#!/bin/bash

# Source debconf library.
. /usr/share/debconf/confmodule

mkdir -p /m23/tmp /m23/log

# Returns 0, if run on UCS
UCS_detect()
{
	[ -f '/usr/sbin/udm' ]
	echo $?
}





ln -s /m23/vms/bin/restoreBTServer /etc/init.d/
update-rc.d -f restoreBTServer defaults





#Remove bad SSH keys
if [ -f /tmp/badSSH/root.pub ] && [ -f /root/.ssh/authorized_keys ] && [ -f /root/.ssh/id_dsa.pub ]
then
	cat /tmp/badSSH/root.pub | while read badSSHKey
	do
		sed -i "s#$badSSHKey##g" /root/.ssh/authorized_keys
		rootbadkeyexists=`grep -c "$badSSHKey" /root/.ssh/id_dsa.pub`
		if [ ${rootbadkeyexists:-0} -gt 0 ]
		then
			rm /root/.ssh/id_dsa*
		fi
	done
fi





if [ -f /tmp/badSSH/backuppc.pub ] && [ -f /m23/data+scripts/packages/baseSys/authorized_keys ]
then
	cat /tmp/badSSH/backuppc.pub | while read badSSHKey
	do
		sed -i "s#$badSSHKey##g" /m23/data+scripts/packages/baseSys/authorized_keys

		bpchome=`grep backuppc /etc/passwd | cut -d':' -f6`
		
		if [ -f $bpchome/.ssh/id_rsa.pub ]
		then
			bpcbadkeyexists=`grep -c "$badSSHKey" $bpchome/.ssh/id_rsa.pub`
			if [ ${bpcbadkeyexists:-0} -gt 0 ]
			then
				rm $bpchome/.ssh/id_*
			fi
		fi
	done
fi





#name updateDB
#description Updates the MySQL DB from m23.sql.bz2.
updateDB()
{
	#get username and password of the debian MySQL system 
	dbParams=$(/m23/bin/serverInfoMySQLAccessParams)

	#create database m23
	mysql $dbParams -e "CREATE DATABASE m23"
	#create database m23captured
	mysql $dbParams -e "CREATE DATABASE m23captured"

	if [ -d /tmp/m23-install ]
	then
		# Add the entries of the main database
		bunzip2 -d -c /tmp/m23-install/m23.sql.bz2 | mysql -f $dbParams m23 2>> /var/log/m23PostinstNonCriticalErrorMessages.log
		# Add the entries of the m23captured database
		bunzip2 -d -c /tmp/m23-install/m23captured.sql.bz2 | mysql -f $dbParams m23captured 2>> /var/log/m23PostinstNonCriticalErrorMessages.log
	fi

	#Make sure the i18n table is always empty
	mysql $dbParams m23 -e "delete from i18n" 2>> /var/log/m23PostinstNonCriticalErrorMessages.log
	mysql $dbParams m23captured -e "delete from i18n" 2>> /var/log/m23PostinstNonCriticalErrorMessages.log
}





#name updateSQLIfOlder
#description Updates SQL information or executes SQL statements, if the current version of this packages is older than a given version.
#parameter oldversionint: The version of this packages, that was previously installed.
#parameter olderThan: The first version number that already contains the SQL adjustment and so doesn't need to be adjusted.
#parameter sql: SQL statement to execute.
updateSQLIfOlder()
{
	oldversionint=$1
	olderThan=$2
	sql="$3"

#echo "updateSQLIfOlder($oldversionint, $olderThan, $sql)" >> /var/log/m23update.log

	if [ -n "$oldversionint" ] && [ $oldversionint -lt $olderThan ]
	then
		dbParams=$(/m23/bin/serverInfoMySQLAccessParams)
#		echo "DRIN($sql)" >> /var/log/m23update.log

		echo "$sql" | mysql $dbParams m23 &>> /var/log/m23PostinstNonCriticalErrorMessages.log
	fi
}





#Restarts the DHCP server
restartDHCPServer()
{
for daemon in dhcp dhcp3-server isc-dhcp-server
do
	if [ -e "/etc/init.d/$daemon" ]
	then
		/etc/init.d/$daemon restart 2>> /var/log/m23PostinstNonCriticalErrorMessages.log
	fi
done
}





#Restarts MySQL or MariaDB server
restartSQLServer()
{
	if [ -f /etc/init.d/mysql ]
	then
		/etc/init.d/mysql restart 2>> /var/log/m23PostinstNonCriticalErrorMessages.log
	else
		systemctl restart mysql 2>> /var/log/m23PostinstNonCriticalErrorMessages.log
	fi
}





if [ `grep -c Debian /etc/issue` -eq 0 ] && [ `grep -c Raspbian /etc/issue` -eq 0 ] && [ `grep -c Univention /etc/issue` -eq 0 ]
then
	echo "The m23 packages are ment for installation on Debian/Raspbian/UCS ONLY!"
	exit 666
fi

# Set a new password for the pi user, if it is still the default password
if [ -d /home/pi ] && [ -e /run/sshwarn ]
then
	db_get m23/PIpass
	yes "$RET" | passwd pi
fi





# Don't run on UCS or when installing from the m23 server ISO
if [ $(UCS_detect) -ne 0 ] && [ ! -d /tmp/oldsys ] && ! /m23/bin/isLibreworkspace
then
	termOld="$TERM"
	export TERM='linux'
	/m23/bin/networkCheckSetDialog
	export TERM="$termOld"
fi

DNS="$(/m23/bin/serverInfoDNS)"
BROADINT="$(/m23/bin/serverInfoBroadcast)"
IPINT="$(/m23/bin/serverInfoIP)"
GATEINT="$(/m23/bin/serverInfoGateway)"




#name getCSExternIP
#description Get the external IP of this server, if run in CloudStack.
#shows External IP or empty if not run under CloudStack.
#returns 0 when an external CloudStack IP could be get, 1 otherwise
getCSExternIP()
{
	wget -qq "http://$GATEINT/latest/public-ipv4" -O /tmp/csExternIp

	if [ $? -eq 0 ] && [ -f /tmp/csExternIp ] && [ $(grep -E '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' -c /tmp/csExternIp) -eq 1 ]
	then
		cat /tmp/csExternIp
		rm /tmp/csExternIp
		return 0
	else
		return 1
	fi
}









#check if we are reconfiguring
if [ "$1" = "reconfigure" ] || [ "${DEBCONF_RECONFIGURE}" = "1" ]
then
	reconf=true
	echo "reconf=true" >> /m23.log
else
	reconf=false
	echo "reconf=false" >> /m23.log
fi

#Check if the version is set (in case of first time installation it is not)
if [ -z $2 ]
then
	oldversion=999999
else
	oldversion=$2
fi
echo "oldversion: $oldversion" >> /m23.log
oldversionint=`echo $oldversion | sed 's/[.-]//g'`
echo "oldversionint: $oldversionint" >> /m23.log


if [ -f /tmp/m23-install/mkMissingDirectories.sh ]
then
	sh /tmp/m23-install/mkMissingDirectories.sh
fi


#make sure there is a .htpasswd to secure the admin interface
if [ ! -f /m23/etc/.htpasswd ]
then
	cp -a /m23/etc/.htpasswd.orig /m23/etc/.htpasswd
fi

#Make sure that the password file for phpMyAdmin and phpLDAPAdmin exists
if [ ! -f /m23/etc/.phpMyLDAPAdminHtpasswd ]
then
	cp -a /m23/etc/.htpasswd /m23/etc/.phpMyLDAPAdminHtpasswd
fi

rm /m23/etc/.htpasswd.orig

db_get m23/configMySQL
if [ "$RET" = "true" ] || [ $(UCS_detect) -eq 0 ]
then
	# Make sure, innoDB is enabled
	#sed -i 's/^skip-innodb/#skip-innodb/' /etc/mysql/my.cnf
	
	# Make sure MariaDB uses latin1 and not 4-byte utf8 which would lead to an exceeding of the 1000 bytes limit for unique keys
	if [ -d /etc/mysql/mariadb.conf.d ]
	then
		sed -i 's/utf8mb4/latin1/g' /etc/mysql/mariadb.conf.d/*
	fi

	restartSQLServer

	# Start MySQL/MariaDB server without init system
# 	if [ $(ps -A | grep mysql -c) -eq 0 ]
# 	then
# 		/usr/sbin/mysqld &
# 		sleep 5
# 	fi

	dbname="m23"
	dbserver="localhost"
	#get username and password of the debian MySQL system 
	dbParams=$(/m23/bin/serverInfoMySQLAccessParams)


	#create database m23
	. /usr/share/wwwconfig-common/mysql-createdb.sh 2>> /var/log/m23PostinstNonCriticalErrorMessages.log

	updateDB

	echo "GRANT SELECT , INSERT , UPDATE , DELETE , FILE, TRIGGER ON * . * TO 'm23dbuser'@'localhost' IDENTIFIED BY 'm23secret' WITH MAX_QUERIES_PER_HOUR 0 MAX_CONNECTIONS_PER_HOUR 0 MAX_UPDATES_PER_HOUR 0 ;" | mysql $dbParams m23 2>> /var/log/m23PostinstNonCriticalErrorMessages.log

	echo "GRANT ALTER ON m23.clientkvstore TO 'm23dbuser'@'localhost';" | mysql $dbParams m23 2>> /var/log/m23PostinstNonCriticalErrorMessages.log

	echo "GRANT SELECT , INSERT , UPDATE , DELETE , CREATE , DROP , FILE , INDEX , ALTER , CREATE TEMPORARY TABLES , LOCK TABLES , TRIGGER ON * . * TO 'm23dbroot'@'localhost' IDENTIFIED BY 'm23secretroot' WITH GRANT OPTION MAX_QUERIES_PER_HOUR 0 MAX_CONNECTIONS_PER_HOUR 0 MAX_UPDATES_PER_HOUR 0 ;" | mysql $dbParams m23 2>> /var/log/m23PostinstNonCriticalErrorMessages.log

	#Delete all unused "defaut" groups (every configuration adds a new instance of the default group => if they don't get deleted there will be lots of unused default groups where no client is in. Only the first occurrance of the default group should have clients in it.)
	echo "DELETE FROM groups WHERE id NOT IN (SELECT id FROM (SELECT groups.id FROM clientgroups, groups WHERE clientgroups.groupid = groups.id) as temp)" | mysql $dbParams m23 2>> /var/log/m23PostinstNonCriticalErrorMessages.log

	#Make the groupname unique
	echo "ALTER TABLE groups ADD UNIQUE (groupname); ALTER TABLE groups DROP INDEX groupname" | mysql $dbParams m23 2>> /var/log/m23PostinstNonCriticalErrorMessages.log

