    module Propellor.Property.OpenId where

    import Propellor.Base
    import qualified Propellor.Property.File as File
    import qualified Propellor.Property.Apt as Apt
    import qualified Propellor.Property.Apache as Apache

    import Data.List

    -- | Openid provider, using the simpleid PHP CGI, with apache.
    --
    -- Runs on usual port by default. When a nonstandard port is specified,
    -- apache is limited to listening only on that port. Warning: Specifying
    -- a port won't compose well with other apache properties on the same
    -- host.
    --
    -- It's probably a good idea to put this property inside a docker or
    -- systemd-nspawn container.
    providerFor :: [User] -> HostName -> Maybe Port -> Property (HasInfo + DebianLike)
    providerFor users hn mp = propertyList desc $ props
            & Apt.serviceInstalledRunning "apache2"
            & apacheconfigured
            & Apt.installed ["simpleid"]
                    `onChange` Apache.restarted
            & File.fileProperty (desc ++ " configured")
                    (map setbaseurl) "/etc/simpleid/config.inc"
            & propertyList desc (toProps $ map identfile users)
      where
            baseurl = hn ++ case mp of
                    Nothing -> ""
                    Just p -> ':' : val p
            url = "http://"++baseurl++"/simpleid"
            desc = "openid provider " ++ url
            setbaseurl l
                    | "SIMPLEID_BASE_URL" `isInfixOf` l =
                            "define('SIMPLEID_BASE_URL', '"++url++"');"
                    | otherwise = l

            apacheconfigured = case mp of
                    Nothing -> setupRevertableProperty $
                            Apache.virtualHost hn (Port 80) "/var/www/html"
                    Just p -> propertyList desc $ props
                            & Apache.listenPorts [p]
                            & Apache.virtualHost hn p "/var/www/html"

            -- the identities directory controls access, so open up
            -- file mode
            identfile (User u) = File.hasPrivContentExposed
                    (concat [ "/var/lib/simpleid/identities/", u, ".identity" ])
                    (Context baseurl)