configure

#!/bin/bash

DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
cd "$DIR"

TEMPLATES=($(ls templates/config/config.sh.* | grep -v '.*~'))

#############################################################################3
# Functions
#############################################################################3

. bin/_common.sh

# Check if a docker image exists in the (public) repository
docker_tag_exists()
{
		curl --silent -f -lSL https://hub.docker.com/v2/repositories/$1/tags/$2 > /dev/null 2>&1
}

# Parse a template files
# args: $1 -- template filename
parse_template()
{
	while IFS= read -r line
	do
		# expected format:
		# VAR=VALUE # DOCSTRING
		# the VALUE is eval-ed, so any shell characters should be escaped
		var=${line%=*}

		val=${line#*=}
		val=$(echo "${val%#*}" | sed 's/^[[:blank:]]*//;s/[[:blank:]]*$//' )
		val=$(eval "echo \"$val\"")

		cmt=$(echo "$line" | cut -s -d '#' -f 2- | sed 's/^[[:blank:]]*//;s/[[:blank:]]*$//')

		req=$(echo "$cmt" | grep -q "(REQUIRED)" && echo "1")

		echo "$var|||$val|||$cmt|||$req"
	done < <(grep -E '^[^#]\w+=.*$' $1)
}

# Print usage info
usage()
{
	echo "usage:   $0 --provider=<provider_id> [options]"
	echo

	echo "options:"
	echo
	
	for TEMPLATE in "${TEMPLATES[@]}"; do
		providerid="${TEMPLATE##*.}"
		providername=$(head -n 1 $TEMPLATE | sed 's/^# *//')

		echo "$providername (--provider=$providerid):"
		while IFS= read -r s
		do
			var="${s%%"|||"*}"; s=${s#*"|||"}
			val="${s%%"|||"*}"; s=${s#*"|||"}
			cmt="${s%%"|||"*}"; s=${s#*"|||"}
			req="${s%%"|||"*}"; s=${s#*"|||"}

			printf "    %-45s %s\n" "$(varname_to_option $var)=$val" "$cmt"

#			echo "var=[[$var]] val=[[$val]] cmt=[[$cmt]]"
		done < <(parse_template $TEMPLATE)
		echo
	done
}

# Collect all required options from a template file
add_required()
{
	while IFS= read -r s
	do
		var="${s%%"|||"*}"; s=${s#*"|||"}
		val="${s%%"|||"*}"; s=${s#*"|||"}
		cmt="${s%%"|||"*}"; s=${s#*"|||"}
		req="${s%%"|||"*}"; s=${s#*"|||"}

		if [[ $req == 1 ]]; then
			REQUIRED+=($var)
		fi

	done < <(parse_template $1)
}

check_do_prerequisites()
{
	# see if we have doctl
	hash doctl 2>/dev/null && msg check "  found doctl" || { errmsg "  error: no doctl on path. Install Digital Ocean CLI tools."; exit -1; }

	# see if we're authenticated
	doctl compute droplet list >/dev/null 2>&1 && msg check "  logged into DO" || { errmsg "  error: issues authenticating to Digital Ocean.."; exit -1; }

	# see if the domain has been properly set up
	DOMAIN=$(echo "$HUB_FQDN" | cut -d . -f 2-)
	doctl compute domain records list "$DOMAIN" >/dev/null 2>&1 && msg check "  DO is managing $DOMAIN" || { errmsg "  error: domain not found. Please delegate '$DOMAIN' to DO's DNS service."; exit -1; }
}

check_aws_prerequisites()
{
	# see if we have eksctl
	hash eksctl 2>/dev/null && msg check "  found eksctl" || { errmsg "  error: no eksctl on path. Learn more about installing eksctl at https://eksctl.io/"; exit -1; }

	hash aws 2>/dev/null && msg check "  found aws" || { errmsg "  error: no aws on path. Learn more about installing AWS CLI tools at https://aws.amazon.com/cli/"; exit -1; }
	
