# Copyright Broadcom, Inc. All Rights Reserved.
# SPDX-License-Identifier: APACHE-2.0

http:
  https://ejbca:{{ .Vars.service.ports.https }}/ejbca/doc:
    status: 200
    allow-insecure: true
file:
  /bitnami/ejbca:
    exists: true
    filetype: directory
    mode: "0775"
    owner: wildfly
  /opt/bitnami/wildfly/standalone/configuration/standalone.xml:
    exists: true
    filetype: file
    mode: "0644"
    contents:
      - /http.*{{ .Vars.containerPorts.http }}/
      - /https.*{{ .Vars.containerPorts.https }}/
      - /connection-url.*{{ .Vars.mariadb.auth.database }}/
      - /user-name.*{{ .Vars.mariadb.auth.username }}/
      - /password.*{{ .Vars.mariadb.auth.password }}/
command:
  {{- $baseDN := .Vars.ejbcaCA.baseDN }}
  {{- $caName := .Vars.ejbcaCA.name }}
  {{- $user := printf "user_%s" (randAlpha 5) }}
  {{- $pass := printf "%s" (randAlpha 5) }}
  {{- $dn := printf "%s,CN=%s" $baseDN $user }}
  # Identity type 1 corresponds to END-USER
  {{- $identityType := "1" }}
  add-identity-export-cert:
    exec: cd /opt/bitnami/ejbca && ejbca.sh ra addendentity --username '{{ $user }}' --caname '{{ $caName}}' --dn '{{ $dn }}' --type {{ $identityType }} --token P12 --password '{{ $pass }}' && ejbca.sh ra setclearpwd '{{ $user }}' '{{ $pass }}' && ejbca.sh batch && ls ./p12/{{ $user }}.p12
    exit-status: 0
    timeout: 20000
  {{- $uid := .Vars.containerSecurityContext.runAsUser }}
  {{- $gid := .Vars.podSecurityContext.fsGroup }}
  check-user-info:
    # The UID and GID should always be either the one specified as vars (always a bigger number that the default)
    # or the one randomly defined by openshift (larger values). Otherwise, the chart is still using the default value.
    exec: if [ $(id -u) -lt {{ $uid }} ] || [ $(id -G | awk '{print $2}') -lt {{ $gid }} ]; then exit 1; fi
    exit-status: 0
