#!/bin/sh

slaves="idp2.mit.edu"
master="idp1.mit.edu"

thishost=`hostname | tr '[:upper:]' '[:lower:]'`
if [ "$thishost" != "$master" ]; then
  echo "This procedure should only be run on $master" 1>&2
  exit 1
fi

cd /usr/local/apache2 || exit 1

# Generate new webkdc and webauth keys (to be valid in 2 days), and
# remove any keys that have been around for more than 60 days.
/usr/local/webauth/bin/wa_keyring -f conf/webkdc/keyring add 2d || exit 1
/usr/local/webauth/bin/wa_keyring -f conf/webkdc/keyring gc -60d || exit 1
/usr/local/webauth/bin/wa_keyring -f conf/webauth/keyring add 2d || exit 1
/usr/local/webauth/bin/wa_keyring -f conf/webauth/keyring gc -60d || exit 1

# Restart Apache to pick up the new keys.
/usr/local/apache2/bin/apachectl graceful

# Propagate new keyrings to the slaves.
for host in $slaves ; do
  scp conf/webkdc/keyring $host:/usr/local/apache2/conf/webkdc/keyring
  scp conf/webauth/keyring $host:/usr/local/apache2/conf/webauth/keyring
  ssh $host /usr/local/apache2/bin/apachectl graceful
done

exit 0