	# see if we are authenticated
	aws sts get-caller-identity >/dev/null 2>&1 && msg check "  logged into AWS" || { errmsg "  error: issues authenticating to AWS. Have you configured the AWS CLI with 'aws configure'? Find more information at https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-configure.html"; exit -1; }

	# see if the domain has been properly set up
	DOMAIN=$(echo "$HUB_FQDN" | cut -d . -f 2-)
	output=$(aws --output=json route53 list-hosted-zones | jq --arg DOMAIN "${DOMAIN}." ' .HostedZones | .[] | select(.Name==$DOMAIN) ')
	if [[ -n $output ]]; then
		msg check "  AWS is managing $DOMAIN"
	else
		{ errmsg "  error: domain not found. Please delegate '$DOMAIN' to AWS's Route 53 service."; exit -1; }
	fi
}

check_prerequisites()
{
	[[ $NOCHECKS == 1 ]] && return

	echo "== Checking prerequisites:"
	echo

	# see if we have jq
	hash jq 2>/dev/null && msg check "  found jq" || { errmsg "  error: no jq on path. Install jq."; exit -1; }

	# see if we have kubectl
	hash kubectl 2>/dev/null && msg check "  found kubectl" || { errmsg "  error: no kubectl on path. Install Kuberbetes CLI tools."; exit -1; }

	# see if we have helm
	hash helm 2>/dev/null && msg check "  found helm" || { errmsg "  error: no helm on path. Install Helm CLI tools."; exit -1; }

	# see if we have certbot
	hash certbot 2>/dev/null && msg check "  found certbot" || { errmsg "  error: no certbot on path. Install certbot tools."; exit -1; }

	[[ $PROVIDER == do ]] && check_do_prerequisites
	[[ $PROVIDER == aws ]] && check_aws_prerequisites

	echo
}

############################

gen_proxy_secret()
{
	# don't regenerate if it already exists
	if [[ -f $PREFIX/secrets/proxy.yaml ]]; then
		msg skip "  skipping $PREFIX/secrets/proxy.yaml; already exists."
		return
	fi

	cat > $PREFIX/secrets/proxy.yaml <<-EOF
	proxy:
	  secretToken: "$(openssl rand -hex 32)"
	EOF
	
	msg done "  generated $PREFIX/secrets/proxy.yaml"
}

gen_github_auth()
{
	if [[ -z $GITHUB_OAUTH_CREDS ]]; then
		if [[ -f "$PREFIX/secrets/github-auth.yaml" ]]; then
			rm -f "$PREFIX/secrets/github-auth.yaml"
			echo "disabling GitHub authentication (rerun with --github-oauth-client-id and --github-oauth-secret to re-enable)"
		fi
		return
	fi

	# read the creds from the file
	exec 3<"$GITHUB_OAUTH_CREDS"
	IFS= read -r GITHUB_OAUTH_CLIENT_ID <&3
	IFS= read -r GITHUB_OAUTH_SECRET <&3

	# simple validation
	[[ ${#GITHUB_OAUTH_CLIENT_ID} != 20 ]] && { errmsg "error: GitHub OAuth App Client ID (==$GITHUB_OAUTH_CLIENT_ID) from file $GITHUB_OAUTH_CREDS must be 20 chars long."; exit -1; }

	GITHUB_OAUTH_CALLBACK="https://$HUB_FQDN/hub/oauth_callback"

	# FIXME: this silently deletes any double quotes in the template file
	cp_with_subst templates/helm/github-auth.yaml.sht $PREFIX/secrets/github-auth.yaml

	msg done "  generated $PREFIX/secrets/github-auth.yaml [creds from $GITHUB_OAUTH_CREDS]"
}

gen_ssl()
{
	if [[ -z $LETSENCRYPT_EMAIL ]]; then
		if [[ -f "$PREFIX/secrets/ssl.yaml" ]]; then
			rm -f "$PREFIX/secrets/ssl.yaml"
			echo "disabling SSL (rerun with --letsencrypt-email=owner-email@example.com to re-enable)"
		fi
		return
	fi

	# don't regenerate if it already exists
	if [[ -f $PREFIX/secrets/ssl.yaml ]]; then
		msg skip "  skipping $PREFIX/secrets/ssl.yaml; already exists."
		return
	fi
	echo "Generating SSL certificates... This can take up to a minute."

