Configure Cherokee caching and compression for improved performance

#!/usr/bin/env bash

set -euo pipefail

# Cherokee Caching and Compression Configuration Script
# Production-quality installer for Cherokee web server with performance optimizations

# Color codes for output
readonly RED='\033[0;31m'
readonly GREEN='\033[0;32m'
readonly YELLOW='\033[1;33m'
readonly NC='\033[0m'

# Global variables
CHEROKEE_CACHE_DIR="/var/lib/cherokee/cache"
CHEROKEE_CONFIG="/etc/cherokee/cherokee.conf"
WEB_USER=""
ADMIN_PORT="9090"

# Print colored output
print_status() {
    echo -e "${GREEN}[INFO]${NC} $1"
}

print_warning() {
    echo -e "${YELLOW}[WARNING]${NC} $1"
}

print_error() {
    echo -e "${RED}[ERROR]${NC} $1"
}

# Usage information
usage() {
    echo "Usage: $0 [--admin-port PORT]"
    echo "  --admin-port    Cherokee admin interface port (default: 9090)"
    echo "  --help         Show this help message"
    exit 1
}

# Parse command line arguments
while [[ $# -gt 0 ]]; do
    case $1 in
        --admin-port)
            ADMIN_PORT="$2"
            shift 2
            ;;
        --help)
            usage
            ;;
        *)
            echo "Unknown option: $1"
            usage
            ;;
    esac
done

# Check if running as root or with sudo
check_privileges() {
    if [[ $EUID -ne 0 ]]; then
        print_error "This script must be run as root or with sudo"
        exit 1
    fi
}

# Cleanup function for rollback
cleanup() {
    local exit_code=$?
    if [[ $exit_code -ne 0 ]]; then
        print_error "Script failed. Cleaning up..."
        systemctl stop cherokee 2>/dev/null || true
        systemctl disable cherokee 2>/dev/null || true
        rm -rf "$CHEROKEE_CACHE_DIR" 2>/dev/null || true
    fi
    exit $exit_code
}

# Set trap for cleanup
trap cleanup ERR

# Auto-detect distribution
detect_distro() {
    if [[ ! -f /etc/os-release ]]; then
        print_error "Cannot detect distribution: /etc/os-release not found"
        exit 1
    fi

    . /etc/os-release
    case "$ID" in
        ubuntu|debian)
            PKG_MGR="apt"
            PKG_UPDATE="apt update && apt upgrade -y"
            PKG_INSTALL="apt install -y"
            WEB_USER="www-data"
            ;;
        almalinux|rocky|centos|rhel|ol|fedora)
            PKG_MGR="dnf"
            PKG_UPDATE="dnf update -y"
            PKG_INSTALL="dnf install -y"
            WEB_USER="cherokee"
            ;;
        amzn)
            PKG_MGR="yum"
            PKG_UPDATE="yum update -y"
            PKG_INSTALL="yum install -y"
            WEB_USER="cherokee"
            ;;
        *)
            print_error "Unsupported distribution: $ID"
            exit 1
            ;;
    esac

    print_status "Detected distribution: $ID"
}

# Update system packages
update_system() {
    print_status "[1/8] Updating system packages..."
    eval "$PKG_UPDATE"
}

# Install Cherokee and dependencies
install_cherokee() {
    print_status "[2/8] Installing Cherokee web server..."
    
    if [[ "$PKG_MGR" == "apt" ]]; then
        $PKG_INSTALL cherokee cherokee-admin libcherokee-mod-libssl libcherokee-mod-streaming
    else
        # For RHEL-based systems, enable EPEL repository if needed
        if ! command -v cherokee &> /dev/null; then
            $PKG_INSTALL epel-release || true
        fi
        $PKG_INSTALL cherokee cherokee-admin
    fi
}

# Configure Cherokee user and permissions
setup_user() {
    print_status "[3/8] Setting up Cherokee user and permissions..."
    
    # Create web user if it doesn't exist
    if ! id "$WEB_USER" &>/dev/null; then
        if [[ "$PKG_MGR" == "apt" ]]; then
            useradd --system --no-create-home --shell /bin/false "$WEB_USER"
        else
            useradd --system --no-create-home --shell /sbin/nologin "$WEB_USER"
        fi
    fi
}

# Create and configure cache directory
setup_cache_directory() {
    print_status "[4/8] Setting up cache directory..."
    
    mkdir -p "$CHEROKEE_CACHE_DIR"
    chown "$WEB_USER":"$WEB_USER" "$CHEROKEE_CACHE_DIR"
    chmod 755 "$CHEROKEE_CACHE_DIR"
    
    # Set SELinux context for RHEL-based systems
    if command -v setsebool &> /dev/null; then
        setsebool -P httpd_can_network_connect on || true
        if command -v semanage &> /dev/null; then
            semanage fcontext -a -t httpd_cache_t "$CHEROKEE_CACHE_DIR(/.*)?" || true
            restorecon -R "$CHEROKEE_CACHE_DIR" || true
        fi
    fi
}

# Configure Cherokee basic settings
configure_cherokee() {
    print_status "[5/8] Configuring Cherokee performance settings..."
    
