" ]; then
    sudo /sbin/iptables -N block-traffic-from-openbl
    sudo /sbin/iptables -A INPUT -j block-traffic-from-openbl
  fi

  BLACKLIST=$(/usr/bin/curl -fs http://www.openbl.org/lists/base_7days.txt.gz | gunzip | grep -E "[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}")

  if [ -z "$BLACKLIST" ]; then
    echo "Blacklist download failed."
    return 1
  fi

  sudo /sbin/iptables -F block-traffic-from-openbl
  IPCOUNT=$(echo "$BLACKLIST" | tr ' ' '\n' | wc -l)
  echo "Adding $IPCOUNT IPs to blacklist. - $(date)"

  echo "$BLACKLIST" | tr ' ' '\n' | while read -r line ; do
    case "$line" in \#*) continue ;; esac
    sudo /sbin/iptables -A block-traffic-from-openbl -p tcp -s "$line" -j REJECT --reject-with tcp-reset
  done
}

# The previous configuration exported PYTHONPATH=/usr/lib/python3.4/site-packages.
# Python 3.4 has not shipped with Arch for years and the directory is gone, so
# it is not carried over. beastix had the same line pointing at 3.9.