	# generate new certificates
	if [[ $PROVIDER == do || $PROVIDER == aws ]]; then
		OUTPUT=$(certbot -d "$HUB_FQDN" \
			--keep --manual \
			--preferred-challenges dns certonly \
			--config-dir $PREFIX/secrets/certbot/config --work-dir $PREFIX/secrets/certbot/work --logs-dir $PREFIX/secrets/certbot/logs \
			-m "$LETSENCRYPT_EMAIL" \
			--agree-tos --no-eff-email --manual-public-ip-logging-ok \
			--manual-auth-hook=bin/certbot-auth.sh.${PROVIDER} 2>&1)
	else
		echo "$PROVIDER not supported in gen_ssl"
		exit -1
	fi
	if [[ $? -ne 0 ]]; then
		errmsg "======="
		errmsg "$OUTPUT"
		errmsg "======="
		errmsg "error: something went wrong with SSL certificate generation; see above. aborting.."
		exit -1
	fi

	cat > $PREFIX/secrets/ssl.yaml <<-EOF
	proxy:
	  https:
	    hosts:
	    - $HUB_FQDN
	    type: manual
	    manual:
	    key: |
	$(cat $PREFIX/secrets/certbot/config/live/$HUB_FQDN/privkey.pem |  sed 's/^/        /')
	    cert: |
	$(cat $PREFIX/secrets/certbot/config/live/$HUB_FQDN/fullchain.pem |  sed 's/^/        /')
	EOF

	msg done "  generated $PREFIX/secrets/ssl.yaml"
}

gen_dashboard()
{
	mkdir -p $PREFIX/dashboard
	cp templates/helm/create-dashboard-admin-user.yaml $PREFIX/dashboard
	curl -s "https://raw.githubusercontent.com/kubernetes/dashboard/$DASHBOARD_VERSION/aio/deploy/recommended.yaml" -o $PREFIX/dashboard/dashboard.yaml
	
	msg done "  generated $PREFIX/dashboard [version $DASHBOARD_VERSION]"
}

doctl_size_list_json()
{
	# Cache so we don't keep hitting the API server
	if ! find node_list.cache.json -mmin +60 >/dev/null 2>&1; then
		# cache doesn't exist or expired
		doctl compute size list -o json > node_list.cache.json
	fi

	cat node_list.cache.json
}

gen_config() {
	# check if we're overwriting
	#if [[ -f "$CONFIG" && $FORCE != "1" ]]; then
	#	errmsg "error: $CONFIG already exists. refusing to proceed in an abundance of caution."
	#	exit -1
	#fi

	# generate the include file with configuration
	TMPCONFIG=$(mktemp -t genesis-config-XXXXX)
	while IFS= read -r s
	do
		var="${s%%"|||"*}"; s=${s#*"|||"}
		val="${s%%"|||"*}"; s=${s#*"|||"}
		cmt="${s%%"|||"*}"; s=${s#*"|||"}
		req="${s%%"|||"*}"; s=${s#*"|||"}

		echo "# $cmt"
		# if this variable was overridden on the command line, replace the default value
		setvar="SET_$var"
		if [[ "${!setvar}" == "1" ]]; then
			val="${!var}"
		else
			# otherwise, make the default value available to subsequent generators
			eval "$var='$val'"
		fi
		echo "$var=$val"
		echo "export $var"
		echo
	done < <(parse_template $TEMPLATE) > "$TMPCONFIG"