	#Make sure that a default group exists
	echo "INSERT INTO groups (id , groupname) VALUES ('1', 'default')" | mysql $dbParams m23 2>> /var/log/m23PostinstNonCriticalErrorMessages.log
fi


db_get m23/configDHCP
if [ "$RET" = "true" ] && [ $(UCS_detect) -ne 0 ]
then
	#this part could be executed more times
	if [ ! -f /etc/dhcp/dhcpd.conf ] || [ `grep domain-name-servers /etc/dhcp/dhcpd.conf | grep -v example -c` -eq 0 ] || $reconf
	then
		[ ! -f /etc/dhcp/dhcpd.conf ]
		echo "/etc/dhcp/dhcpd.conf: $?" >> /m23.log
		[ `grep domain-name-servers /etc/dhcp/dhcpd.conf -c` -eq 0 ]
		echo "grep domain-name-servers: $?" >> /m23.log
		echo "reconf: $reconf" >> /m23.log
	

		#Create /m23/dhcp if it's missing, set permissions and owner
		if [ ! -d /m23/dhcp ]
		then
			mkdir -p /m23/dhcp
			chown root:www-data /m23/dhcp
			chmod 777 /m23/dhcp
		fi

		#/etc/dhcp/dhcpd.conf
		rm /etc/dhcp/dhcpd.conf 2> /dev/null

echo "option domain-name-servers $DNS; \

option broadcast-address $BROADINT;\

option root-path \"/\";\

default-lease-time            21600;\

max-lease-time                21600;\

option log-servers            $IPINT;\

next-server   $IPINT;\

option routers                $GATEINT;

use-host-decl-names on;\

ddns-update-style none;\

authoritative;\

"> /etc/dhcp/dhcpd.conf

	fi

	netDevices=`grep ':' /proc/net/dev | cut -d':' -f1 | tr -d '[:blank:]' | grep -v lo | awk -v ORS=' ' '{print}'`
	sed -i "s/INTERFACES=.*/INTERFACES=\"$netDevices\"/g" /etc/default/isc-dhcp-server
	sed -i "s/INTERFACESv4=.*/INTERFACESv4=\"$netDevices\"/g" /etc/default/isc-dhcp-server
fi



db_get m23/configureSSH
if [ "$RET" = "true" ] || [ ! -f /m23/data+scripts/packages/baseSys/authorized_keys ] || [ $(find /m23/data+scripts/packages/baseSys/authorized_keys -printf "%s") -eq 0 ]
then
	if test -e /root/.ssh/id_rsa.pub
	then
		nop=x
	else
		ssh-keygen -t rsa -b 8192 -N '' -P '' -f /root/.ssh/id_rsa
		ssh-agent sh -c 'ssh-add < /dev/null'
	fi

	#copy the public key to the m23 directory
	cp /root/.ssh/id_rsa.pub /m23/data+scripts/packages/baseSys/authorized_keys
	chown www-data:www-data /m23/data+scripts/packages/baseSys/authorized_keys
else
	if [ ! -f /m23/data+scripts/packages/baseSys/authorized_keys ]
	then
		cp /root/.ssh/id_rsa.pub /m23/data+scripts/packages/baseSys/authorized_keys
		chown www-data:www-data /m23/data+scripts/packages/baseSys/authorized_keys
	fi
fi


db_get m23/configureAPTCacherNG
if [ "$RET" = "true" ] || [ $(UCS_detect) -eq 0 ]
then

# Allow port 2323 in UCS firewall
if [ $(UCS_detect) -eq 0 ]
then
	ucr set security/packetfilter/tcp/2323/all=ACCEPT
	service univention-firewall restart
fi

# Is there Squid proxy configuration that uses port 2323? Indicating that Squid was configured by an older release of m23
if [ $(grep 'http_port 2323' /etc/squid*/squid.conf | wc -l) -gt 0 ]
then
	# Stop Squid for now
	/etc/init.d/squid* stop
	systemctl stop squid.service

	# Make sure Squid won't be started again
	systemctl disable squid.service
	update-rc.d squid remove
	update-rc.d squid3 remove
fi


echo "CacheDir: /var/cache/apt-cacher-ng

LogDir: /var/log/apt-cacher-ng

Port:2323

ReportPage: acng-report.html

ForceManaged: 0

ExTreshold: 4

#DontCache: $IPINT

VfilePatternEx: .*(\.xz)$

PassThroughPattern: .*

PfilePattern = .*(.7z|.deb|.rpm|.exe|.dsc|.tar.gz.gpg|.tar.gz|.diff.gz|.diff.bz2|.jigdo|.template|changelog|copyright|.udeb|.diff/.*.gz|vmlinuz|initrd.gz|(Devel)?ReleaseAnnouncement(\?.*)?)$

LocalDirs: acng-doc /usr/share/doc/apt-cacher-ng
" > /etc/apt-cacher-ng/acng.conf

/etc/init.d/apt-cacher-ng restart
fi

db_get m23/configureSquid
if [ "$RET" = "true" ] && [ $(UCS_detect) -ne 0 ] && [ $(grep -c 'Port:2323' /etc/apt-cacher-ng/acng.conf) -eq 0 ]
then

# 	if [ -d /etc/squid3 ]
# 	then
# 		squidName='squid3'
# 		squidConf="/etc/squid3/squid.conf"
# 		
# 	else
# 		squidName='squid'
# 		squidConf="/etc/squid/squid.conf"
# 	fi
# 
# 	# Special handling for Squid 3 that used squid.conf
# 	if [ -f /usr/sbin/squid3 ]
# 	then
# 		squidName='squid3'
# 		squidConf="/etc/squid/squid.conf"
# 
# 		# Create the spool and log directories
# 		mkdir /var/spool/squid3 /var/log/squid3
# 		chown -R proxy:proxy /var/spool/squid3 /var/log/squid3
# 	fi

	mkdir /var/spool/squid3 /var/log/squid3 /var/spool/squid /var/log/squid
	chown -R proxy:proxy /var/spool/squid3 /var/log/squid3 /var/spool/squid /var/log/squid


	if [ -f /etc/init.d/squid3 ]
	then
		squidName='squid3'
	else
		squidName='squid'
	fi

	if [ -d /etc/squid3 ]
	then
		squidConf="/etc/squid3/squid.conf"
		
	else
		squidConf="/etc/squid/squid.conf"
	fi


	rm $squidConf 2> /dev/null

	hname=`cat /etc/hostname`

if [ $squidName = 'squid' ]
then
cat >> $squidConf << "EOFSQUID"
acl all src all
acl manager proto cache_object
acl localhost src 127.0.0.1/32
acl to_localhost dst 127.0.0.0/8 0.0.0.0/32
acl purge method PURGE
acl CONNECT method CONNECT
acl SSL_ports port 443          # https
acl SSL_ports port 563          # snews
acl SSL_ports port 873          # rsync
acl localnet src 10.0.0.0/8     # RFC1918 possible internal network
acl localnet src 172.16.0.0/12  # RFC1918 possible internal network
acl localnet src 192.168.0.0/16 # RFC1918 possible internal network

http_access allow manager localhost
http_access deny manager
http_access allow purge localhost
http_access allow all
http_access deny CONNECT !SSL_ports

http_access allow localhost

http_access deny all

icp_access allow localnet
icp_access deny all

http_port 2323

hierarchy_stoplist cgi-bin ?

cache_dir ufs /var/spool/squid X_CACHESIZE_X 16 256

maximum_object_size 1024000 KB

access_log /var/log/squid/access.log squid

acl shoutcast rep_header X-HTTP09-First-Line ^ICY.[0-9]
upgrade_http0.9 deny shoutcast

acl apache rep_header Server ^Apache
broken_vary_encoding allow apache

extension_methods REPORT MERGE MKACTIVITY CHECKOUT

hosts_file /etc/hosts

coredump_dir /var/spool/squid

http_access allow all !localhost
acl NOCACHE url_regex -i 192.168.1.6
no_cache deny NOCACHE
visible_hostname m23iso
refresh_pattern Release$         0   41%    360
refresh_pattern Packages.bz2$   0   41%    360
refresh_pattern Packages.gz$    0   41%    360
refresh_pattern Packages$        0   41%    360

refresh_pattern Sources.gz$     0   41%    360
refresh_pattern Sources$         0   41%    360
refresh_pattern Sources.bz2$    0   41%    360


refresh_pattern deb$			129600 100% 129600
refresh_pattern udeb$			129600 100% 129600
refresh_pattern tar.gz$			129600 100% 129600
refresh_pattern tar.xz$			129600 100% 129600
refresh_pattern tar.bz2$		129600 100% 129600
refresh_pattern .orig.tar.gz$	129600 100% 129600
refresh_pattern .diff.gz$		129600 100% 129600
refresh_pattern .tar.7z$		129600 100% 129600
refresh_pattern .dsc$			129600 100% 129600
refresh_pattern .rpm$			129600 100% 129600


http_access deny purge !localhost
EOFSQUID
else
cat >> $squidConf << "EOFSQUID3"
acl SSL_ports port 443
acl Safe_ports port 80          # http
acl Safe_ports port 21          # ftp
acl Safe_ports port 443         # https
acl Safe_ports port 210         # wais
acl Safe_ports port 1025-65535  # unregistered ports
acl Safe_ports port 280         # http-mgmt
acl Safe_ports port 488         # gss-http
acl Safe_ports port 591         # filemaker
acl Safe_ports port 777         # multiling http
acl CONNECT method CONNECT
acl m23server dstdomain 192.168.1.6

http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow all

http_port 2323

cache_dir ufs /var/spool/squid3 X_CACHESIZE_X 16 256

maximum_object_size 1024000 KB

access_log /var/log/squid3/access.log squid

coredump_dir /var/spool/squid3

#acl NOCACHE url_regex -i 192.168.1.6
#no_cache deny NOCACHE
always_direct allow m23server

visible_hostname m23iso

refresh_pattern Release$         0   41%    360
refresh_pattern Packages.bz2$   0   41%    360
refresh_pattern Packages.gz$    0   41%    360
refresh_pattern Packages$        0   41%    360

refresh_pattern Sources.gz$     0   41%    360
refresh_pattern Sources$         0   41%    360
refresh_pattern Sources.bz2$    0   41%    360

refresh_pattern .orig.tar.gz$ 525600 0% 525600 override-lastmod ignore-reload reload-into-ims ignore-no-cache
refresh_pattern .diff.gz$     525600 0% 525600 override-lastmod ignore-reload reload-into-ims ignore-no-cache
refresh_pattern .deb$         525600 0% 525600 override-lastmod ignore-reload reload-into-ims ignore-no-cache
refresh_pattern .tar.7z$     525600 0% 525600 override-lastmod ignore-reload reload-into-ims ignore-no-cache
refresh_pattern .dsc$         525600 0% 525600 override-lastmod ignore-reload reload-into-ims ignore-no-cache
refresh_pattern .rpm$         525600 0% 525600 override-lastmod ignore-reload reload-into-ims ignore-no-cache

shutdown_lifetime 5 seconds
EOFSQUID3
fi

	#Get the free 1K blocks of /var in MB and divide by 2
	free=$[ $(df -P /var | awk 'NR==2 {print $4}') / 2048 ]

