#!/usr/bin/env bash
#
# Copyright 2016 Confluent Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

. /etc/confluent/docker/bash-config

# --- for broker

# Ensure KAFKA_PROCESS_ROLES and CLUSTER_ID 
ub ensure KAFKA_PROCESS_ROLES
ub ensure CLUSTER_ID

# unset KAFKA_ADVERTISED_LISTENERS from ENV in KRaft mode when running as controller only
if [[ $KAFKA_PROCESS_ROLES == "controller" ]]
then
  if [[ -n "${KAFKA_ADVERTISED_LISTENERS-}" ]]
  then
    echo "KAFKA_ADVERTISED_LISTENERS is not supported on a KRaft controller."
    exit 1
  else
    unset KAFKA_ADVERTISED_LISTENERS
  fi
else
  ub ensure KAFKA_ADVERTISED_LISTENERS
fi 

# By default, LISTENERS is derived from ADVERTISED_LISTENERS by replacing
# hosts with 0.0.0.0. This is good default as it ensures that the broker
# process listens on all ports.
if [[ -z "${KAFKA_LISTENERS-}" ]] && [[ $KAFKA_PROCESS_ROLES != "controller" ]]
then
  export KAFKA_LISTENERS
  KAFKA_LISTENERS=$(echo "$KAFKA_ADVERTISED_LISTENERS" | sed -e 's|://[^:]*:|://0.0.0.0:|g')
fi

ub path /etc/kafka/ writable

if [[ -z "${KAFKA_LOG_DIRS-}" ]]
then
  export KAFKA_LOG_DIRS
  KAFKA_LOG_DIRS="/var/lib/kafka/data"
fi

# advertised.host, advertised.port, host and port are deprecated. Exit if these properties are set.
if [[ -n "${KAFKA_ADVERTISED_PORT-}" ]]
then
  echo "advertised.port is deprecated. Please use KAFKA_ADVERTISED_LISTENERS instead."
  exit 1
fi

if [[ -n "${KAFKA_ADVERTISED_HOST-}" ]]
then
  echo "advertised.host is deprecated. Please use KAFKA_ADVERTISED_LISTENERS instead."
  exit 1
fi

if [[ -n "${KAFKA_HOST-}" ]]
then
  echo "host is deprecated. Please use KAFKA_ADVERTISED_LISTENERS instead."
  exit 1
fi

if [[ -n "${KAFKA_PORT-}" ]]
then
  echo "port is deprecated. Please use KAFKA_ADVERTISED_LISTENERS instead."
  exit 1
fi

# Set if ADVERTISED_LISTENERS has SSL:// or SASL_SSL:// endpoints.
if [[ -n "${KAFKA_ADVERTISED_LISTENERS-}" ]] && [[ $KAFKA_ADVERTISED_LISTENERS == *"SSL://"* ]]
then
  echo "SSL is enabled."

  ub ensure KAFKA_SSL_KEYSTORE_FILENAME
  export KAFKA_SSL_KEYSTORE_LOCATION="/etc/kafka/secrets/$KAFKA_SSL_KEYSTORE_FILENAME"
  ub path "$KAFKA_SSL_KEYSTORE_LOCATION" existence

  ub ensure KAFKA_SSL_KEY_CREDENTIALS
  KAFKA_SSL_KEY_CREDENTIALS_LOCATION="/etc/kafka/secrets/$KAFKA_SSL_KEY_CREDENTIALS"
  ub path "$KAFKA_SSL_KEY_CREDENTIALS_LOCATION" existence
  export KAFKA_SSL_KEY_PASSWORD
  KAFKA_SSL_KEY_PASSWORD=$(cat "$KAFKA_SSL_KEY_CREDENTIALS_LOCATION")

  ub ensure KAFKA_SSL_KEYSTORE_CREDENTIALS
  KAFKA_SSL_KEYSTORE_CREDENTIALS_LOCATION="/etc/kafka/secrets/$KAFKA_SSL_KEYSTORE_CREDENTIALS"
  ub path "$KAFKA_SSL_KEYSTORE_CREDENTIALS_LOCATION" existence
  export KAFKA_SSL_KEYSTORE_PASSWORD
  KAFKA_SSL_KEYSTORE_PASSWORD=$(cat "$KAFKA_SSL_KEYSTORE_CREDENTIALS_LOCATION")