	# Source the generated config, to eval any variables
	. "$TMPCONFIG"

	# Make sure that PREFIX is valid
	[[ -n "$PREFIX" ]] || { errmsg "error: --prefix is not set. aborting"; exit -1; }

	# early validation
	if [ $PROVIDER == "do" ]; then
		NODEPROPS=( $(doctl_size_list_json | jq -r '.[] | select(.slug == "'"$SIZE"'") | [.vcpus, .memory, .price_hourly] | @tsv ') )
		NODE_CPU=${NODEPROPS[0]}
		NODE_MEMORY=${NODEPROPS[1]}
		NODE_PRICE=${NODEPROPS[2]}
	elif [ $PROVIDER == "aws" ]; then
		REGION_DESCRIPTION=$(curl --silent https://raw.githubusercontent.com/boto/botocore/master/botocore/data/endpoints.json | jq -r --arg REGION "$REGION" '.partitions | .[0] | .regions | to_entries[] | {'key': .key, description: .value.description } | select(.key==$REGION) | .description')
		msg check "  found description for $REGION, description is $REGION_DESCRIPTION"
		filter=$(cat <<-EOF
			[
				{ 
					"Field" : "instanceType", 
					"Value" : "$SIZE", 
					"Type" : "TERM_MATCH" 
				}, 
				{ 
					"Field" : "location", 
					"Value" : "$REGION_DESCRIPTION", 
					"Type" : "TERM_MATCH" 
				}, 

				{ 
					"Type": "TERM_MATCH", 
					"Field": "ServiceCode", 
					"Value": "AmazonEC2" 
				}, 
				{ 
					"Type": "TERM_MATCH", 
					"Field": "tenancy", 
					"Value": "shared" 
				}, 
				{ 
					"Field" : "capacitystatus", 
					"Value" : "Used", 
					"Type" : "TERM_MATCH" 
				}, 
				{ 
					"Field" : "operatingSystem", 
					"Value" : "Linux", 
					"Type" : "TERM_MATCH" 
				}, 
				{ 
					"Field" : "preInstalledSw", 
					"Value" : "NA", 
					"Type" : "TERM_MATCH" 
				} 
			]
			EOF
		)
		product=$(aws --output=json pricing --region us-east-1 get-products  --max-results 1 --service-code AmazonEC2 --filters "$filter" | jq ' .PriceList | .[] | fromjson')
		NODE_CPU=$(echo "$product" | jq ' .product.attributes.vcpu | tonumber ')		
		mem_gb=$(echo "$product" | jq ' .product.attributes | { "memory" : .memory } | map( . |= split(" ")) | .[0] | .[0] | tonumber ')
		NODE_MEMORY=$(($mem_gb * 1024))
		NODE_PRICE=$(echo "$product" | jq ' .terms.OnDemand | map( . ) | .[0] | .priceDimensions | map( . ) | .[0] | .pricePerUnit.USD | tonumber ')
	else
		echo "Provider $PROVIDER not supported in gen_config()"
		exit -1
	fi

	# CPU and memory overheads
	# Estimated by inspecting "kubectl describe node s-4vcpu-8gb-a6hd"
	OH_MEM=1.5
	OH_CPU=1

	# how many users can use this node? keep ~0.5CPU for overhead
	node_users_cpu=$(echo "scale=0; ($NODE_CPU-$OH_CPU)/$USER_CPU" | bc)
	[[ node_users_cpu -gt 0 ]] || { errmsg "error: number of vcpus in a node is too small to accommodat even a single user. change --size or --user-cpu."; exit -1; }

	# how many users can use this node? keep ~0.5GiB for overhead
	node_users_ram=$(echo "scale=0; ($NODE_MEMORY/1024-$OH_MEM)/$USER_MEMORY" | bc)
	[[ node_users_ram -gt 0 ]] || { errmsg "error: node memory is too small to accommodat even a single user. change --size or --user-memory."; exit -1; }

	# total users
	node_users=$(( $node_users_cpu < $node_users_ram ? $node_users_cpu : $node_users_ram ))
	users=$((node_users*$NODES))

	# cost per hour
	cost_per_day=$(printf %.2f $(echo "$NODE_PRICE*$NODES*24" | bc))
	storage_cost_per_user_per_day=$(printf %.2f $(echo "0.0015*$USER_DISK*24" | bc))