	#Adjust the config file
	sed -i "s#X_CACHESIZE_X#$free#g" $squidConf
	sed -i "s#acl NOCACHE url_regex -i .*#acl NOCACHE url_regex -i $IPINT#g" $squidConf
	sed -i "s#acl m23server dstdomain .*#acl m23server dstdomain $IPINT#g" $squidConf
	sed -i "s#visible_hostname .*#visible_hostname $hname#g" $squidConf

	chown root.root $squidConf
	chmod 644 $squidConf

	# Get the name of the init script
	squidName=$(ls /etc/init.d/ | grep squid | head -1)

	#restarting squid
	/etc/init.d/$squidName stop 2>> /var/log/m23PostinstNonCriticalErrorMessages.log
	$squidName -z
	/etc/init.d/$squidName start 2>> /var/log/m23PostinstNonCriticalErrorMessages.log

	echo $squidName > /tmp/squidName
fi


db_get m23/configureSSL
if [ "$RET" = "true" ] && [ $(UCS_detect) -ne 0 ] && ! /m23/bin/isLibreworkspace
then
	if [ -c /dev/random ]
	then
		mv /dev/random /dev/random-blocks
		ln -s /dev/urandom /dev/random
	fi
	
	if [ $(LC_ALL=C wget https://`/m23/bin/serverInfoIP` |& grep 'does not match hostname' -c) -gt 0 ]
	then
		faultyCert=true
	else
		faultyCert=false
	fi

	if test -f /etc/apache/m23/server.crt
	then
		#there is a m23 server certificate, but maybe it was not generated correctly for the server's IP
		if $reconf || $faultyCert
		then
			#generate only a new if reconfigure is selected
			/m23/bin/enable-ssl noAptGet `getCSExternIP`
		fi

		# Re-generate the package index of local packages if needed (not needed, but stays in source code if needed sometime later)
# 		if $faultyCert
# 		then
# 			sudo su - www-data -c ". /mdk/m23Debs/bin/m23Deb.inc; cd /m23/data+scripts/extraDebs/; makePackages"
# 			/m23/bin/m23cli.php GPG_signExtraDebsRelease
# 		fi
	else
		#no m23 certificate found => create a new
		/m23/bin/enable-ssl noAptGet `getCSExternIP`
	fi

	if [ -h /dev/random ] && [ -c /dev/random-blocks ]
	then
		rm /dev/random
		mv /dev/random-blocks /dev/random
	fi
fi

# Make the m23 server trust its own certificate
ln -s /m23/data+scripts/packages/baseSys/ca.crt /usr/local/share/ca-certificates/m23-server.crt
update-ca-certificates



# Make symlinks on UCS and copy SSL certificate
if [ $(UCS_detect) -eq 0 ]
then
	ln -s /m23/data+scripts/m23admin /var/www
	ln -s /m23/data+scripts/gfx /var/www
	ln -s /m23/data+scripts/cron.php /var/www
	ln -s /m23/data+scripts/debugScreen.php /var/www
	ln -s /m23/data+scripts/index.php /var/www
	ln -s /m23/data+scripts/migrate.php /var/www
	ln -s /m23/data+scripts/postMessage.php /var/www
	ln -s /m23/data+scripts/work.php /var/www
	ln -s /m23/data+scripts/devguide /var/www
	ln -s /m23/data+scripts/extraDebs /var/www
	ln -s /m23/data+scripts/iso /var/www
	ln -s /m23/data+scripts/jQuery-gfx /var/www
	ln -s /m23/data+scripts/java-vnc /var/www
	ln -s /m23/data+scripts/js /var/www
	ln -s /m23/data+scripts/packages /var/www
	ln -s /m23/data+scripts/ace /var/www
	ln -s /m23/data+scripts/distr /var/www/
	ln -s /m23/data+scripts/m23manual /var/www/
	ln -s /m23/data+scripts/devguide /var/www/
	
	ucsSSLDir="/etc/univention/ssl/`hostname`"
	openssl x509 -in "$ucsSSLDir/cert.pem" -subject_hash_old -noout > /m23/data+scripts/packages/baseSys/ca.hash
	cp "$ucsSSLDir/cert.pem" /m23/data+scripts/packages/baseSys/ca.crt
	
	chown www-data:www-data /m23/data+scripts/packages/baseSys/ca.crt /m23/data+scripts/packages/baseSys/ca.hash
	chmod 644 /m23/data+scripts/packages/baseSys/ca.crt /m23/data+scripts/packages/baseSys/ca.hash

	# Convert to UTF-8 on UCS > 4.1
# 	if [ $(grep ' 4\.1-' /etc/issue -c) -ne 1 ] && [ $(LC_ALL=C file /m23/inc/i18n/de/m23base.php | grep -i -c UTF-8) -eq 0 ]
# 	then
# 		# Convert the files to UTF-8
# 		find /m23/inc/help -type f | xargs -n1 recode ISO-8859-1..utf-8
# 		find /m23/inc/i18n -type f | xargs -n1 recode ISO-8859-1..utf-8
# 		find /m23/inc -type f | grep info.txt$ | xargs -n1 recode ISO-8859-1..utf-8
# 		sed -i 's/ISO-8859-1/UTF-8/' /m23/data+scripts/index.php /m23/data+scripts/m23admin/index.php
# 	fi

	for phpFile in `find /etc/php?/apache* /etc/php/7.0 /etc/php/7.3 2> /dev/null | grep php.ini` `find /etc/php?/cli | grep php.ini`
	do
		# PHP settings

		# Enable short opening tags
		sed -i -e 's/short_open_tag = Off/short_open_tag = On/g' $phpFile

		# Increase allowed amount of input variables from 1000 to 10000
		if [ $(egrep '^max_input_vars = 10000' -c $phpFile) -eq 0 ]
		then
			sed -i -e 's/^max_input_vars/;max_input_vars/g' $phpFile
			echo 'max_input_vars = 10000' >> $phpFile
		fi
	done

	/etc/init.d/apache2 restart 2>> /var/log/m23PostinstNonCriticalErrorMessages.log
fi





db_get m23/configureApache
if [ "$RET" = "true" ] && [ $(UCS_detect) -ne 0 ]
then
	if /m23/bin/isLibreworkspace
	then
		# Define special ports for HTTP and HTTPs if run on Libre Workspace, because 80 and 443 are used by Caddy
		httpPort="2380"
		httpsPort="23443"

		# Remove the original configuration that holds the ports that Apache should open
		dpkg-divert --local --rename --add /etc/apache2/ports.conf
		rm /etc/apache2/ports.conf 2> /dev/null

		# Set the ports to open
		for port in $httpPort $httpsPort
		do
			if [ ! -f /etc/apache2/ports.conf ] || [ $(grep -c "Listen $port" /etc/apache2/ports.conf) -eq 0 ]
			then
				echo "Listen $port" >> /etc/apache2/ports.conf
			fi
		done
	else
		# Default ports that are used in Apache's default configuration
		httpPort="80"
		httpsPort="443"
	fi

	if ( [ -f /etc/default/apache2 ] && [ `grep "NO_START=1" /etc/default/apache2 -c` -eq 0 ] ) || ( [ -f /etc/apache2/ports.conf ] )
	then
		#Configuration for Apache 2.x

		rm /etc/apache2/sites-enabled/m23.conf /etc/apache2/sites-enabled/000-default.conf 2> /dev/null

		# Config snippets for Apache 2.2
		allowAll='
		Order allow,deny
		Allow from all
		'
		sslDirSettings=''
		phpCharSet=''


		# Check, if apache2ctl is present
		type apache2ctl &> /dev/null
		if [ $? -eq 0 ]
		then
			# Check, if Apache 2.4 is installed
			if [ $(apache2ctl -v | grep version | grep -c '/2\.4') -gt 0 ]
			then
				# Overwrite the Apache 2.2 snippets
				allowAll='Require all granted'
				sslDirSettings='
		<Directory /m23/data+scripts>
			Options Indexes Includes FollowSymLinks MultiViews
			AllowOverride AuthConfig
			Require all granted
		</Directory>
		'
			fi
		fi

		for IP in 127.0.0.1 localhost $IPINT
		do

echo "<VirtualHost *:$httpPort>
	ServerName $IP
	DocumentRoot /m23/data+scripts
	<Directory /m23/data+scripts>
		Options Indexes Includes FollowSymLinks MultiViews
		AllowOverride AuthConfig
		$allowAll
	</Directory>
	php_value default_charset utf-8
</VirtualHost>
" >> /etc/apache2/sites-enabled/m23.conf
		done

		# No SSL on Libre Workspace
		if ! /m23/bin/isLibreworkspace
		then
			echo "<IfModule mod_ssl.c>" >> /etc/apache2/sites-enabled/m23.conf

			for IP in 127.0.0.1 localhost $IPINT
			do
	echo "	<VirtualHost *:$httpsPort>
			ServerName $IP
			DocumentRoot \"/m23/data+scripts/\"
			SSLEngine on
			SSLCertificateFile /etc/apache/m23/server.crt
			SSLCertificateKeyFile /etc/apache/m23/server.key
			SSLCertificateChainFile /etc/apache/m23/server.crt
			SSLVerifyClient none
	
			<Files ~ \"\.(cgi|shtml)$\">
				SSLOptions +StdEnvVars
			</Files>
			<Directory \"/usr/lib/cgi-bin\">
				SSLOptions +StdEnvVars
			</Directory>
	
			$sslDirSettings
	
			SetEnvIf User-Agent \".*MSIE.*\" nokeepalive ssl-unclean-shutdown
			php_value default_charset utf-8
		</VirtualHost>
	" >> /etc/apache2/sites-enabled/m23.conf
			done

			echo "</IfModule>" >> /etc/apache2/sites-enabled/m23.conf
		fi


		chmod 644 /etc/apache2/sites-enabled/m23.conf

		#Delete symbolic link of old default vhost
		rm /etc/apache2/sites-enabled/000-default 2> /dev/null
		
		apacheV=2
	else
		sed 's/DocumentRoot \/var\/www/DocumentRoot \/m23\/data+scripts/' /etc/apache/httpd.conf | sed 's/<Directory \/var\/www\/>/<Directory \/m23\/data+scripts>/' | sed 's/  DirectoryIndex/  DirectoryIndex index.php/' | sed  's/#AddType application\/x-httpd-php .php/AddType application\/x-httpd-php .php/' | sed 's/# LoadModule php4_module \/usr\/lib\/apache\/1.3\/libphp4.so/LoadModule php4_module \/usr\/lib\/apache\/1.3\/libphp4.so/' | sed 's/AllowOverride None/AllowOverride AuthConfig/g' > /tmp/httpd.conf
		mv /tmp/httpd.conf /etc/apache/
		chown root:root /etc/apache/httpd.conf
		chmod 644 /etc/apache/httpd.conf

		apacheV=""
	fi
	
	if ! /m23/bin/isLibreworkspace
	then
		#Get the absolute path to the PHP ini file(s)
		for phpFile in `find /etc/php/ | egrep php.ini$`
		do
			#PHP settings
			sed -i -e 's/register_globals = Off/register_globals = On/g' -e 's/memory_limit[ =0-9MG]*;/memory_limit = 512M;/g' -e 's/short_open_tag = Off/short_open_tag = On/g' -e 's/^session.gc_probability[ =0-9]*/session.gc_probability = 5/g' -e 's/^session.gc_divisor[ =0-9]*/session.gc_divisor = 100/g' $phpFile
			