    # Backup original config
    if [[ -f "$CHEROKEE_CONFIG" ]]; then
        cp "$CHEROKEE_CONFIG" "${CHEROKEE_CONFIG}.backup.$(date +%s)"
    fi
    
    # Create basic Cherokee configuration with caching and compression
    cat > "$CHEROKEE_CONFIG" << EOF
# Cherokee Configuration - Generated by install script

config!version = 001002002

# Server settings
server!bind!1!port = 80
server!user = $WEB_USER
server!group = $WEB_USER
server!pid_file = /var/run/cherokee.pid
server!thread_number = $(nproc)
server!max_connection_reuse = 500
server!timeout = 15
server!sendfile_min = 32768
server!sendfile_max = 2097152

# Cache settings
cache!enabled = 1
cache!max_size = 134217728
cache!max_file_size = 1048576
cache!directory = $CHEROKEE_CACHE_DIR
cache!lasting_stat = 1
cache!lasting_mmap = 1

# MIME types
mime!application/javascript!extensions = js
mime!text/css!extensions = css
mime!text/html!extensions = html,htm
mime!image/png!extensions = png
mime!image/jpeg!extensions = jpg,jpeg
mime!image/gif!extensions = gif

# Virtual server
vserver!1!nick = default
vserver!1!document_root = /var/www/html
vserver!1!directory_index = index.html,index.htm

# Static file rules with caching
vserver!1!rule!100!match = extensions
vserver!1!rule!100!match!extensions = css,js,png,jpg,jpeg,gif,ico,pdf
vserver!1!rule!100!handler = file
vserver!1!rule!100!handler!iocache = 1
vserver!1!rule!100!expiration = 2592000

# Compression rules
vserver!1!rule!200!match = extensions
vserver!1!rule!200!match!extensions = html,htm,css,js,xml,txt,json,svg
vserver!1!rule!200!handler = file
vserver!1!rule!200!encoder!gzip = 1
vserver!1!rule!200!encoder!gzip!compression_level = 6

# Default rule
vserver!1!rule!500!match = default
vserver!1!rule!500!handler = file

# Admin interface
admin!enabled = 1
admin!port = $ADMIN_PORT
admin!ssl = 0
EOF

    chmod 644 "$CHEROKEE_CONFIG"
    chown root:root "$CHEROKEE_CONFIG"
}

# Enable and start Cherokee service
setup_service() {
    print_status "[6/8] Enabling and starting Cherokee service..."
    
    systemctl enable cherokee
    systemctl start cherokee
    
    # Verify service is running
    if ! systemctl is-active --quiet cherokee; then
        print_error "Cherokee service failed to start"
        systemctl status cherokee
        exit 1
    fi
}

# Configure firewall
setup_firewall() {
    print_status "[7/8] Configuring firewall..."
    
    # Configure firewall for HTTP and admin ports
    if command -v ufw &> /dev/null; then
        # Ubuntu/Debian UFW
        ufw allow 80/tcp comment "Cherokee HTTP"
        ufw allow "$ADMIN_PORT"/tcp comment "Cherokee Admin"
    elif command -v firewall-cmd &> /dev/null; then
        # RHEL-based firewalld
        firewall-cmd --permanent --add-port=80/tcp
        firewall-cmd --permanent --add-port="$ADMIN_PORT"/tcp
        firewall-cmd --reload
    fi
}

# Verify installation
verify_installation() {
    print_status "[8/8] Verifying installation..."
    
    # Check if Cherokee is running
    if ! systemctl is-active --quiet cherokee; then
        print_error "Cherokee service is not running"
        return 1
    fi
    
    # Check if cache directory exists and has correct permissions
    if [[ ! -d "$CHEROKEE_CACHE_DIR" ]]; then
        print_error "Cache directory not found"
        return 1
    fi
    
    # Check if port 80 is listening
    if ! netstat -tln 2>/dev/null | grep -q ":80 " && ! ss -tln 2>/dev/null | grep -q ":80 "; then
        print_warning "Cherokee may not be listening on port 80"
    fi
    
    # Check if admin port is listening
    if ! netstat -tln 2>/dev/null | grep -q ":$ADMIN_PORT " && ! ss -tln 2>/dev/null | grep -q ":$ADMIN_PORT "; then
        print_warning "Cherokee admin interface may not be accessible"
    fi
    
    print_status "Cherokee installation completed successfully!"
    print_status "Web server: http://$(hostname -I | awk '{print $1}')"
    print_status "Admin interface: http://$(hostname -I | awk '{print $1}'):$ADMIN_PORT"
    print_status "Cache directory: $CHEROKEE_CACHE_DIR"
    print_status "Configuration file: $CHEROKEE_CONFIG"
    print_warning "Remember to secure the admin interface in production!"
}

# Main execution
main() {
    print_status "Starting Cherokee installation with caching and compression..."
    
    check_privileges
    detect_distro
    update_system
    install_cherokee
    setup_user
    setup_cache_directory
    configure_cherokee
    setup_service
    setup_firewall
    verify_installation
    
    print_status "Installation completed successfully!"
}

# Run main function
main "$@"