	# Generate output directory skeleton
	mkdir -p "$PREFIX"/{secrets,values}
	msg done "  created output directory $PREFIX"
	
	if [[ -n $DEV_MODE ]]; then
		rm -f "$PREFIX/scripts" "$PREFIX/Makefile"
		ln -s "$PWD/scripts" "$PREFIX/"
		ln -s "$PWD/scripts/Makefile" "$PREFIX/"
		msg done "  [dev-mode] Linking 'scripts' to $PREFIX/scripts"
	else
		cp -a scripts "$PREFIX/"
		cp -a scripts/Makefile "$PREFIX/"
		msg done "  copied scripts to $PREFIX/scripts"
	fi

	# move config file
	CONFIG="$PREFIX/config"
	mv "$TMPCONFIG" "$CONFIG"


	# progress report
	msg done "  generated $CONFIG"
}

gen_images()
{
	# Verify the images exist on dockerhub
	if [[ -n $HUB_IMAGE ]]; then
		HUB_IMAGE_NAME=${HUB_IMAGE%%":"*}
		HUB_IMAGE_TAG=${HUB_IMAGE##*":"}
		
		if [[ -z $NOCHECKS ]]; then
			docker_tag_exists $HUB_IMAGE_NAME $HUB_IMAGE_TAG || { errmsg "error: image $HUB_IMAGE doesn't exist in the Docker repository."; exit -1; }
			msg check "  verified that $HUB_IMAGE is in the Docker repo."
		fi

		NAME="$HUB_IMAGE_NAME" TAG="$HUB_IMAGE_TAG" cp_with_subst templates/helm/hub.image.yaml.sht $PREFIX/values/hub.image.yaml
		msg done "  generated $PREFIX/values/hub.image.yaml.sht [image is $HUB_IMAGE]"
	else
		rm -f "$PREFIX/values/hub.image.yaml"
	fi

	if [[ -n $JUPYTER_IMAGE ]]; then
		JUPYTER_IMAGE_NAME=${JUPYTER_IMAGE%%":"*}
		JUPYTER_IMAGE_TAG=${JUPYTER_IMAGE##*":"}

		if [[ -z $NOCHECKS ]]; then
			docker_tag_exists $JUPYTER_IMAGE_NAME $JUPYTER_IMAGE_TAG || { errmsg "error: image $JUPYTER_IMAGE doesn't exist in the Docker repository."; exit -1; }
			msg check "  verified that $JUPYTER_IMAGE is in the Docker repo."
		fi

		NAME="$JUPYTER_IMAGE_NAME" TAG="$JUPYTER_IMAGE_TAG" cp_with_subst templates/helm/singleuser.image.yaml.sht $PREFIX/values/singleuser.image.yaml
		msg done "  generated $PREFIX/values/singleuser.image.yaml.sht [image is $JUPYTER_IMAGE]"
	else
		rm -f "$PREFIX/values/singleuser.image.yaml"
	fi
}

gen_autoexec()
{
	# inject "autoexec.sh" if requested
	if [[ -n $AUTOEXEC_SCRIPT ]]; then
		AUTOEXEC_SCRIPT_CONTENTS="$(cat $AUTOEXEC_SCRIPT)"

		cp_with_subst templates/helm/autoexec.yaml.sht $PREFIX/values/autoexec.yaml
		msg done "  generated $PREFIX/values/autoexec.yaml [from $AUTOEXEC_SCRIPT]"
	else
		rm -f "$PREFIX/values/autoexec.yaml"
	fi
}

gen_values_yaml() {

	# copy default values.yaml
	cp_with_subst templates/helm/values.yaml.sht $PREFIX/values/values.yaml
	msg done "  generated $PREFIX/values/values.yaml"
}

gen_eksctl()
{
	mkdir -p "$PREFIX/eksctl"
	cp_with_subst templates/eksctl/cluster.yaml.sht $PREFIX/eksctl/cluster.yaml
	msg done "  generated $PREFIX/eksctl/cluster.yaml.sht"
}