# 			if [ -e /etc/php/7.0 ] || [ -e /etc/php/7.3 ]
# 			then
# 				sed -i -e 's/^session.gc_probability[ =0-9]*/session.gc_probability = 0/g' $phpFile
# 			else
# 				#activate MySQL support in php.ini (obsolete on PHP 7, remove when there are no supported distributons with PHP 5.x anymore)
# 				if test `grep -c "^extension=mysql.so" $phpFile` -eq 0
# 				then
# 					echo "extension=mysql.so" >> $phpFile
# 				fi
# 			fi
	
			chown root:root $phpFile
			chmod 644 $phpFile
		done
	fi

	# Remove the now unknown "default_charset" parameter from Apache configuration
# 	if [ $(grep -c 'Debian GNU/Linux 10' /etc/issue) -gt 0 ]
# 	then
# 		sed -i '/default_charset/d' /etc/apache2/sites-enabled/*.conf
# 	fi


	#Sets the phpver and phpini variables to the version of php that are installed.
	. /usr/share/wwwconfig-common/php.get
	server="apache$apacheV"

	#Verifies that the php module is loaded in the apache config file.
	. /usr/share/wwwconfig-common/apache-php.sh
	server="apache$apacheV-ssl"
	. /usr/share/wwwconfig-common/apache-php.sh

	# Disable systemd redirecting /tmp of PHP processes to separte directories
	cp -a /lib/systemd/system/apache* /etc/systemd/system/
	sed -i 's/PrivateTmp=true/PrivateTmp=false/g' /etc/systemd/system/apache*
	#sed -i 's/PrivateTmp=true/PrivateTmp=false/g' /lib/systemd/system/apache*
	systemctl daemon-reload

	/etc/init.d/apache$apacheV restart 2>> /var/log/m23PostinstNonCriticalErrorMessages.log
	
	#Create a script that "knows" how to control the Apache 1.x/2.x process.
	echo "/etc/init.d/apache$apacheV \$1" > /tmp/apachectl
	chmod +x /tmp/apachectl
fi

db_get m23/configureSudo
if [ "$RET" = "true" ] || [ $(UCS_detect) -eq 0 ]
then
	if test `grep -c "^www-data          ALL=NOPASSWD:ALL" /etc/sudoers` -eq 0
	then
		echo "www-data          ALL=NOPASSWD:ALL" >> /etc/sudoers
	fi
fi



db_get m23/configureBackupPC
if [ "$RET" = "true" ] && [ $(UCS_detect) -ne 0 ] && ! /m23/bin/isLibreworkspace
then
	bpchome=`grep backuppc /etc/passwd | cut -d':' -f6`
	
	#check if the BackupPC SSH key is missing
	if [ ! -f $bpchome/.ssh/id_rsa ]
	then
		#create a new SSH keypair for the backuppc user
		sudo -H -u backuppc sh -l -c "ssh-keygen -t dsa -N '' -P '' -f ~/.ssh/id_rsa; ssh-agent sh -c 'ssh-add < /dev/null'"
	fi

	#add the BackupPC key to the authorized_keys
	if [ `grep -c backuppc /m23/data+scripts/packages/baseSys/authorized_keys` -lt 1 ]
	then
		#add the key to the keys known by the clients
		keyPath="$bpchome/.ssh/id_rsa.pub"
		cat $keyPath >> /m23/data+scripts/packages/baseSys/authorized_keys
	fi

	#disable needed mutual exchange of SSH keys and strong verification of keys
	sed -i 's#sshPath -q -x -n -l root#sshPath -o VerifyHostKeyDNS=no -o PreferredAuthentications=publickey -o PasswordAuthentication=no -o CheckHostIP=no -o BatchMode=yes -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -q -x -l root#g' /etc/backuppc/config.pl

	#Check for Apache 1.x
	if [ -f /etc/apache/httpd.conf ]
	then
		#Make sure the BackupPC Apache include file is included in httpd.conf.
		if [ `grep -c "Include /etc/backuppc/apache.conf" /etc/apache/httpd.conf` -lt 1 ]
		then
			echo "Include /etc/backuppc/apache.conf" >> /etc/apache/httpd.conf
		fi
	fi

	#Make BackupPC use the same password file than m23
	sed -i 's#/etc/backuppc/htpasswd#/m23/etc/.htpasswd#g' /etc/backuppc/apache.conf

	#Make sure all m23 admins are known to BackupPC.
	for admin in `cat /m23/etc/.htpasswd | cut -d':' -f1`
	do
		echo "Adding $admin to the list of BackupPC admins"
		php -r "include(\"/m23/inc/db.php\");
		include(\"/m23/inc/backup.php\");
		include(\"/m23/inc/server.php\");
		include(\"/m23/inc/edit.php\");
		include(\"/m23/inc/helper.php\");
		BACKUP_addAdmin(\"$admin\");"
	done

	#Make BackupPC usable by the apache user (and not only by user backuppc)
	chown backuppc:www-data /usr/share/backuppc/cgi-bin/index.cgi
	chmod u+s /usr/share/backuppc/cgi-bin/index.cgi

	#Restart the Apache 1.x/2.x
	/tmp/apachectl restart 2>> /var/log/m23PostinstNonCriticalErrorMessages.log
fi





#Create a new cron secret file if it doesn't exist
if [ ! -e /m23/inc/cronSecret.php ]
then
	echo "<?
        define('CONF_CRON_SECRET','`pwgen -c -s 64 1`');
?>" > /m23/inc/cronSecret.php
	chmod 644 /m23/inc/cronSecret.php
fi





#Create the GPG key
if [ -z $(getent passwd grdmgpg) ] || [ $(su -c "gpg --list-secret-keys | grep ^sec -c" grdmgpg) -eq 0 ]
then
	#Change random to non-blocking urandom
	if [ -c /dev/random ]
	then
		mv /dev/random /dev/random-blocks
		ln -s /dev/urandom /dev/random
	fi

	#Generate a random password for the GPG user
	pw=`pwgen -s -c 16`

	#Create the user
	if [ $(UCS_detect) -eq 0 ]
	then
		addgroup --gid 55001 grdmgpg
		useradd --uid 55001 --gid 55001 -m -p $pw grdmgpg
	else
		useradd -m -p $pw grdmgpg
	fi

	#Delete old GPG line
	sed -i '/NOPASSWD:GPG/d' /etc/sudoers

	#Delete localhost alias
	sed -i '/Host_Alias[ \t]*LOCALHOST/d' /etc/sudoers
	sed -i '/Host alias specification/d' /etc/sudoers
	
	grdmAmount=$(grep -c grdmgpg /etc/sudoers)
	if [ $grdmAmount -eq 0 ]
	then
		echo "# User privilege specification
www-data          ALL= (grdmgpg) NOPASSWD:/usr/bin/gpg

" >> /etc/sudoers
	fi
	

	#add access to sudo: the Apache user should be able to call gpg under the grdmgpg user
	echo "# Host alias specification
Host_Alias	LOCALHOST=127.0.0.1/255.255.255.0, `hostname`
" >> /etc/sudoers

	#Write a file with settings for the GPG key generation
	echo "
%echo Generating a standard key
Key-Type: RSA
Key-Length: 4096
Subkey-Type: ELG-E
Subkey-Length: 4096
Name-Real: backupsignkey
Name-Comment: No comment
Name-Email: backupsignkey@m23server
Expire-Date: 0
%no-protection
%commit
%echo done
" > /tmp/gpgSettings

	#let the GPG user create a new key
	su -c "gpg --batch --gen-key -a /tmp/gpgSettings" grdmgpg
	rm /tmp/gpgSettings

	#Change random back
	if [ -h /dev/random ] && [ -c /dev/random-blocks ]
	then
		rm /dev/random
		mv /dev/random-blocks /dev/random
	fi
fi


#For Debian Squeeze (where mkisofs doesn't exist)
if [ -f /usr/bin/genisoimage ] && [ ! -f /usr/bin/mkisofs ]
then
	ln -s /usr/bin/genisoimage /usr/bin/mkisofs
fi

#For Debian Squeeze (where cdrecord doesn't exist)
if [ -f /usr/bin/wodim ] && [ ! -f /usr/bin/cdrecord ]
then
	ln -s /usr/bin/wodim /usr/bin/cdrecord
fi

# Add the cron entry for automatically removing old APT lists files
if [ $( grep rmOldM23VarCacheM23aptLists /etc/crontab -c ) -eq 0 ]
then
	echo "*/30 * * * *	root	/m23/bin/rmOldM23VarCacheM23aptLists" >> /etc/crontab
fi


# Generate random API key
if [ ! -f /m23/etc/apiKey ]
then
	pwgen -c -s 32 1 > /m23/etc/apiKey
fi


##################
# DB adjustments #
##################

#Add architecture option with i386 if it's missing
if [ -n "$oldversionint" ] && [ $oldversionint -lt 057100154 ]
then
php -r "
	include(\"/m23/inc/db.php\");
	include(\"/m23/inc/checks.php\");
	include(\"/m23/inc/client.php\");
	include(\"/m23/inc/capture.php\");

	dbConnect();

	\$results = CLIENT_query(\"\",\"\",\"\",\"\");

	while(\$data = mysqli_fetch_array(\$results))
	{
		\$opt=CLIENT_getAllOptions(\$data['client']);

		if (!isset(\$opt['arch']))
		{
			\$opt['arch']=\"i386\";
			CLIENT_setAllOptions(\$data['client'],\$opt);
		}
	}
"
fi

dbParams=$(/m23/bin/serverInfoMySQLAccessParams)

echo "SELECT COUNT(*) FROM clients WHERE client='localhost' AND ip='$IPINT' | mysql $dbParams m23" > /m23serverinst.log
ps -A >> /m23serverinst.log

echo 'ergkompl' >> /m23serverinst.log
echo "SELECT COUNT(*) FROM clients WHERE client='localhost' AND ip='$IPINT'" | mysql $dbParams m23 >> /m23serverinst.log 2>> /var/log/m23PostinstNonCriticalErrorMessages.log
echo 'erge' >> /m23serverinst.log

#Add the server to the list of clients if it's missing
localhostCount=`echo "SELECT COUNT(*) FROM clients WHERE client='localhost' AND ip='$IPINT'" | mysql $dbParams m23 2>> /var/log/m23PostinstNonCriticalErrorMessages.log | tail -1`

echo "erge2: $localhostCount" >> /m23serverinst.log

if [ -z $localhostCount ] || [ $localhostCount -eq 0 ]
then
	#Add the server to the list of clients as "localhost"
	ts=`date +%s`

