class soc::intelmq(
  Optional[String]    $tls_cert   = undef,
  Optional[String]    $tls_chain  = undef,
  Optional[String]    $tls_key    = undef,
  String              $servername = $facts['networking']['fqdn'],
  Boolean             $use_snakeoil = false,
) {
  include sunet::systemd_reload

  group { 'intelmq':
    ensure => present,
  }

  user { 'intelmq':
    ensure     => present,
    gid        => 'intelmq',
    groups     => 'www-data',
    home       => '/opt/intelmq',
    managehome => true,
    shell      => '/bin/bash',
  }

  file { '/etc/intelmq':
    ensure => directory,
    owner  => 'intelmq',
    group  => 'intelmq',
  }

  file { '/etc/intelmq/api':
    ensure => directory,
    owner  => 'intelmq',
    group  => 'www-data',
    mode   => '0770',
  }

  #  file { '/opt/sso/apache/groups.txt':
  #  ensure  => file,
  #    content => template('soc/sso/apache-groups.txt.erb')
  #  }

  package { 'apache2':
    ensure => 'latest',
  }

  package { 'libapache2-mod-wsgi-py3':
    ensure => 'latest',
  }

  package { ['postgresql', 'python3-venv', 'python3-pip', 'python3-gpg', 'python3-psycopg2', 'redict', ]:
    ensure => 'latest',
  }

  exec { 'Install IntelMQ venv':
    command => 'sudo -u intelmq /usr/bin/python3 -m venv --system-site-packages /opt/intelmq/venv',
    creates => '/opt/intelmq/venv',
  }

  file { '/opt/intelmq/install-intelmq.sh':
    ensure  => file,
    content => file('soc/intelmq/install-intelmq.sh'),
    mode    => '0555',
  }

  exec { 'Install IntelMQ':
    command => 'sudo -u intelmq /opt/intelmq/install-intelmq.sh',
    creates => '/opt/intelmq/.installed'
  }

  exec { 'Run IntelMQ setup script':
    command => '/opt/intelmq/venv/bin/intelmqsetup --state-file /opt/intelmq/.setup_state',
    creates => '/opt/intelmq/.setup_state',
    returns => ['0', '1',],
  }

  file { '/etc/sudoers.d/01_intelmq-api':
    ensure  => file,
    content => file('soc/intelmq/sudoers-01-intelmq-api'),
    mode    => '0440',
  }

  service { 'apache2':
    ensure  => 'running',
    enable  => true,
    require => Package['apache2'],
  }

  exec { 'Enable Apache2 modules':
    command => 'a2enmod ssl wsgi proxy proxy_http headers rewrite',
    require => Package['libapache2-mod-wsgi-py3'],
    notify  => Service['apache2'],
  }

  file { '/etc/apache2/conf-available/wsgi-venv.conf':
    ensure  => file,
    content => file('soc/intelmq/apache/wsgi-venv.conf'),
  }

  exec { 'Enable wsgi-venv conf':
    command => 'a2enconf wsgi-venv',
    creates => '/etc/apache2/conf-enabled/wsgi-venv.conf',
    notify  => Service['apache2'],
  }

  file { '/etc/apache2/sites-available/intelmq-vhost.conf':
    ensure  => file,
    content => template('soc/intelmq/intelmq-vhost.conf.erb'),
    notify  => Service['apache2'],
  }

  file { '/etc/intelmq/api-config.json':
    ensure  => file,
    owner   => 'intelmq',
    group   => 'intelmq',
    mode    => '0444',
    content => file('soc/intelmq/api-config.json'),
  }

  $api_user = lookup('intelmq_api_user.username', undef, undef, 'test')
  $api_pass = lookup('intelmq_api_user.password', undef, undef, 'pass')
  exec { 'Setup intelmq-api user':
    command => "sudo -u intelmq /opt/intelmq/venv/bin/intelmq-api-adduser --user ${api_user} --password ${api_pass}",
    creates => '/etc/intelmq/api/api-session.sqlite',
  }

  file { '/etc/intelmq/api/api-session.sqlite':
    ensure  => 'present',
    replace => 'no',
    owner   => 'intelmq',
    group   => 'www-data',
    mode    => '0660'
  }

  file { '/etc/systemd/system/intelmq-api.service':
    ensure  => file,
    content => file('soc/intelmq/intelmq-api.service'),
    notify  => [Class['sunet::systemd_reload'], Service['intelmq-api.service'],],
  }

  file { '/etc/systemd/system/intelmq-api.socket':
    ensure  => file,
    content => file('soc/intelmq/intelmq-api.socket'),
    notify  => [Class['sunet::systemd_reload'], Service['intelmq-api.socket'],],
  }

  file { '/opt/intelmq/etc/runtime.yaml':
    ensure  => 'present',
    replace => 'no',
    owner   => 'intelmq',
    group   => 'www-data',
    mode    => '0660',
  }

  file { '/opt/intelmq/etc/runtime.yaml.bak':
    ensure  => 'present',
    replace => 'no',
    owner   => 'www-data',
    group   => 'www-data',
    mode    => '0660',
    content => '',
  }

  service { 'intelmq-api.service':
    ensure     => running,
    name       => 'intelmq-api.service',
    enable     => true,
    hasrestart => true,
  }

  service { 'intelmq-api.socket':
    ensure     => running,
    name       => 'intelmq-api.socket',
    enable     => true,
    hasrestart => true,
  }

  exec { 'Disable default apache conf':
    command => 'a2dissite 000-default',
    onlyif  => 'test -f /etc/apache2/sites-enabled/000-default.conf',
    notify  => Service['apache2'],
  }

  exec { 'Enable intelmq apache conf':
    command => 'a2ensite intelmq-vhost',
    creates => '/etc/apache2/sites-enabled/intelmq-vhost.conf',
    notify  => Service['apache2'],
  }

  sunet::nftables::allow { 'allow_http':
    from => any,
    port => 80,
  }

  sunet::nftables::allow { 'allow_https':
    from => any,
    port => 443,
  }
}