package util

import (
	"crypto/tls"
	"fmt"
	"net/http"

	"github.rackspace.com/gorax/tools/passkey"
)

// TLSServer : Creates an http.Server with our Rackspace standard configuration using the wildcard NSI cert, TLS 1.2, and a cipher suite that passes PCI scanning
// Proper way to use this after creation is: s.ListenAndServeTLS("", "")
func TLSServer(pk *passkey.Client, handler http.Handler, address, serverName string) (http.Server, error) {
	var combined, key []byte

	combined = []byte(pk.Keys.WildcardCert.Credential.Password + "\r\n" + pk.Keys.WildcardCABundle.Credential.Password)
	key = []byte(pk.Keys.WildcardKey.Credential.Password)

	cert, err := tls.X509KeyPair(combined, key)
	if err != nil {
		return http.Server{}, fmt.Errorf("error generating keypair: %s", err.Error())
	}

	tlsConfig := &tls.Config{
		Certificates:             []tls.Certificate{cert},
		MinVersion:               tls.VersionTLS12,
		PreferServerCipherSuites: true,
		ServerName:               serverName,
		CipherSuites: []uint16{
			// List HTTP/2 approved cipher suites first, otherwise go generates an error
			tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
			tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
			tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
			tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
			tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,
			tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,
			// Remaining cipher suites
			tls.TLS_RSA_WITH_AES_128_CBC_SHA,
			tls.TLS_RSA_WITH_AES_256_CBC_SHA,
			tls.TLS_RSA_WITH_AES_128_CBC_SHA256,
			tls.TLS_RSA_WITH_AES_128_GCM_SHA256,
			tls.TLS_RSA_WITH_AES_256_GCM_SHA384,
			tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
			tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
			tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
			tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
			tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,
			tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,
		},
	}

	return http.Server{
		TLSConfig: tlsConfig,
		Handler:   handler,
		Addr:      address,
	}, nil
}