	#Get CPU type and speed
	cpu=`grep name /proc/cpuinfo | cut -d':' -f2`
	mhz=`grep MHz /proc/cpuinfo | cut -d':' -f2 | cut -d' ' -f2`

	echo "DELETE FROM clients WHERE client='localhost' | mysql $dbParams m23" >> /m23serverinst.log
	echo "DELETE FROM clients WHERE client='localhost'" | mysql $dbParams m23 2>> /var/log/m23PostinstNonCriticalErrorMessages.log

	echo "INSERT INTO clients (client,ip,installdate,lastmodify,status,cpu,MHz) VALUES ('localhost','$IPINT','$ts','$ts','2','$cpu','$mhz') | mysql $dbParams m23" >> /m23serverinst.log	
	echo "INSERT INTO clients (client,ip,installdate,lastmodify,status,cpu,MHz) VALUES ('localhost','$IPINT','$ts','$ts','2','$cpu','$mhz')" | mysql $dbParams m23 2>> /var/log/m23PostinstNonCriticalErrorMessages.log
fi

#Increased the size of the fields "cpu" and "MHz" in the table "clients".
updateSQLIfOlder $oldversionint 057100145 "ALTER TABLE clients CHANGE cpu cpu LONGTEXT NOT NULL"
updateSQLIfOlder $oldversionint 057100145 "ALTER TABLE clients CHANGE MHz MHz LONGTEXT NOT NULL"

#Add table rows for virtualisation
updateSQLIfOlder $oldversionint 071100200 "ALTER TABLE clientjobs CHANGE normalPackage normalPackage LONGTEXT"
updateSQLIfOlder $oldversionint 071100200 "ALTER TABLE clients ADD vmRunOnHost INT( 9 ) NULL DEFAULT '-1'"
updateSQLIfOlder $oldversionint 071100200 "ALTER TABLE clients ADD vmSoftware INT NULL DEFAULT '0'"
updateSQLIfOlder $oldversionint 071100200 "ALTER TABLE clients ADD vmRole TINYINT( 1 ) NOT NULL DEFAULT '0'"
updateSQLIfOlder $oldversionint 071100200 "ALTER TABLE clients ADD vmVisualPassword VARCHAR( 40 ) NOT NULL"
updateSQLIfOlder $oldversionint 071100200 "ALTER TABLE clients ADD vmVisualURL VARCHAR( 255 ) NOT NULL"

#Add table a rows for storing debconf values
updateSQLIfOlder $oldversionint 101100351 "ALTER TABLE clientjobs CHANGE normalPackage normalPackage LONGTEXT"
updateSQLIfOlder $oldversionint 101100351 "CREATE TABLE m23.debconf ( id INT NOT NULL AUTO_INCREMENT , client VARCHAR( 40 ) NOT NULL , package VARCHAR( 255 ) NOT NULL , type varchar(255) NOT NULL, var VARCHAR( 255 ) NOT NULL , val LONGTEXT NOT NULL , PRIMARY KEY ( id ), UNIQUE KEY client (client,package,var) ) ENGINE = MYISAM"

#Add a table for storing status bar values
updateSQLIfOlder $oldversionint 113100356 "CREATE TABLE m23.statusbar ( id int(20) NOT NULL AUTO_INCREMENT , refreshtime int(11) NOT NULL default '5', type VARCHAR( 255 ) NOT NULL , cmd LONGTEXT NOT NULL, ts bigint(20) NOT NULL default '0', percent int(11) NOT NULL default '0', client varchar(255) NOT NULL , statustext longtext NOT NULL , name VARCHAR( 255 ) NOT NULL , PRIMARY KEY ( id ),  UNIQUE KEY client (client,name) ) ENGINE = MYISAM"

#Increased the size of the field "normalPackage" in the table "clientjobs".
updateSQLIfOlder $oldversionint 113100402 "ALTER TABLE clientjobs CHANGE normalPackage normalPackage LONGTEXT NOT NULL"

#Increased the size of the clientname to longtext.
updateSQLIfOlder $oldversionint 113100411 "ALTER TABLE clients CHANGE client client LONGTEXT NOT NULL"

#Increase the size of language
updateSQLIfOlder $oldversionint 113100485 "ALTER TABLE clients CHANGE language language VARCHAR( 5 ) NOT NULL"

#Add a table for storing locked IP ranges
updateSQLIfOlder $oldversionint 123100598 "CREATE TABLE m23.lockedIPRanges (id BIGINT NOT NULL AUTO_INCREMENT , firstIPInt bigint(20) NOT NULL , lastIPInt bigint(20) NOT NULL , PRIMARY KEY ( id )) ENGINE = MYISAM ;"

#Convert the old dhcpd.conf format to the new
if [ -f /etc/dhcp/dhcpd.conf ]
then
	dhcpdBackup=$(date +'/etc/dhcp/dhcpd.conf.%Y-%m-%d_%H-%M.bak')
	cp /etc/dhcp/dhcpd.conf $dhcpdBackup
	sed -i -e 's/^ subnet [0-9]*\.[0-9]*\.[0-9]*\.[0-9]* netmask [0-9]*\.[0-9]*\.[0-9]*\.0 { //g' -e 's/; } option/; option/g' -e 's/}}$/}/g' -e 's/^ host/host/g' /etc/dhcp/dhcpd.conf
fi

#Add new table for storing the PHP objects
updateSQLIfOlder $oldversionint 131100629 "CREATE TABLE m23.PHPObjectStorage ( id BIGINT NOT NULL AUTO_INCREMENT , ident VARCHAR( 255 ) NOT NULL , class VARCHAR( 255 ) NOT NULL , object LONGTEXT NOT NULL, last_modified int(10) NOT NULL, PRIMARY KEY ( id ), UNIQUE KEY client (ident,class) ) ENGINE = MYISAM ;"

#Add a new table for storing the admin credentials
updateSQLIfOlder $oldversionint 131100637 "CREATE TABLE m23Admins ( ID int(10) unsigned NOT NULL AUTO_INCREMENT, name varchar(40) NOT NULL, pwhash varchar(255) NOT NULL, options longtext NOT NULL, salt varchar(16) NOT NULL, PRIMARY KEY (ID) ) ENGINE=MyISAM COMMENT='List of all m23 admins with password hashes and options';"

#Increase the size of the normalPackage field to LONGTEXT
updateSQLIfOlder $oldversionint 131100669 "ALTER TABLE recommendpackages CHANGE normalPackage normalPackage LONGTEXT NOT NULL"

updateSQLIfOlder $oldversionint 143100752 "ALTER TABLE clients ADD CFDiskTemp LONGBLOB NOT NULL AFTER partitions"

# Add description field to the groups table
updateSQLIfOlder $oldversionint 162100899 "ALTER TABLE groups ADD description LONGTEXT; ALTER TABLE clients ADD keyValueStore LONGTEXT"

# Add new table for storing the autoUpdate schedule
updateSQLIfOlder $oldversionint 172100985 "CREATE TABLE autoUpdateSchedule ( id int(11) NOT NULL, startsEnds text NOT NULL, groups text NOT NULL, type varchar(1) NOT NULL, parallelUpdates int(11) NOT NULL, lastRun timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP, active tinyint(1) NOT NULL ) ENGINE=InnoDB DEFAULT CHARSET=latin1;"

# Extend the client table by fields for storing autoUpdate values
updateSQLIfOlder $oldversionint 172100985 "ALTER TABLE clients ADD autoUpdate_lastAttempt int(10) DEFAULT NULL AFTER keyValueStore, ADD autoUpdate_gotJob BOOLEAN NOT NULL AFTER autoUpdate_lastAttempt, ADD autoUpdate_fails INT NOT NULL AFTER autoUpdate_gotJob;"

# Add field for online status in the client's table
updateSQLIfOlder $oldversionint 173101041 "ALTER TABLE clients ADD online TINYINT(1) UNSIGNED NOT NULL DEFAULT '0' AFTER status;"
updateSQLIfOlder $oldversionint 173101041 "ALTER TABLE clientjobs ADD reason LONGTEXT NOT NULL COMMENT 'Grund f�r das Hinzufuegen des Jobs' AFTER package;"

#Speed improvements

# Add indices
updateSQLIfOlder $oldversionint 173101041 "ALTER TABLE clientpackages ADD id INT NOT NULL AUTO_INCREMENT FIRST, ADD PRIMARY KEY (id);"
updateSQLIfOlder $oldversionint 173101041 "ALTER TABLE clientpackages ADD INDEX idx_clientname_package (clientname, package);"
updateSQLIfOlder $oldversionint 173101041 "ALTER TABLE clientjobs ADD INDEX idx_client_status (client, status);"

# Longtext fields cannot be indexed, so make it indexable varchar
updateSQLIfOlder $oldversionint 173101041 "ALTER TABLE clients CHANGE client client VARCHAR(512) CHARACTER SET latin1 COLLATE latin1_swedish_ci NOT NULL;"
updateSQLIfOlder $oldversionint 173101041 "ALTER TABLE clients ADD INDEX idx_client (client);"


# Add triggers to calculate the sum of client packages in the SQL database itself
# updateSQLIfOlder $oldversionint 173101041 "ALTER TABLE clients ADD trg_sum_clientpackages INT UNSIGNED NOT NULL DEFAULT '0' AFTER lastmodify;"
# updateSQLIfOlder $oldversionint 173101041 "CREATE TRIGGER trg_sum_clientpackages_add AFTER INSERT ON clientpackages FOR EACH ROW UPDATE clients SET trg_sum_clientpackages = trg_sum_clientpackages + 1 WHERE client = NEW.clientname;"
# updateSQLIfOlder $oldversionint 173101041 "CREATE TRIGGER trg_sum_clientpackages_del AFTER DELETE ON clientpackages FOR EACH ROW UPDATE clients SET trg_sum_clientpackages = trg_sum_clientpackages - 1 WHERE client = DEL.clientname;"

# if [ -n "$oldversionint" ] && [ $oldversionint -lt 173101041 ]
# then
# 	/m23/bin/m23cli.php PKG_recountAllClientPackages
# fi

updateSQLIfOlder $oldversionint 181101085 "CREATE TABLE monitors ( vendor varchar(255) NOT NULL COMMENT 'Vendor name', model varchar(255) NOT NULL COMMENT 'Model name' ) ENGINE=MyISAM DEFAULT CHARSET=latin1;"
updateSQLIfOlder $oldversionint 181101085 "ALTER TABLE monitors ADD PRIMARY KEY (vendor,model);"

if [ -n "$oldversionint" ] && [ $oldversionint -lt 191101276 ]
then
	/m23/bin/mkCert.sh renewServerCert
fi

# Create table for group settings
updateSQLIfOlder $oldversionint 201101353 "CREATE TABLE groupSettings ( id int(11) NOT NULL, groupid int(11) NOT NULL, type int(11) NOT NULL, var varchar(200) NOT NULL, val longtext NOT NULL ) ENGINE=MyISAM DEFAULT CHARSET=latin1;"
updateSQLIfOlder $oldversionint 201101353 "ALTER TABLE groupSettings ADD PRIMARY KEY (id);"
updateSQLIfOlder $oldversionint 201101353 "ALTER TABLE groupSettings MODIFY id int(11) NOT NULL AUTO_INCREMENT;"
updateSQLIfOlder $oldversionint 201101353 "ALTER TABLE groupSettings ADD UNIQUE( groupid, type, var);"

