#!/bin/bash
# Build against a specific nginx.org NGINX version (nginx -v).
# Intended to run inside an Ubuntu container
# matching the target distribution.
# Compiling GeoIP2 as a dynamic module (.so file)
# Compiling Brotli as a dynamic module (.so file)
# Compiling ModSecurity-nginx as a dynamic module (.so file)
# Must be run in root home as root (sudo -i)

if ! id | grep -q "uid=0(root)"; then
        echo "Must be run as root" 
	exit 1
fi
# Set log file
scriptdir="$( cd "$( dirname "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )"
logname=`basename "$0"`
logname+=".log"
logfile=$scriptdir/$logname
touch "$logfile"

# Functions
logger(){
    echo "$(date): $@" >> $logfile
    echo "## $@"
}
logger "Starting script"

# Setup
## NeedRestart config change (automatically restart required services instead of prompting/blocking script. Revert at end).
sed -i 's/#$nrconf{restart} = '\''i'\'';/$nrconf{restart} = '\''a'\'';/' /etc/needrestart/needrestart.conf
#
# Best practice settings for running bash scripts:
# Exit the script when an error is encountered
set -o errexit
# Exit the script when a pipe operation fails
set -o pipefail
# Exit the script when there are undeclared variables
set -o nounset
# Uncomment this to see a log to the screen of each command run in the script
# set -o xtrace
# Credit: nginx.org 2020-10-05 https://gist.github.com/nginx-gists/bdc7da70b124c4f3e472970c7826cccc 

# Back up Your Current Configuration
cp -r /etc/nginx /etc/nginx__backup

# Pre-reqs
apt-get -qq update
apt-get -qq install -y \
libpcre2-dev \
libssl-dev \
zlib1g-dev \
libbrotli-dev \
g++ \
flex \
bison \
curl \
doxygen \
libyajl-dev \
libgeoip-dev \
libtool \
dh-autoreconf \
libcurl4-gnutls-dev \
libxml2-dev \
make \
libmaxminddb0 \
libmaxminddb-dev \
mmdb-bin

# Install the modules
# Get installed Nginx version number
NGINX_VER=$(nginx -v |& sed 's/nginx version: nginx\///' | sed 's/\s.*$//')
logger "Nginx version: $NGINX_VER"

# Create a workspace and download the exact matching Nginx ${NGINX_VER} source code:
cd /opt/

if [ ! -d /opt/nginx-upgrade ]; then
  mkdir -p /opt/nginx-upgrade
fi

cd /opt/nginx-upgrade

if [ ! -f /opt/nginx-upgrade/nginx-${NGINX_VER}/configure ]; then
  curl -O https://nginx.org/download/nginx-${NGINX_VER}.tar.gz
  tar -zxf nginx-${NGINX_VER}.tar.gz
  logger "nginx-${NGINX_VER} source downloaded"
fi

# Clone Module Repositories
# Download the source code for the Brotli GeoIP2 ModSecurity-nginx modules into your workspace.

# delete previous clone directories
if [ -d /opt/nginx-upgrade/ngx_brotli ]; then
  rm -r /opt/nginx-upgrade/ngx_brotli
fi

if [ -d /opt/nginx-upgrade/ngx_http_geoip2_module ]; then
  rm -r /opt/nginx-upgrade/ngx_http_geoip2_module
fi

if [ -d /opt/nginx-upgrade/ModSecurity-nginx ]; then
  rm -r /opt/nginx-upgrade/ModSecurity-nginx
fi

# Clone Brotli module
cd /opt/nginx-upgrade
git clone --recursive https://github.com/google/ngx_brotli.git
# Navigate to your cloned ngx_brotli folder and pull down missing dependencies:
cd /opt/nginx-upgrade/ngx_brotli
git submodule update --init --recursive
cd /opt/nginx-upgrade
logger "Brotli dynamic module cloned"

cd /opt/nginx-upgrade/nginx-${NGINX_VER}

# Remove previous configs
if [ -d /opt/nginx-upgrade/nginx-${NGINX_VER}/objs ]; then
  make clean
fi
logger "make clean invoked"

# Run configure with the --add-dynamic-module flags appended to your configuration:
./configure --with-compat --add-dynamic-module=../ngx_brotli
logger "Brotli dynamic module completed"

# Compile only the modules:
make modules
logger "Brotli dynamic modules compiled"

# Copy the freshly compiled .so files into your system’s Nginx modules directory:
if [ ! -d /etc/nginx/modules/ ]; then
  mkdir -p /etc/nginx/modules
fi
cp objs/ngx_http_brotli_filter_module.so /etc/nginx/modules/
cp objs/ngx_http_brotli_static_module.so /etc/nginx/modules/
logger "Brotli dynamic modules copied to /etc/nginx/modules/"

# Clone GeoIP2 module
cd /opt/nginx-upgrade
git clone https://github.com/leev/ngx_http_geoip2_module.git
# Navigate to your cloned ngx_brotli folder and pull down missing dependencies:
cd /opt/nginx-upgrade/ngx_http_geoip2_module
git submodule update --init --recursive
cd /opt/nginx-upgrade
logger "GeoIP2 module cloned"

cd /opt/nginx-upgrade/nginx-${NGINX_VER}

# Run configure with the --add-dynamic-module flags appended to your configuration:
./configure --with-compat --add-dynamic-module=../ngx_http_geoip2_module
logger "GeoIP2 dynamic module completed"

# Compile only the modules:
make modules
logger "GeoIP2 module compiled"

# Copy the freshly compiled .so files into your system’s Nginx modules directory:
cp objs/ngx_http_geoip2_module.so /etc/nginx/modules/
logger "GeoIP2 dynamic module copied to /etc/nginx/modules/"

# Clone ModSecurity-nginx module
cd /opt/nginx-upgrade
git clone --depth 1 https://github.com/SpiderLabs/ModSecurity-nginx.git
# Navigate to your cloned ngx_brotli folder and pull down missing dependencies:
cd /opt/nginx-upgrade/ModSecurity-nginx
git submodule update --init --recursive
cd /opt/nginx-upgrade
logger "ModSecurity-nginx cloned"

cd /opt/nginx-upgrade/nginx-${NGINX_VER}

# Run configure with the --add-dynamic-module flags appended to your configuration:
./configure --with-compat --add-dynamic-module=../ModSecurity-nginx
logger "ModSecurity dynamic module configured"

# Note: Using --with-compat ensures binary compatibility with official Nginx packages.

# Compile only the modules:
make modules
logger "ModSecurity dynamic module compiled"

# Copy the freshly compiled .so files into your system’s Nginx modules directory:
cp objs/ngx_http_modsecurity_module.so /etc/nginx/modules/
logger "ModSecurity dynamic module copied to /etc/nginx/modules/"

# Verify
# nginx -t
if [ "$(command nginx -t) | grep 'ok'" ]; then
        logger "Nginx configuration ok, reloading.."
	if [ "systemctl status nginx | grep 'Started nginx.service'" ]; then 
		systemctl reload nginx
	else
		systemctl start nginx
	fi
else
        logger "Nginx errors"
fi

ls -la /opt/nginx-upgrade/nginx-${NGINX_VER}/objs

logger "Operation complete"