Configure Cherokee web server reverse proxy and load balancing with SSL

#!/usr/bin/env bash

set -euo pipefail

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m'

# Default values
DOMAIN="${1:-example.com}"
BACKEND_IP="${2:-192.168.1.10}"
BACKEND_PORT="${3:-8080}"

# Usage function
usage() {
    echo "Usage: $0 [domain] [backend_ip] [backend_port]"
    echo "Example: $0 mysite.com 10.0.1.100 3000"
    exit 1
}

# Logging functions
log_info() { echo -e "${GREEN}[INFO]${NC} $*"; }
log_warn() { echo -e "${YELLOW}[WARN]${NC} $*"; }
log_error() { echo -e "${RED}[ERROR]${NC} $*"; }

# Cleanup function for rollback
cleanup() {
    log_error "Installation failed. Performing cleanup..."
    systemctl stop cherokee 2>/dev/null || true
    systemctl disable cherokee 2>/dev/null || true
    rm -f /etc/systemd/system/cherokee.service
    rm -rf /opt/cherokee /var/log/cherokee /var/run/cherokee /etc/cherokee
    userdel cherokee 2>/dev/null || true
    rm -f /etc/ld.so.conf.d/cherokee.conf
    ldconfig
    exit 1
}

# Set trap for cleanup on error
trap cleanup ERR

# Check if running as root
if [[ $EUID -ne 0 ]]; then
    log_error "This script must be run as root"
    exit 1
fi

# Validate domain format
if [[ ! $DOMAIN =~ ^[a-zA-Z0-9][a-zA-Z0-9-]{1,61}[a-zA-Z0-9]\.[a-zA-Z]{2,}$ ]]; then
    log_error "Invalid domain format: $DOMAIN"
    usage
fi

# Detect distribution
echo "[1/8] Detecting distribution and setting up package manager..."
if [ -f /etc/os-release ]; then
    . /etc/os-release
    case "$ID" in
        ubuntu|debian) 
            PKG_MGR="apt"
            PKG_UPDATE="apt update"
            PKG_INSTALL="apt install -y"
            BUILD_GROUP=""
            DEV_TOOLS="build-essential"
            SSL_DEV="libssl-dev"
            ZLIB_DEV="zlib1g-dev"
            PCRE_DEV="libpcre3-dev"
            FIREWALL_CMD="ufw"
            ;;
        almalinux|rocky|centos|rhel|ol|fedora)
            PKG_MGR="dnf"
            PKG_UPDATE="dnf update -y"
            PKG_INSTALL="dnf install -y"
            BUILD_GROUP="Development Tools"
            DEV_TOOLS=""
            SSL_DEV="openssl-devel"
            ZLIB_DEV="zlib-devel"
            PCRE_DEV="pcre-devel"
            FIREWALL_CMD="firewall-cmd"
            ;;
        amzn)
            PKG_MGR="yum"
            PKG_UPDATE="yum update -y"
            PKG_INSTALL="yum install -y"
            BUILD_GROUP="Development Tools"
            DEV_TOOLS=""
            SSL_DEV="openssl-devel"
            ZLIB_DEV="zlib-devel"
            PCRE_DEV="pcre-devel"
            FIREWALL_CMD="firewall-cmd"
            ;;
        *)
            log_error "Unsupported distribution: $ID"
            exit 1
            ;;
    esac
    log_info "Detected: $PRETTY_NAME using $PKG_MGR"
else
    log_error "Cannot detect distribution - /etc/os-release not found"
    exit 1
fi

# Update packages and install dependencies
echo "[2/8] Installing build dependencies and libraries..."
$PKG_UPDATE

if [[ -n "$BUILD_GROUP" ]]; then
    $PKG_INSTALL groupinstall "$BUILD_GROUP"
fi

$PKG_INSTALL $DEV_TOOLS wget curl git autoconf libtool pkgconfig $SSL_DEV $ZLIB_DEV $PCRE_DEV gettext

# Create Cherokee user and directories
echo "[3/8] Creating Cherokee user and directory structure..."
if ! id "cherokee" &>/dev/null; then
    useradd --system --no-create-home --shell /bin/false --comment "Cherokee web server" cherokee
fi

mkdir -p /opt/cherokee /var/log/cherokee /var/run/cherokee /etc/cherokee
chown -R cherokee:cherokee /var/log/cherokee /var/run/cherokee

# Download and compile Cherokee
echo "[4/8] Downloading and compiling Cherokee from source..."
cd /tmp
rm -rf webserver-master*
wget -q https://github.com/cherokee/webserver/archive/refs/heads/master.zip
unzip -q master.zip
cd webserver-master