# Add fields for adding and finish times to the clientjobs table.
updateSQLIfOlder $oldversionint 201101353 "ALTER TABLE clientjobs ADD addtime INT(10) NOT NULL AFTER installedSize, ADD finishtime INT(10) NOT NULL, ADD starttime INT(10) NOT NULL DEFAULT '0';"

# Add a field to store the timestamp of the reboot of the client, that became necessary because of newly installed Debian packages.
updateSQLIfOlder $oldversionint 201101353 "ALTER TABLE clients ADD rebootAfterJobsStarted INT(10) NOT NULL AFTER autoUpdate_fails;"

# Create table for client reports
updateSQLIfOlder $oldversionint 201101353 "CREATE TABLE clientreporting ( id int(11) NOT NULL, reportCreationTime int(10) NOT NULL, client varchar(512) COLLATE latin1_general_ci NOT NULL, packageamount int(10) NOT NULL, onlinestatus tinyint(1) NOT NULL, rebootstatus tinyint(1) NOT NULL, updatestatus tinyint(1) NOT NULL, lastupdate int(10) NOT NULL ) ENGINE=MyISAM DEFAULT CHARSET=latin1 COLLATE=latin1_general_ci;"
updateSQLIfOlder $oldversionint 201101353 "ALTER TABLE clientreporting ADD PRIMARY KEY (id), ADD KEY id (id,reportCreationTime,client);"

# Create table clientkvstore
updateSQLIfOlder $oldversionint 201101380 "CREATE TABLE IF NOT EXISTS clientkvstore ( client varchar(255) CHARACTER SET latin1 NOT NULL, UNIQUE KEY client (client) ) ENGINE=MyISAM DEFAULT CHARSET=latin1 COLLATE=latin1_general_ci;"
updateSQLIfOlder $oldversionint 201101380 "GRANT ALTER ON m23.clientkvstore TO 'm23dbuser'@'localhost';"

/m23/bin/m23cli.php POSTINST_migrateKeyValueStore

# Add a new table row for storing the serial (eg inventary number) of a client
updateSQLIfOlder $oldversionint 211101440 "ALTER TABLE clients ADD serial VARCHAR(255) NOT NULL AFTER rebootAfterJobsStarted;"

# Add a new table row for storing the school the client belongs to
updateSQLIfOlder $oldversionint 211101440 "ALTER TABLE clients ADD school VARCHAR(255) NOT NULL AFTER serial;"

# Add default values for many columns
updateSQLIfOlder $oldversionint 221101546 "ALTER TABLE PHPObjectStorage ALTER ident SET DEFAULT '';"
updateSQLIfOlder $oldversionint 221101546 "ALTER TABLE PHPObjectStorage ALTER class SET DEFAULT '';"
updateSQLIfOlder $oldversionint 221101546 "ALTER TABLE PHPObjectStorage ALTER last_modified SET DEFAULT 0;"
updateSQLIfOlder $oldversionint 221101546 "ALTER TABLE autoUpdateSchedule ALTER startsEnds SET DEFAULT '';"
updateSQLIfOlder $oldversionint 221101546 "ALTER TABLE autoUpdateSchedule ALTER groups SET DEFAULT '';"
updateSQLIfOlder $oldversionint 221101546 "ALTER TABLE autoUpdateSchedule ALTER type SET DEFAULT '';"
updateSQLIfOlder $oldversionint 221101546 "ALTER TABLE autoUpdateSchedule ALTER parallelUpdates SET DEFAULT 0;"
updateSQLIfOlder $oldversionint 221101546 "ALTER TABLE autoUpdateSchedule ALTER active SET DEFAULT 0;"
updateSQLIfOlder $oldversionint 221101546 "ALTER TABLE autoUpdateSchedule ENGINE = MyISAM;"
updateSQLIfOlder $oldversionint 221101546 "ALTER TABLE billMails ALTER date SET DEFAULT '';"
updateSQLIfOlder $oldversionint 221101546 "ALTER TABLE billMails ALTER user SET DEFAULT '';"
updateSQLIfOlder $oldversionint 221101546 "ALTER TABLE billMails ALTER status SET DEFAULT 0;"
updateSQLIfOlder $oldversionint 221101546 "ALTER TABLE clientjobs ALTER addtime SET DEFAULT 0;"
updateSQLIfOlder $oldversionint 221101546 "ALTER TABLE clientpackages ALTER status SET DEFAULT '';"
updateSQLIfOlder $oldversionint 221101546 "ALTER TABLE clientpackages ALTER action SET DEFAULT '';"
updateSQLIfOlder $oldversionint 221101546 "ALTER TABLE clientreporting ALTER reportCreationTime SET DEFAULT 0;"
updateSQLIfOlder $oldversionint 221101546 "ALTER TABLE clientreporting ALTER client SET DEFAULT '';"
updateSQLIfOlder $oldversionint 221101546 "ALTER TABLE clientreporting ALTER packageamount SET DEFAULT 0;"
updateSQLIfOlder $oldversionint 221101546 "ALTER TABLE clientreporting ALTER onlinestatus SET DEFAULT 0;"
updateSQLIfOlder $oldversionint 221101546 "ALTER TABLE clientreporting ALTER rebootstatus SET DEFAULT 0;"
updateSQLIfOlder $oldversionint 221101546 "ALTER TABLE clientreporting ALTER updatestatus SET DEFAULT 0;"
updateSQLIfOlder $oldversionint 221101546 "ALTER TABLE clientreporting ALTER lastupdate SET DEFAULT 0;"
updateSQLIfOlder $oldversionint 221101546 "ALTER TABLE clients ALTER client SET DEFAULT '';"
updateSQLIfOlder $oldversionint 221101546 "ALTER TABLE clients ALTER mac SET DEFAULT '';"
updateSQLIfOlder $oldversionint 221101546 "ALTER TABLE clients ALTER language SET DEFAULT '';"
updateSQLIfOlder $oldversionint 221101546 "ALTER TABLE clients ALTER vmVisualPassword SET DEFAULT '';"
updateSQLIfOlder $oldversionint 221101546 "ALTER TABLE clients ALTER vmVisualURL SET DEFAULT '';"
updateSQLIfOlder $oldversionint 221101546 "ALTER TABLE clients ALTER autoUpdate_gotJob SET DEFAULT 0;"
updateSQLIfOlder $oldversionint 221101546 "ALTER TABLE clients ALTER autoUpdate_fails SET DEFAULT 0;"
updateSQLIfOlder $oldversionint 221101546 "ALTER TABLE clients ALTER rebootAfterJobsStarted SET DEFAULT 0;"
updateSQLIfOlder $oldversionint 221101546 "ALTER TABLE clients ALTER serial SET DEFAULT '';"
updateSQLIfOlder $oldversionint 221101546 "ALTER TABLE clients ALTER school SET DEFAULT '';"
updateSQLIfOlder $oldversionint 221101546 "ALTER TABLE debconf ALTER client SET DEFAULT '';"
updateSQLIfOlder $oldversionint 221101546 "ALTER TABLE debconf ALTER package SET DEFAULT '';"
updateSQLIfOlder $oldversionint 221101546 "ALTER TABLE debconf ALTER type SET DEFAULT '';"
updateSQLIfOlder $oldversionint 221101546 "ALTER TABLE debconf ALTER var SET DEFAULT '';"
updateSQLIfOlder $oldversionint 221101546 "ALTER TABLE groupSettings ALTER groupid SET DEFAULT 0;"
updateSQLIfOlder $oldversionint 221101546 "ALTER TABLE groupSettings ALTER type SET DEFAULT 0;"
updateSQLIfOlder $oldversionint 221101546 "ALTER TABLE groupSettings ALTER var SET DEFAULT '';"
updateSQLIfOlder $oldversionint 221101546 "ALTER TABLE i18n ALTER ShortLanguage SET DEFAULT '';"
updateSQLIfOlder $oldversionint 221101546 "ALTER TABLE i18n ALTER LongLanguage SET DEFAULT '';"
updateSQLIfOlder $oldversionint 221101546 "ALTER TABLE i18n ALTER country SET DEFAULT '';"
updateSQLIfOlder $oldversionint 221101546 "ALTER TABLE i18n ALTER lang SET DEFAULT '';"
updateSQLIfOlder $oldversionint 221101546 "ALTER TABLE i18n ALTER keymap SET DEFAULT '';"
updateSQLIfOlder $oldversionint 221101546 "ALTER TABLE i18n ALTER xkeyboard SET DEFAULT '';"
updateSQLIfOlder $oldversionint 221101546 "ALTER TABLE i18n ALTER kdekeyboard SET DEFAULT '';"
updateSQLIfOlder $oldversionint 221101546 "ALTER TABLE i18n ALTER locale SET DEFAULT '';"
updateSQLIfOlder $oldversionint 221101546 "ALTER TABLE i18n ALTER kdekeyboards SET DEFAULT '';"
updateSQLIfOlder $oldversionint 221101546 "ALTER TABLE i18n ALTER timezone SET DEFAULT '';"
updateSQLIfOlder $oldversionint 221101546 "ALTER TABLE i18n ALTER packagelang SET DEFAULT '';"
updateSQLIfOlder $oldversionint 221101546 "ALTER TABLE statusbar ALTER type SET DEFAULT '';"
updateSQLIfOlder $oldversionint 221101546 "ALTER TABLE statusbar ALTER client SET DEFAULT '';"
updateSQLIfOlder $oldversionint 221101546 "ALTER TABLE statusbar ALTER name SET DEFAULT '';"
updateSQLIfOlder $oldversionint 221101546 "ALTER TABLE statusbar ALTER percentpoint SET DEFAULT 1;"

######################
# DB adjustments END #
######################


updateDB

# Make sure, the Apache user gets a shell. Needed for sudo by www-data otherwise the '-i' in SERVER_runInBackground need to be removed
chsh -s /bin/sh www-data

#Adjust the ramdisk sizes of all PXE settings
/m23/bin/fixRamdisksize

# Disable Apparmor for the DHCP server
if [ -f /etc/apparmor.d/usr.sbin.dhcpd ] && [ ! -f /etc/apparmor.d/disable/usr.sbin.dhcpd ]
then
	aa-disable /etc/apparmor.d/usr.sbin.dhcpd
fi

restartDHCPServer


mkdir -p /m23/tmp /m23/log

/m23/bin/fix-permissions
if [ -e /m23/data+scripts/clientImages ]
then
	chown www-data /m23/data+scripts/clientImages
	chmod 755 /m23/data+scripts/clientImages
fi


chown www-data:www-data /m23/data+scripts/packages/userPackages /m23/log
mkdir -p /m23/var/cache/m23apt
chown www-data:www-data /m23/var/cache/m23apt /m23/tmp /m23/tftp/pxelinux.cfg
chmod 755 /m23/log

touch /m23/dhcp/dhcpd.leases

mkdir -p /m23/root-only
chmod 700 /m23/root-only

rm -r /tmp/m23-install 2> /dev/null

# Make sure the www-data user has a normal login (needed for sudo, e.g. package index creation)
usermod -s /bin/bash www-data

rpw="$(cat /dev/urandom | tr -dc A-Za-z0-9 | dd bs=64 count=1 2> /dev/null)"
# Set a random password
usermod -p $rpw www-data

