## -*- mode: shell-script; -*-
##
## Lines that start with "##" will be removed before this code is
## added to the generated script. Regular shell comments can be added
## using single "#", these will appear in the script.
##
##
## These are commands built-in policy installer runs on the firewall if
## installation is performed using regular user account for authentication
##
##  Variables:
##
##  {{$fwbprompt}} -- "magic" prompt that installer uses to detect when it is logged in
##  {{$fwdir}}     -- directory on the firewall
##  {{$fwscript}}  -- script name on the firewall
##  {{$rbtimeout}} -- rollback timeout, seconds the firewall waits for the
##                    confirmation before it puts back the ruleset that was
##                    running before
##
##  {{$firewall_name}} -- the name of the firewall object
##
##  run            -- activate the script
##  with_rollback  -- activate the script copied to <script>.new with a
##                    rollback timer
##  confirm        -- confirm that activation, sent over a new connection,
##                    and make <script>.new the script the firewall boots
##                    with
##
##  Note: all commands should be on one line to avoid unnecessary linefeeds.
##  These linefeeds are sent to the server side (to the firewall) and end up
##  on the input of sudo and other commands. This creates difficult to catch
##  race condition which breaks installation process.

{{if run}}echo '{{$fwbprompt}}'; chmod +x {{$fwdir}}/{{$fwscript}}; sudo -S {{$fwdir}}/{{$fwscript}} && echo 'Policy activated'{{endif}}
{{if with_rollback}}echo '{{$fwbprompt}}'; chmod +x {{$fwdir}}/{{$fwscript}}.new; sudo -S {{$fwdir}}/{{$fwscript}}.new try {{$rbtimeout}} && echo 'Policy activated, waiting for confirmation'{{endif}}
{{if confirm}}echo '{{$fwbprompt}}'; sudo -S {{$fwdir}}/{{$fwscript}}.new confirm && mv -f {{$fwdir}}/{{$fwscript}}.new {{$fwdir}}/{{$fwscript}} && echo 'Policy confirmed'{{endif}}
