#!/bin/sh
### BEGIN INIT INFO
# Provides:          @BG_SYSV_SERVICE_NAME@
# Required-Start:    $local_fs $remote_fs $network
# Required-Stop:     $local_fs $remote_fs $network
# Default-Start:     2 3 4 5
# Default-Stop:      0 1 6
# Short-Description: BastionGuard service dispatcher
### END INIT INFO

PATH=/sbin:/usr/sbin:/bin:/usr/bin
name=$(basename "$0")
pidfile="/run/${name}.pid"
logdir=/var/log/BastionGuard

mkdir -p "$logdir" /run 2>/dev/null || true

is_oneshot() {
    case "$name" in
        BastionGuard-phishing-updater|bastionguard-sanesecurity) return 0 ;;
        *) return 1 ;;
    esac
}

is_running() {
    [ -r "$pidfile" ] || return 1
    pid=$(cat "$pidfile" 2>/dev/null || true)
    case "$pid" in *[!0-9]*|"") return 1 ;; esac
    kill -0 "$pid" 2>/dev/null
}

start_bg() {
    daemon=$1
    shift
    if is_running; then
        return 0
    fi

    if command -v start-stop-daemon >/dev/null 2>&1; then
        start-stop-daemon --start --quiet --background --make-pidfile \
            --pidfile "$pidfile" --startas "$daemon" -- "$@"
    else
        nohup "$daemon" "$@" >>"$logdir/$name.log" 2>&1 &
        printf '%s\n' "$!" > "$pidfile"
    fi
}

start_supervised() {
    policy=$1
    delay=$2
    workdir=$3
    daemon=$4
    shift 4
    start_bg /usr/libexec/bastionguard/bastionguard-supervise \
        --restart "$policy" --delay "$delay" --chdir "$workdir" \
        --log "$logdir/$name.log" -- \
        "$daemon" "$@"
}

start_service() {
    case "$name" in
        BastionGuard-phishing-scanner)
            start_supervised on-failure 5 /usr/share/BastionGuard \
                /usr/bin/BastionGuard-daemon \
                --http-port=81 --https-port=444 \
                --bind-address=127.0.0.2 \
                --page-warning=/usr/share/BastionGuard/data/blocking/block.html
            ;;
        BastionGuard-phishing-updater)
            /usr/share/BastionGuard/data/scripts/BastionGuard-phishing-updater.sh
            ;;
        BastionGuard-phishing-updater-timer)
            start_supervised on-failure 5 / \
                /usr/libexec/bastionguard/bastionguard-periodic \
                --delay 600 --interval 7200 -- \
                /usr/share/BastionGuard/data/scripts/BastionGuard-phishing-updater.sh
            ;;
        BastionGuard-ransomware-realtime)
            start_supervised on-failure 5 / \
                /usr/bin/BastionGuard-ransomware-realtime
            ;;
        bastionguard-sanesecurity)
            /usr/libexec/bastionguard/bastionguard-sanesecurity-update
            ;;
        bastionguard-sanesecurity-timer)
            start_supervised on-failure 5 / \
                /usr/libexec/bastionguard/bastionguard-periodic \
                --delay 300 --interval 7200 -- \
                /usr/libexec/bastionguard/bastionguard-sanesecurity-update
            ;;
        BastionGuard-usbd)
            start_supervised on-failure 5 / \
                /usr/bin/BastionGuard-usbd
            ;;
        bsc-daemon)
            start_supervised on-failure 5 / \
                /usr/sbin/bsc-daemon \
                --rules-path /etc/bastionguard-secure-connectiond/rules \
                --ui-socket unix:///tmp/bsd-daemon.sock
            ;;
        clamav-clamonacc)
            start_supervised on-failure 5 / /usr/sbin/clamonacc \
                -F --fdpass \
                --log=/var/log/clamav/clamonacc.log \
                --move=/root/quarantine
            ;;
        *)
            echo "Unknown BastionGuard SysV service: $name" >&2
            return 5
            ;;
    esac
}

stop_service() {
    if is_oneshot; then
        return 0
    fi
    [ -r "$pidfile" ] || return 0
    if command -v start-stop-daemon >/dev/null 2>&1; then
        start-stop-daemon --stop --quiet --retry TERM/10/KILL/5 --pidfile "$pidfile" || true
    else
        pid=$(cat "$pidfile" 2>/dev/null || true)
        case "$pid" in
            *[!0-9]*|"") ;;
            *)
                kill "$pid" 2>/dev/null || true
                count=0
                while kill -0 "$pid" 2>/dev/null && [ "$count" -lt 100 ]; do
                    sleep 0.1
                    count=$((count + 1))
                done
                kill -KILL "$pid" 2>/dev/null || true
                ;;
        esac
    fi
    rm -f "$pidfile"
}

reload_service() {
    case "$name" in
        BastionGuard-phishing-scanner)
            /usr/libexec/bastionguard/bastionguard-service --system reload dnsmasq.service
            ;;
        bsc-daemon)
            echo "bsc-daemon does not support reload; use restart" >&2
            return 3
            ;;
        *)
            is_running || return 3
            kill -HUP "$(cat "$pidfile")"
            ;;
    esac
}

case "${1-}" in
    start)
        echo "Starting $name"
        start_service
        ;;
    stop)
        echo "Stopping $name"
        stop_service
        ;;
    restart|force-reload)
        stop_service
        start_service
        ;;
    reload)
        reload_service
        ;;
    status)
        if is_running; then
            echo "$name is running"
            exit 0
        fi
        echo "$name is not running"
        exit 3
        ;;
    *)
        echo "Usage: $0 {start|stop|restart|reload|force-reload|status}" >&2
        exit 64
        ;;
esac