#Make sure that there is no user test
userdel -r -f test 2> /dev/null





# Write the GPG sign keys to a (temporary) file
echo '-----BEGIN PGP PUBLIC KEY BLOCK-----

mQINBGfCZyMBEADM9iyP0+uTEawm5lYsLG9TsBXxIT0569TcGzz0wMIRaV4lCllM
BfsNFMGsmEIg0zOWhYthm56MCC8DtHu60xVY7jXs1epgOjusiupLm6n31m0zc6La
dBmxqo4un0D1kOSIqyxBwCOl4Yn0iR2Wg72eVgxVRQx49suln7zYb/3GveUS5Uw7
g8rx+voynlvoDW2h268p+Bwsx5iX3Ts6DCAXm0ZP7DeidoqVNLM9V7Ut83N11qp/
bhRGJ4KioemERujrEa6VI3TXglSBNwRz7WlB0CGwJr4gUiR7aGSP3JzppJLkGrYE
OIOMaj3EdDijMDlmK8B4FfGjP6knxhWF0qoOlwpR3lBiMvEdXaahcv9q8JITChh0
crH+Y2AFZBd7npc8j9FbgI+JgKD8YBYbAzjDVpFneD/e8IE9hM4qg0NDA7D7PUTm
ZtUXIcS/KmJDBAuG4go7U7WCRYbvHOkAsZlK7BdHljAuWqzIq2T/kEf+fVq2jMZF
OxOgaIGnra7/EOgPmvvycORtezdX4cCx5TOzmPd1P9Ukoh7Eafv/CTN2+i+fmBEY
8MnHq+hoOdKxAi9IUCSSjxnwaErUGzhxmFdbSp96H5IoICh11JthQ3L3KIVpQ/Wm
NHrQev4mmD77UCEGIhyMcodeXvBZjOHIjGsQ8arRzpe2KYjK0/SYqFrFwwARAQAB
tEtIYXVrZSBHb29zLUhhYmVybWFubiAoZU1haWwtIHVuZCBQYWtldHNpZ25pZXJ1
bmcpIDxoYXVrZUBnb29zLWhhYmVybWFubi5kZT6JAkcEEwEKADECGwMCHgECF4AW
IQSSzyqMHbMfOlaanzHuJlY5lnV62QUCZ8JoMwILCQMVCggDFgMCAAoJEO4mVjmW
dXrZXXIQAMOBcv37w0eJkgEu8ns3sXD+CQU769Q3EyAkTGnyjEpxQ3W+6SGB/15w
oskHUHST7b5/RD9gybXiM/6AiL1Y0NezErPFZ/nTHqxI8HMIAd3ZwTynJ5uCovAn
mXOhF+7PIztPYD92NdQcC3Futpqdg1Zh4pFIgTWVzBm5x+VAcwtMCHUlx5URkUTw
82stcgb40XYN7Qc9vFAy+ptQlWiT7VCdDTuH8Pggplmi8mystgGogRC+3cW7XzJR
JDdoxPQH6q8io1ROAWOtrSVRF2R7ofukUAK7YXdsLVchA3rhApf9eEXKU8YhVE7u
Z99ELOvUKzwiZvilUp5pK7fft5u8BFoCmGFvKw0ODtOW2ck+qnuSMbJfeK1niRRE
kBCx0EuK1ySGyOLSOkY4yUndqORD0/bVINj2jiHe/87U4sCbSUM4PoJ7chcwq1br
7rRUTMUaOI0N/QkbWNVXuvanFdDsIY0ecdkzMijMa1naRUJpNY1ccKMPJx6ZRiBS
cCPQ/z39jBlbLVLA5bV03iQhPwpDqzlW0AUINETE4ukJKtjk1PADtkDrRizWstfC
n91NIhsrnoPrbFg9mjuwgcieQbgYqzjyKN2bw0jvuF+FBFViue8OOy6CTitAEMo5
ZQ+jRH+fbvreMGm8g5Ecl8E8L0mJRKwDOpNgCRhiVO1z5oS8c53auQINBGfCZyMB
EADdTQFIID7WKWkqHQ7l5UNLIcnizq+HZ8NqqoL87PmFPQKsA9/NA+dwDIAyNsgn
wjTWWlec99/E4gQaCGBiN7TZHy2x7oSbb+DuzJ8LbtreiyZg05vHzBao9+pah5db
aSPnVYfNUuzIzDfeH4rjHjDbKNUCKbuyZMk0UdHmWOK8W/Bv1/VdlIdDL0cGBYaY
G7FHRZGuFgxVO3kF0OI4a50VIAMfl/HO1MparZzV+rGcO0wkDYhksGy0VbmHXXpj
KHR0E0cyaKLj2x9+YOebpi+JwgJKF2jyX/TnLOmLMC14bcJe1jD/osthORXOrwM/
MXkjw/eXB8mVKaR2ysrQYcIoDsrfVodqJghpI3HAhugoVkWKf0Orsz5QPOO+fnYq
8Bbtg+k5VS5rM3CAdboZPHYs4iKk0SDx+t/i6GHAe/++RdWwwoaEfo1C/Ej6WN1W
Ahv0YtuVztcoFnkBDD8lVBJJnZroItI1vhvpckgts8ZHkKAIiQpDc6xobEaj8Pw3
Phz5WE6uQRlJVZlRqHzt7f2iJ+nRoSuLNzeF9tNYS3jMu7K4lTwrWJ37bNZvJd2X
S9Jsz/bFLrDMBzbZmI5r6yhnUTgquR+wNjKImxvs/BlOkeO+n6Rbw3b5zqZoXxhG
ZTqX3tCr3KY64E7wkBOGjg8+6fVx7is2RpNlPnJTzu37qQARAQABiQI2BBgBCgAg
FiEEks8qjB2zHzpWmp8x7iZWOZZ1etkFAmfCZyMCGwwACgkQ7iZWOZZ1etl5ug/+
LOMAsFY+83v5qrrcBIPZQy/dttfXlutPKcBcoJmoEAvkhwGPbby15z3XYxQHrptc
idF8ZJgoOSBp2rkpQ1HvsGMmYD1ziok+J5SZsZlNgibshMHu08nn0XqmMRAFedk+
5RZSAKxl6oz+dBdhh0NNxGkqRVunb99i+xc4gvoeN0qI1hkx1zjG8Ki2gZHgDJ8x
JdRhXDRf65BjN0US1hovudK7H5bi1R6xzNQW9FEF9/XPPkgdLEVYMrf+jhz1e/zs
xApPLesPJREFW2dUIWWeWE5whtUUItjvO2CnaA/MJbkKizzninAwp2230CH290Yp
7ktAZFGL9yjPOckn10/Nfcc/sf6IKzOvDZzAXQaFvDlT5jF4IZxfACb4exsrzWKz
1I80E/7BhL7Pnztzh5YDcs2IhayJTX2f6YLViyhkKZfmhAlGO/jf25nv7ncllW3q
M9L64ni7kdoyylcux1jWh7YIX92k6FqRAm38/IZTpRGZ1Qi7mkIfb5wj7HX/XY0s
TGPwleEOZ/PH4RLVAFsKvqqbraQsou3WpxS08PgN2fmqC4JaU7xD7V35WSRFG9sn
M1kONXLyi4z+5OMwkH0EOByiQQo1gGK/QFKAfvCnAa/O/jSB6kgxvZ8MUQs5k0rW
R57fidKdC0DI5zIy4364rowt6vSkPaaS+BXQ6RPWUGE=
=liY8
-----END PGP PUBLIC KEY BLOCK-----

-----BEGIN PGP PUBLIC KEY BLOCK-----

mQGiBEwuMUIRBACN93T2CuB3g1jWnhNqsYgyKA7S5kiXSThxW/IvNU9s0R473ugA
4D9r6YkP0ViKoUbgySs43550OUXUifuwquAs4vrg1mNSuP7WnqEHkrGuWFWTpRLk
ASYKsjze/ehSMEb4BgHp8ZNxh1M0PPu7xZPGzLBaeUKvdyuAhT87ONeUrwCgmZCm
Dn85NDtxt/qhvtI/iWMGNssD/1rWT4hptRAyvRaIvvzIqnRhc3LQ9Z/nrnyhJ1hw
nz1BtHWb43g0SZOeuuHF2LqmTqQcPZ5N4eeOtPxYbXbGPHZ6UQSg+lwZz7skyApL
nDwFpSrNVewp6h0mlKgBku9l76dx7cbyfJC4ZKG6YTbzWb8VdjHZmmrnrxSCZMMt
xR2GA/9MyiSyhZchcoSHuq/0FsT8zFDJLkRyu0nKv4+kBCDPiR4WFmvTM9w7J/nW
2EoQuR+rdfnzUIegxLq51Q8RuKa56nf/EYlkNtVb7AgGmIsUu3ry2HssbycBn8n/
8rje2oULWCLKKIMpeop/t62jcUFtn6G+m+Ge1L9f58YBLa0zHrRBSGF1a2UgR29v
cy1IYWJlcm1hbm4gKFBhY2thZ2UgU2lnbiBLZXkpIDxoYXVrZUBnb29zLWhhYmVy
bWFubi5kZT6IYAQTEQIAIAUCTC4xQgIbIwYLCQgHAwIEFQIIAwQWAgMBAh4BAheA
AAoJEMbwkT0zBeY6JAoAoJOX2nzSfJJW+K23N0yZ6mBpnVdtAJ9jDBGjlkx/9gxM
S729jmJAh5OIBbkEDQRMLjFCEBAAh9DE+rnYwOfJeU9FMGG+145GTzdg+x35oAmX
EMvlVEvYocHymlO3+Co87DqxKIWiytnxr6VrgyClI/jKmkfXBm14i/4rutd69/s9
qCEwnAE1rkIZ/2k8FXgROtNVy8yy6kPQ72m+36OvxdhhqA07EA1hgOLKrP0RqtSN
PGlYgkEsY5ZZgu0PZgE1d/nkJqJ1rbfpA80wgTgjwAflnjLMCs8GWKgxEJcGU/mm
NpQ5hs8xGCdzZR67RkifTKu5dUbiUWo0zmXA8qHBSFHDwSoZMID70qFIrfoND+R0
ofKXa/KaxEvewKuK7ziGWGTcQzGF+2ABGHXcMf1EitWtOjeIhvULv3Xq/hNKg18R
INDLNEk+7A1+GRGN40cm5ki8iabw3cur5vkut2lXU6IwGamtslt8hu66Pve6YEUp
DK8SFgSSXr98UMLpzn1VoYD0LBTkPHEXbxaDa53GT8kBTRlz0QLmO0RDomBe5fcZ
t3eOqQyC8pPzD2JxjwojxWN8iiieyZRN5grNXSD1J3+J/gzQsFbKhHWyivXHv8sS
eRT5ZFNY6ujdPc/1NlU0uZISaWHrlK79ktudrdbr0OIxEoPG2iqEBdh4sksdlY8C
uIWnxqFndltu5A5IqXtojU9CpgYS+89Jhm3YBZk0GOQPNBZtmQSRTYpneq5uKXqy
iLHwNdsAAwUP/RThtSUwlWbwqC2r5b+dYemUN643dV20gH0699EmLsNqKDSKZkPP
DUGDlK3irLX0O+B4HE9WxGPESKcMyCfLLGBTuPpuqhK9CGWXhX27tkMAP+yhyCXS
mFlizbt0Egbk9NnMzQp3Uw5cVqTNtqYN9CN99VM/69GIvfkciMQZiNwLyWS16ZH9
VBqH8GqvK7cnsi4/kSW83YM/x8dhfXOL6id0Za8BXeGOXKrPVj1W2RPanjJU6xDD
BK1B3beS1aliFmd/njntr5AdI9yHUwGB+JlrPE/XT67vXtRj9vRMkcZbOGrrJQMm
j0BKFo3kDTNrTDZWkrSxfBW7WtrdS70U7qLG4kNPaAb/w4nLmSox53YLSVAATdEQ
KfYMMfimPjjbff2RHk6Uo24pentYRWqbDMsKD7E0YOcmWwfnnbFoomFim+uqCVXn
aXtt10ItgrM+bgn7jM8l5qelLK2EEnqaUf9k4ktaGUqjFKxM4haeVHaodO6fTykb
pMEBa35uGOczUI5r6lrHWaH7u5rWAfu7bxwrahJmfwYiQuytFfuWCFkiW2P3cHHe
fym396mxY7vmMAQwy8dOz2tGNgtW6XEif/9wchHbnQiueFR879Yn3Ea9zlQ7mVl3
mJ+ZuWfXJx5AK0I83ZUs/WjM76/E4jwV1HvNkxFwPpAz43gOPg+EFmx9iEkEGBEC
AAkFAkwuMUICGwwACgkQxvCRPTMF5jpqNwCeN0zq2If+2CQj0JOiX3hr5rgMg+sA
n1eZ5Xt92BHoJ7qoOiP+TiLO57T6
=Du7O
-----END PGP PUBLIC KEY BLOCK-----' > /tmp/m23.asc