./autogen.sh --prefix=/opt/cherokee --enable-ssl --enable-threading --enable-epoll --with-wwwroot=/opt/cherokee/www
make -j$(nproc) >/dev/null 2>&1
make install >/dev/null 2>&1

# Configure system PATH and libraries
echo "[5/8] Configuring system PATH and libraries..."
ln -sf /opt/cherokee/sbin/cherokee /usr/local/sbin/cherokee
ln -sf /opt/cherokee/sbin/cherokee-admin /usr/local/sbin/cherokee-admin
echo '/opt/cherokee/lib' > /etc/ld.so.conf.d/cherokee.conf
ldconfig

# Generate SSL certificates
echo "[6/8] Generating SSL certificates..."
mkdir -p /etc/cherokee/ssl
openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
    -keyout /etc/cherokee/ssl/cherokee.key \
    -out /etc/cherokee/ssl/cherokee.crt \
    -subj "/C=US/ST=State/L=City/O=Organization/CN=$DOMAIN" 2>/dev/null

chown -R root:cherokee /etc/cherokee/ssl
chmod 640 /etc/cherokee/ssl/*

# Create Cherokee configuration
echo "[7/8] Creating Cherokee configuration..."
cat > /etc/cherokee/cherokee.conf << EOF
config!version = 001002002

# Server configuration
server!bind!1!port = 80
server!bind!2!port = 443
server!bind!2!tls = 1
server!bind!2!tls!certificate = /etc/cherokee/ssl/cherokee.crt
server!bind!2!tls!certificate_key = /etc/cherokee/ssl/cherokee.key

server!user = cherokee
server!group = cherokee
server!pid_file = /var/run/cherokee/cherokee.pid
server!error_log = /var/log/cherokee/error.log
server!access_log = /var/log/cherokee/access.log
server!timeout = 15
server!keepalive = 1
server!keepalive_max_requests = 100
server!thread_number = 50

# Backend server configuration
source!1!type = host
source!1!nick = backend1
source!1!host = $BACKEND_IP:$BACKEND_PORT
source!1!timeout = 10

# Virtual server configuration
vserver!1!nick = $DOMAIN
vserver!1!document_root = /opt/cherokee/www
vserver!1!rule!1!match = default
vserver!1!rule!1!handler = proxy
vserver!1!rule!1!handler!balancer = round_robin
vserver!1!rule!1!handler!balancer!source!1 = 1

# Default virtual server
vserver!default!nick = default
vserver!default!document_root = /opt/cherokee/www
vserver!default!rule!1!match = default
vserver!default!rule!1!handler = common
EOF

chown cherokee:cherokee /etc/cherokee/cherokee.conf
chmod 644 /etc/cherokee/cherokee.conf

# Create systemd service
cat > /etc/systemd/system/cherokee.service << 'EOF'
[Unit]
Description=Cherokee Web Server
After=network.target
Wants=network.target

[Service]
Type=forking
User=cherokee
Group=cherokee
ExecStart=/opt/cherokee/sbin/cherokee -d -C /etc/cherokee/cherokee.conf
ExecReload=/bin/kill -USR1 $MAINPID
KillMode=mixed
PrivateTmp=true
LimitNOFILE=1048576
Restart=on-failure
RestartSec=5s

[Install]
WantedBy=multi-user.target
EOF

# Enable and start Cherokee service
echo "[8/8] Configuring firewall and starting Cherokee service..."
systemctl daemon-reload
systemctl enable cherokee

# Configure firewall based on distribution
if command -v ufw >/dev/null 2>&1; then
    ufw allow 80/tcp >/dev/null 2>&1 || true
    ufw allow 443/tcp >/dev/null 2>&1 || true
elif command -v firewall-cmd >/dev/null 2>&1; then
    firewall-cmd --permanent --add-service=http >/dev/null 2>&1 || true
    firewall-cmd --permanent --add-service=https >/dev/null 2>&1 || true
    firewall-cmd --reload >/dev/null 2>&1 || true
fi

systemctl start cherokee

# Verification
log_info "Cherokee Web Server installation completed successfully!"
log_info "Configuration file: /etc/cherokee/cherokee.conf"
log_info "SSL certificate: /etc/cherokee/ssl/cherokee.crt"
log_info "Backend server: $BACKEND_IP:$BACKEND_PORT"
log_info "Domain: $DOMAIN"
log_warn "Replace SSL certificates with production certificates before going live"

if systemctl is-active --quiet cherokee; then
    log_info "Cherokee service is running"
else
    log_error "Cherokee service failed to start"
    exit 1
fi