ipsec-xfrm-update

#! /bin/sh

set -e

umask 077

: ${IPSEC_CONF:='/etc/ipsec-xfrm.conf'}
if [ -r "${IPSEC_CONF}" ]
then
	source "${IPSEC_CONF}"
fi

: ${IPSEC_DIR:='/var/lib/ipsec'}
: ${SYNC_HOST:='sync.virusfree.cz'}
: ${SYNC_USER:="$(hostname)"}
: ${LFTP_EXTRA_OPTIONS:=''}
: ${SSH_PRIVATE_KEY:='/etc/ssh/ssh_host_ed25519_key'}

# The IPSEC_SYNC_DIR MUST differ from IPSEC_HOSTS_UPDATE and IPSEC_HOSTS_STABLE!
IPSEC_SYNC_DIR="${IPSEC_DIR}/ipsechosts-sync"
IPSEC_HOSTS_STABLE="${IPSEC_DIR}/ipsechosts"
IPSEC_HOSTS_UPDATE="${IPSEC_DIR}/ipsechosts-update"

if [ "${IPSEC_SYNC_DIR}" == "${IPSEC_HOSTS_STABLE}" -o "${IPSEC_SYNC_DIR}" == "${IPSEC_HOSTS_UPDATE}" ]
then
	echo "IPSEC_SYNC_DIR MUST differ from IPSEC_HOSTS_UPDATE and IPSEC_HOSTS_STABLE!" >&2
	exit 2
fi

if [ -d "${IPSEC_SYNC_DIR}" ]
then
	find "${IPSEC_SYNC_DIR}/" -delete
fi
mkdir -p "${IPSEC_SYNC_DIR}"

# Read about options of mirror command in lftp(1) if you need to exclude some
# files based on regular expresion or glob pattern.
lftp "sftp://${SYNC_USER}:DUMMY@${SYNC_HOST}" > /dev/null <<EOS
	set sftp:connect-program 'ssh -axi ${SSH_PRIVATE_KEY}'
	mirror ${LFTP_EXTRA_OPTIONS} /ipsec ${IPSEC_SYNC_DIR}
	exit
EOS

find "${IPSEC_SYNC_DIR}" -type f -print0 \
| xargs -0rn1 sh -c 'echo "# data from file $0"; cat $0; echo' \
> ${IPSEC_HOSTS_UPDATE}

function manage_service() {
	# This is sort of naive detection of init system.
	if [ -x '/etc/init.d/ipsec-xfrm' ]
	then
		# OpenRC:
		rc-service ipsec-xfrm "${1}"
	elif [ -x '/usr/local/bin/ipsec' ]
	then
		# Following script is used in conjunction with systemd.
		/usr/local/bin/ipsec "${1}"
	else
		echo "Unable to locate OpenRC ipsec-xfrm run script nor systemd ipsec script" >&2
		echo "Check if ipsec-xfrm package is installed properly!" >&2
		echo "" >&2
		echo "Fill a new issue https://github.com/Excello-cz/ipsec-xfrm/issues/new" >&2
		echo "if you think it is a bug." >&2
		exit 1
	fi
}

if [ -f "${IPSEC_HOSTS_STABLE}" ]
then
	set +e
	cmp "${IPSEC_HOSTS_STABLE}" "${IPSEC_HOSTS_UPDATE}"
	if [[ $? == 1 ]]
	then
		set -e
		manage_service 'update'
	elif [[ $? == 2 ]]
	then
		exit $?
	fi
else
	cp "${IPSEC_HOSTS_UPDATE}" "${IPSEC_HOSTS_STABLE}"
	manage_service 'start'
fi