# Delete old sources list file
if [ -f /etc/apt/sources.list.d/m23.list ]
then
	rm /etc/apt/sources.list.d/m23.list
fi


# Check, if the directory for storing the GPG sign keys is present
if [ -d /etc/apt/trusted.gpg.d ]
then
	# Remove the old signing key from the old key ring
	if [ $(apt-key finger 2> /dev/null | grep '3305 E63A' -c) -gt 0 ]
	then
		apt-key del '0x3305E63A'
	fi

	# New method with GPG sign key in directory
	###########################################

	# Move the key to the correct destination
	mv /tmp/m23.asc /etc/apt/trusted.gpg.d

	# Add package sources list for release packages with sign key
	echo 'deb [signed-by=/etc/apt/trusted.gpg.d/m23.asc] http://m23inst.goos-habermann.de ./' > /etc/apt/sources.list.d/m23.list
else
	# Old method with importing thenGPG sign key
	############################################

	apt-key add /tmp/m23.asc

	# Add package sources list for release packages
	echo 'deb http://m23inst.goos-habermann.de ./' > /etc/apt/sources.list.d/m23.list
fi





#Create the extraDebs directory with empty indices if it doesn't exist.
if [ ! -f /m23/data+scripts/extraDebs/Packages.gz ]
then
	mkdir -p /m23/data+scripts/extraDebs/

	cd /m23/data+scripts/extraDebs/
	touch Packages
	gzip -c Packages > Packages.gz
	bzip2 -k Packages

	chmod 777 -R /m23/data+scripts/extraDebs
fi

grep "`cat ~/.ssh/id_rsa.pub 2> /dev/null`" ~/.ssh/authorized_keys -c 2> /dev/null
if [ $? -ne 0 ]
then
	cat ~/.ssh/id_rsa.pub 2> /dev/null >> ~/.ssh/authorized_keys
fi


#Fix /etc/sudoers, if there are more than one entry for grdmgpg
grdmAmount=$(grep -c grdmgpg /etc/sudoers)
if [ $grdmAmount -gt 1 ]
then
	awk -vAM=$grdmAmount '
	BEGIN { cnt=1 }
	/grdmgpg/ {
		if (cnt < AM)
		{ cnt++; next}
	}
	{ print }
	' /etc/sudoers > /tmp/sudoers
	cat /tmp/sudoers > /etc/sudoers
fi

# Needed on Debian 8
restartSQLServer

# Start MySQL/MariaDB server without init system
# if [ $(ps -A | grep mysql -c) -eq 0 ]
# then
# 	/usr/sbin/mysqld &
# 	sleep 5
# fi


# MariaDB 10.3/10.5 (Debian 10/11) needs additional parameters to accept INSERTs without setting all values on tables with fields that have no explicit default value
# old check: mysql --version | egrep '10\.3\.[0-9]+-MariaDB' -c
if [ $(mysql --version | grep -i MariaDB -c) -gt 0 ] && [ -d /etc/mysql/mariadb.conf.d ]
then
	# Get MariaDB version
	ver="$(dpkg -s mariadb-server | grep 'Version:' | sed -e 's/.*://' -e 's/-.*//')"
	
# 	if [ dpkg --compare-versions $ver le 10.11.0 ]
# 	then
		# Fix for server part (mysqld)
			if [ ! -f /etc/mysql/mariadb.conf.d/99-server_added_by_m23.cnf ]
			then
				cat >> /etc/mysql/mariadb.conf.d/99-server_added_by_m23.cnf << "EOF"
[server]
sql_mode = NO_ENGINE_SUBSTITUTION
EOF
			fi

		# Fix for client part (mysql)
			if [ ! -f /etc/mysql/mariadb.conf.d/99-client_added_by_m23.cnf ]
			then
				cat >> /etc/mysql/mariadb.conf.d/99-client_added_by_m23.cnf << "EOF"
[client]
init-command="set sql_mode='NO_ENGINE_SUBSTITUTION'"
EOF
			fi
		
		# Fix for systems that upgraded from MySQL and aren't configured to read files from /etc/mysql/mariadb.conf.d
			if [ -d /etc/mysql/conf.d ]
			then
				ln -s /etc/mysql/mariadb.conf.d/99-client_added_by_m23.cnf /etc/mysql/conf.d
				ln -s /etc/mysql/mariadb.conf.d/99-server_added_by_m23.cnf /etc/mysql/conf.d
			fi
# 	fi

	restartSQLServer
fi



postinstHook='/m23/bin/postinstHook.sh'
if [ -f $postinstHook ]
then
	bash $postinstHook
fi

if [ -f /tmp/squidName ] && [ $(grep -c 'Port:2323' /etc/apt-cacher-ng/acng.conf) -eq 0 ]
then
	# Restart Squid as long until it is availabe via port 2323
	sRet=1
	while [ -f /tmp/squidName ] && [ $sRet -ne 0 ] && [ ! -e /tmp/oldsys ]
	do
		/etc/init.d/$(cat /tmp/squidName) restart 2>> /var/log/m23PostinstNonCriticalErrorMessages.log
		sleep 60
		http_proxy="http://127.0.0.1:2323" wget http://127.0.0.1 -O /dev/null -q
		sRet=$?
	done
fi



# Activated "DontCache" options seems to produce broken downloads, that will let APT download a package in a loop
if [ $(grep '^DontCache' /etc/apt-cacher-ng/acng.conf -c) -gt 0 ]
then
	sed -i "s/^DontCache: $IPINT/#DontCache: $IPINT/" /etc/apt-cacher-ng/acng.conf
	/etc/init.d/apt-cacher-ng restart
fi


mkdir -p /m23/m23customPatch
cd /m23/m23customPatch
if [ $(ls | wc -l) -gt 0 ]
then
	ls | xargs -n1 /m23/bin/m23customPatch.php
fi

chmod 777 -R /m23/tmp

/m23/bin/m23cli.php GPG_set1stKey


# Restart Apache on Raspbian a 2nd time (seems to be needed on newer Raspbian versions to disable PrivateTmp)
if [ `grep -c Raspbian /etc/issue` -eq 0 ]
then
	/etc/init.d/apache2 restart
fi

# Disable complaining about disabled Wi-Fi on login. The message will confuse some m23 functions that login via SSH
if [ -f /etc/profile.d/wifi-check.sh ]
then
	mv /etc/profile.d/wifi-check.sh /etc/profile.d/wifi-check.sh.disabled
fi

if [ $(UCS_detect) -ne 0 ] && ! /m23/bin/isLibreworkspace
then
	/m23/bin/enable-LDAP-TLS
fi

# Make SSL server key readable for openldap
if [ -f /etc/apache/m23/server.key ]
then
	chmod 640 /etc/apache/m23/server.key
	chgrp openldap /etc/apache/m23/server.key
fi

# Start fixes for Debian 11 that require access to APT
#screen -dmS fixDebian11 /m23/bin/fixDebian11.sh


# Make sure /etc/dhcp/dhcpd.conf is a hardlink /etc/dhcp/dhcpd.conf
#rm /etc/dhcp/dhcpd.conf
#ln /etc/dhcp/dhcpd.conf /etc/dhcp/dhcpd.conf


# Upgrade the MariaDB database structure (if necessary)
mv /etc/mysql/mariadb.conf.d/99-client_added_by_m23.cnf /etc/mysql/mariadb.conf.d/99-client_added_by_m23.cnf.raus
mv /etc/mysql/mariadb.conf.d/99-server_added_by_m23.cnf /etc/mysql/mariadb.conf.d/99-server_added_by_m23.cnf.raus
restartSQLServer
mysql_upgrade $(/m23/bin/serverInfoMySQLAccessParams) &>> /var/log/m23PostinstNonCriticalErrorMessages.log
mv /etc/mysql/mariadb.conf.d/99-client_added_by_m23.cnf.raus /etc/mysql/mariadb.conf.d/99-client_added_by_m23.cnf
mv /etc/mysql/mariadb.conf.d/99-server_added_by_m23.cnf.raus /etc/mysql/mariadb.conf.d/99-server_added_by_m23.cnf
restartSQLServer

if [ $(grep 'authoritative;' -c /etc/dhcp/dhcpd.conf) -eq 0 ]
then
	sed -i 's/ddns-update-style none;/ddns-update-style none;\nauthoritative;/' /etc/dhcp/dhcpd.conf
	restartDHCPServer
fi


# ISO-8859-1 to UTF-8
sed -i '/ISO-8859-1/d' /etc/apache2/sites-enabled/m23.conf

# Fix ownership (just in case)
chown -R www-data:www-data /var/lib/php

db_stop