################################
###### CONFIGURE WEBSERVER
################################

mkdir ~/autoinstall

cd ~/autoinstall
sudo yum upgrade -y
sudo yum update -y
sudo yum groupinstall "Development tools" -y
sudo yum install epel-release wget htop -y

sudo yum install wget htop iotop mc lynx curl rsync nmap lsof sysstat strace elfutils traceroute telnet bc psmisc mtr git vim-enhanced vim-minimal sharutils tcpdump screen parted lynx psutils dstat unzip ltrace ftp dos2unix unix2dos links tmux bind-utils libsemanage-python -y

#wget https://centos7.iuscommunity.org/ius-release.rpm && sudo rpm -Uvh ius-release.rpm
wget https://repo.ius.io/ius-release-el7.rpm && sudo rpm ius-release-el7.rpm
sudo yum -y install https://rpms.remirepo.net/enterprise/remi-release-7.rpm
sudo yum -y install yum-utils
sudo yum-config-manager --enable remi-php74
sudo yum update -y

cd /etc/yum.repos.d/
sudo wget --no-cache https://assets.funnelflux.com/tools/confs/clickhouse/nginx.repo

sudo yum install bc nginx php php-devel php-pecl-zip php-fpm php-ioncube-loader php-gd php-mbstring php-mcrypt php-mysqlnd php-pdo php-opcache php-pear php-xml php-xmlrpc php-memcached php-bcmath -y

# Configure nginx
cd /etc/
sudo rm -rf nginx
sudo wget --no-cache https://assets.funnelflux.com/tools/confs/clickhouse/nginx.zip
sudo unzip nginx.zip

## Configure php-fpm
cd /etc/
sudo rm -rf php-fpm.*
sudo wget --no-cache https://assets.funnelflux.com/tools/confs/clickhouse/php-fpm.zip
sudo unzip -o php-fpm.zip
sudo mv php-fpm/* .

## memcached server and extension
sudo yum --enablerepo=remi install memcached -y
sudo yum install php-pecl-memcached -y

# make memcached more secure
cmd="perl -pi -w -e 's/OPTIONS=\"\"/OPTIONS=\"-l 127.0.0.1 -U 0\"/g;' /etc/sysconfig/memcached"
eval $cmd

## Install extension: zend opcache
sudo yum install php-pecl-zendopcache -y

## Configure system limits
echo "fs.file-max = 96000" | sudo tee --append /etc/sysctl.conf
echo "*       soft    nofile   90000" | sudo tee --append /etc/security/limits.conf
echo "*       hard    nofile   90000" | sudo tee --append /etc/security/limits.conf
sudo sysctl -p
# Reload new limits without restarting
ulimit -Hn 90000
ulimit -Sn 90000

## Disable SELINUX
setenforce 0
cmd="perl -pi -w -e 's/SELINUX=enforcing/SELINUX=disabled/g;' /etc/selinux/config"
eval $cmd
cmd="perl -pi -w -e 's/SELINUX=permissive/SELINUX=disabled/g;' /etc/selinux/config"
eval $cmd

sudo systemctl start nginx
sudo systemctl start php-fpm
sudo systemctl start memcached
sudo systemctl start postfix

sudo systemctl enable nginx
sudo systemctl enable php-fpm
sudo systemctl enable memcached
sudo systemctl enable postfix

cd ~/
rm -rf ~/autoinstall
rm -rf /usr/share/nginx/html/*
chown nginx:nginx /usr/share/nginx/html/

#disable rpcbind
systemctl stop rpcbind
systemctl disable rpcbind
systemctl stop rpcbind.socket
systemctl disable rpcbind.socket


################################
###### CONFIGURE FIREWALL
################################

# Remove default firewall
sudo yum remove -y firewalld

# And replace with iptables instead
sudo yum install -y iptables-services
sudo systemctl start iptables

# Open ports for nginx, mysql and clickhouse which are closed by default
sudo /usr/libexec/iptables/iptables.init save
echo "
# Generated by iptables-save v1.4.21 on Thu Feb 13 07:33:15 2020
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [10:776]
-A INPUT -p tcp -m tcp --dport 3306 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 8123 -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT
# Completed on Thu Feb 13 07:33:15 2020
" > /etc/sysconfig/iptables
sudo systemctl reload iptables

sudo systemctl enable iptables


################################
###### CONFIGURE MYSQL
################################

mkdir ~/autoinstall

cd ~/autoinstall
sudo yum upgrade -y
sudo yum update -y
sudo yum install epel-release -y
sudo yum install bc htop -y

sudo yum install wget htop iotop mc lynx curl rsync nmap lsof sysstat strace elfutils traceroute telnet bc psmisc mtr git vim-enhanced vim-minimal sharutils tcpdump screen parted lynx psutils dstat unzip ltrace ftp dos2unix unix2dos links tmux bind-utils libsemanage-python -y

cd /etc/yum.repos.d/
sudo wget https://assets.funnelflux.com/tools/confs/clickhouse/mariadb.repo

sudo yum install mariadb MariaDB-server MariaDB-client -y

## Configure mysql/mariadb
cd /etc/my.cnf.d
sudo wget https://assets.funnelflux.com/tools/confs/clickhouse/server-my.cnf

mkdir /var/log/mysql
chown mysql:mysql /var/log/mysql

sudo dd if=/dev/zero of=/swapfile count=4096 bs=1MiB
sudo chmod 600 /swapfile
sudo mkswap /swapfile
sudo swapon /swapfile
echo '/swapfile none swap sw 0 0' | sudo tee -a /etc/fstab

sudo systemctl start mariadb
sudo systemctl enable mariadb

# secure mysql install
mysql -u root -e "UPDATE mysql.user SET Password=PASSWORD('$esc_pass') WHERE User='root';"
mysql -u root -e "DELETE FROM mysql.user WHERE User='';"
mysql -u root -e "DELETE FROM mysql.user WHERE User='root' AND Host NOT IN ('localhost', '127.0.0.1', '::1');"
mysql -u root -e "DROP DATABASE test;"
mysql -u root -e "DELETE FROM mysql.db WHERE Db='test' OR Db='test\\_%'"
mysql -u root -e "FLUSH PRIVILEGES;"

rm -rf ~/autoinstall


################################
###### CONFIGURE CLICKHOUSE
################################

sudo yum install -y pygpgme yum-utils

cd /etc/yum.repos.d/
sudo wget https://assets.funnelflux.com/tools/confs/clickhouse/altinity_clickhouse.repo
sudo yum -q makecache -y --disablerepo='*' --enablerepo='altinity_clickhouse'

sudo yum install -y clickhouse-server clickhouse-client

cd /etc/clickhouse-server
rm -f config.xml users.xml
sudo wget https://assets.funnelflux.com/tools/confs/clickhouse/clickhouse-config.zip
unzip clickhouse-config.zip

sudo service clickhouse-server start
systemctl enable clickhouse-server


echo " "
echo "----------------------------------------------------"
echo "--- Your server is now fully configured"
echo "--- Please run the 2 following commands one by one:"
echo " "
echo "wget https://assets.funnelflux.com/tools/confs/clickhouse/ff2.sh"
echo "sh ff2.sh"
echo " "