show_summary() {
	echo
	echo "========================================================================="
	echo ""
	echo "  JupyterHub Deployment Configuration Summary:"
	echo ""
	echo "  Cluster:"
	echo "    ${NODES} nodes, ${NODE_CPU}vcpus and ${NODE_MEMORY}mib each ($SIZE instance type)."
	echo "    Enough for ~$users simultaneous users (at ${USER_CPU}vcpus and ${USER_MEMORY}gib per user)"
	echo "      note: ${OH_CPU}vcpus and ${OH_MEM}GiB per node are reserved by the system."
	echo "    Expected cost: "
	echo "      Compute cluster: \$$cost_per_day/day"
	echo "      User storage: \$$storage_cost_per_user_per_day/user/day"
	echo "    Kubernetes version: $K8S_VERSION"
	echo "    Kubernetes cluster name: ${CLUSTER_NAME}"
	echo ""
	echo "  Environment:"
	echo "    Each user is guaranteed ${USER_CPU}vcpus, ${USER_MEMORY}gib RAM, and ${USER_DISK}GiB of disk space"
	echo "    Hub address will be https://$HUB_FQDN"
	echo "      Let's Encrypt SSL cert will be registered to $LETSENCRYPT_EMAIL"
if [[ -n $GITHUB_OAUTH_CREDS ]]; then
	echo "    Authenticating via GitHub"
if [[ -n $GITHUB_ORG ]]; then
	echo "      Only users belonging to $GITHUB_ORG can log in."
else
	echo "      Any GitHub user can log in."
fi
fi
if [[ -n $HUB_IMAGE || -n $JUPYTER_IMAGE ]]; then
	echo "    Images:"
fi
if [[ -n $HUB_IMAGE ]]; then
	echo "      Hub: $HUB_IMAGE"
fi
if [[ -n $JUPYTER_IMAGE ]]; then
	echo "      Jupyter: $JUPYTER_IMAGE"
fi
	echo "    Helm Chart: $JHUB_VERSION"
	echo ""
	echo "========================================================================="
	echo
}

#############################################################################3
# Main
#############################################################################3

# Parse the command line
POSITIONAL=()
while [[ $# -gt 0 ]]
do
	key="$1"
	case "$key" in
		-h|--help)
			usage
			exit -1
		;;
		
		-f|--force)
			FORCE=1
			shift;
		;;

		--no-checks)
			NOCHECKS=1
			shift;
		;;

		--dev-mode)
			DEV_MODE=1
			shift;
		;;

		# Simple options with an argument
		--*=*)
			eval "$(option_to_varname $key)='${key#*=}'"
			eval "SET_$(option_to_varname $key)=1"
			shift;
		;;

		--*)
			eval "$(option_to_varname $key)=$2"
			eval "SET_$(option_to_varname $key)=1"
			shift;
			shift;
		;;

		*)
		POSITIONAL+=("$1")
		shift;
		;;
	esac
done
set -- "${POSITIONAL[@]}" # restore positional parameters

# Discover provider
if [[ -z "$PROVIDER" ]]; then
	errmsg "error: --provider must be specified"
	exit -1
fi
TEMPLATE="templates/config/config.sh.$PROVIDER"
if [[ ! -f $TEMPLATE ]]; then
	errmsg "error: provider '$PROVIDER' unknown."
	exit -1
fi

# Discover all required options for this provider
REQUIRED=(PROVIDER)
add_required $TEMPLATE

# Verify we have all required options
for key in ${REQUIRED[@]}; do
	if [[ -z ${!key} ]]; then
		opt="${key//_/-}"
		opt=$(echo "$opt" | awk '{print tolower($0)}')
		errmsg "error: --$opt=<$key> must be specified for provider '$PROVIDER'."
		err=1
	fi
done
test "$err" == "1" && { errmsg; errmsg "run $0 -h for help"; exit -1; }

# Check prerequisites
check_prerequisites

# generate output files
echo "== Generating configuration:"
echo

gen_config

gen_dashboard
gen_proxy_secret
gen_ssl
gen_github_auth

gen_images
gen_autoexec
gen_values_yaml

[[ $PROVIDER == aws ]] && gen_eksctl

show_summary

echo "========================================================================="
echo "   Configuration success. run 'make all' to (re)deploy your cluster."
echo "========================================================================="