# Project Clearwater - IMS in the Cloud
# Copyright (C) 2015  Metaswitch Networks Ltd
#
# This program is free software: you can redistribute it and/or modify it
# under the terms of the GNU General Public License as published by the
# Free Software Foundation, either version 3 of the License, or (at your
# option) any later version, along with the "Special Exception" for use of
# the program along with SSL, set forth below. This program is distributed
# in the hope that it will be useful, but WITHOUT ANY WARRANTY;
# without even the implied warranty of MERCHANTABILITY or FITNESS FOR
# A PARTICULAR PURPOSE.  See the GNU General Public License for more
# details. You should have received a copy of the GNU General Public
# License along with this program.  If not, see
# <http://www.gnu.org/licenses/>.
#
# The author can be reached by email at clearwater@metaswitch.com or by
# post at Metaswitch Networks Ltd, 100 Church St, Enfield EN2 6BQ, UK
#
# Special Exception
# Metaswitch Networks Ltd  grants you permission to copy, modify,
# propagate, and distribute a work formed by combining OpenSSL with The
# Software, or a work derivative of such a combination, even if such
# copying, modification, propagation, or distribution would otherwise
# violate the terms of the GPL. You must comply with the GPL in all
# respects for all of the code used other than OpenSSL.
# "OpenSSL" means OpenSSL toolkit software distributed by the OpenSSL
# Project and licensed under the OpenSSL Licenses, or a work based on such
# software and licensed under the OpenSSL Licenses.
# "OpenSSL Licenses" means the OpenSSL License and Original SSLeay License
# under which the OpenSSL Project distributes the OpenSSL toolkit software,
# as those licenses appear in the file LICENSE-OPENSSL.

heat_template_version: 2013-05-23

description: >
  DNS server exposing dynamic DNS using DNSSEC

parameters:
  vnf_id:
    type: string
    label: VNF ID
    description: The VNF ID provided by ONAP
  vf_module_id:
    type: string
    label: VNF module ID
    description: The VNF module ID provided by ONAP
  public_net_id:
    type: string
    description: ID of public network
    constraints:
      - custom_constraint: neutron.network
        description: Must be a valid network ID
  dns_flavor_name:
    type: string
    description: Flavor to use
    constraints:
      - custom_constraint: nova.flavor
        description: Must be a valid flavor name
  dns_image_name:
    type: string
    description: Name of image to use
  key_name:
    type: string
    description: Name of keypair to assign
    constraints:
      - custom_constraint: nova.keypair
        description: Must be a valid keypair name
# dns_security_group:
#   type: string
#   description: ID of security group for DNS nodes
  zone:
    type: string
    description: DNS zone
    default: example.com
  dnssec_key:
    type: string
    description: DNSSEC private key (Base64-encoded)

resources:
  server:
    type: OS::Nova::Server
    properties:
      name: { str_replace: { params: { __zone__: { get_param: zone } }, template: ns.__zone__ } }
      image: { get_param: dns_image_name }
      flavor: { get_param: dns_flavor_name }
      key_name: { get_param: key_name }
      networks:
        - network: { get_param: public_net_id }
      metadata: {vnf_id: { get_param: vnf_id }, vf_module_id: { get_param: vf_module_id }}
      user_data_format: RAW
      user_data:
        str_replace:
          params:
            __zone__: { get_param: zone }
            __dnssec_key__: { get_param: dnssec_key }
          template: |
            #!/bin/bash

            # Log all output to file.
            exec > >(tee -a /var/log/clearwater-heat-dns.log) 2>&1
            set -x

            # Install BIND.
            apt-get update
            DEBIAN_FRONTEND=noninteractive apt-get install bind9 --yes

            # Get the public IP address from eth0
            sudo apt-get install ipcalc
            ADDR=`ip addr show eth0 | awk '/inet /{print $2}'`
            PUBLIC_ADDR=`ipcalc -n -b $ADDR | awk '/Address:/{print $2}'`

            # Update BIND configuration with the specified zone and key.
            cat >> /etc/bind/named.conf.local << EOF
            key __zone__. {
              algorithm "HMAC-MD5";
              secret "__dnssec_key__";
            };

            zone "__zone__" IN {
              type master;
              file "/var/lib/bind/db.__zone__";
              allow-update {
                key __zone__.;
              };
            };
            EOF

            # Function to give DNS record type and IP address for specified IP address
            ip2rr() {
              if echo $1 | grep -q -e '[^0-9.]' ; then
                echo AAAA $1
              else
                echo A $1
              fi
            }

            # Create basic zone configuration.
            cat > /var/lib/bind/db.__zone__ << EOF
            \$ORIGIN __zone__.
            \$TTL 1h
            @ IN SOA ns admin\@__zone__. ( $(date +%Y%m%d%H) 1d 2h 1w 30s )
            @ NS ns
            ns $(ip2rr $PUBLIC_ADDR)
            EOF
            chown root:bind /var/lib/bind/db.__zone__

            # Now that BIND configuration is correct, kick it to reload.
            service bind9 reload

outputs:
  dns_ip:
    description: IP address of DNS server
    value: { get_attr: [ server, accessIPv4 ] }
  zone:
    description: DNS zone
    value: { get_param: zone }
  dnssec_key:
    description: DNSSEC private key (Base64-encoded)
    value: { get_param: dnssec_key }