  if [[ -n "${KAFKA_SSL_CLIENT_AUTH-}" ]] && ( [[ $KAFKA_SSL_CLIENT_AUTH == *"required"* ]] || [[ $KAFKA_SSL_CLIENT_AUTH == *"requested"* ]] )
  then
      ub ensure KAFKA_SSL_TRUSTSTORE_FILENAME
      export KAFKA_SSL_TRUSTSTORE_LOCATION="/etc/kafka/secrets/$KAFKA_SSL_TRUSTSTORE_FILENAME"
      ub path "$KAFKA_SSL_TRUSTSTORE_LOCATION" existence

      ub ensure KAFKA_SSL_TRUSTSTORE_CREDENTIALS
      KAFKA_SSL_TRUSTSTORE_CREDENTIALS_LOCATION="/etc/kafka/secrets/$KAFKA_SSL_TRUSTSTORE_CREDENTIALS"
      ub path "$KAFKA_SSL_TRUSTSTORE_CREDENTIALS_LOCATION" existence
      export KAFKA_SSL_TRUSTSTORE_PASSWORD
      KAFKA_SSL_TRUSTSTORE_PASSWORD=$(cat "$KAFKA_SSL_TRUSTSTORE_CREDENTIALS_LOCATION")
  fi
  
fi

# Set if KAFKA_ADVERTISED_LISTENERS has SASL_PLAINTEXT:// or SASL_SSL:// endpoints.
if [[ -n "${KAFKA_ADVERTISED_LISTENERS-}" ]] && [[ $KAFKA_ADVERTISED_LISTENERS =~ .*SASL_.*://.* ]]
then
  echo "SASL" is enabled.

  ub ensure KAFKA_OPTS

  if [[ ! $KAFKA_OPTS == *"java.security.auth.login.config"*  ]]
  then
    echo "KAFKA_OPTS should contain 'java.security.auth.login.config' property."
  fi
fi

if [[ -n "${KAFKA_JMX_OPTS-}" ]]
then
  if [[ ! $KAFKA_JMX_OPTS == *"com.sun.management.jmxremote.rmi.port"*  ]]
  then
    echo "KAFKA_OPTS should contain 'com.sun.management.jmxremote.rmi.port' property. It is required for accessing the JMX metrics externally."
  fi
fi


# --- for rest proxy
ub ensure KAFKA_REST_BOOTSTRAP_SERVERS
ub path /etc/kafka-rest/ writable

if [[ -n "${KAFKA_REST_PORT-}" ]]
then
  echo "PORT is deprecated. Please use KAFKA_REST_LISTENERS instead."
  exit 1
fi

if [[ -n "${KAFKAREST_JMX_OPTS-}" ]]
then
  if [[ ! $KAFKAREST_JMX_OPTS == *"com.sun.management.jmxremote.rmi.port"*  ]]
  then
    echo "KAFKA_REST_OPTS should contain 'com.sun.management.jmxremote.rmi.port' property. It is required for accessing the JMX metrics externally."
  fi
fi


# --- for broker
ub render-properties /etc/confluent/docker/kafka-propertiesSpec.json > /etc/kafka/kafka.properties
ub render-template /etc/confluent/docker/kafka-log4j2.yaml.template > /etc/kafka/log4j2.yaml
ub render-template /etc/confluent/docker/kafka-tools-log4j2.yaml.template > /etc/kafka/tools-log4j2.yaml

# --- for rest proxy
ub render-properties /etc/confluent/docker/kafka-rest-propertiesSpec.json > /etc/kafka-rest/kafka-rest.properties
ub render-properties /etc/confluent/docker/admin-propertiesSpec.json > /etc/kafka-rest/admin.properties
ub render-template /etc/confluent/docker/kafka-rest-log4j2.yaml.template > /etc/kafka-rest/log4j2.yaml
