import textwrap


def _get_cqlsh_tls_rc_config(node_address, node_port, certfile='/mnt/mesos/sandbox/ca-bundle.crt'):
    """
    Returns a content of `cqlshrc` configuration file with provided hostname,
    port and certfile location. The configuration can be used for connecting
    to cassandra over a TLS connection.
    """
    return textwrap.dedent("""
        [cql]
        ; Substitute for the version of Cassandra you are connecting to.
        version = 3.4.0

        [connection]
        hostname = {hostname}
        port = {port}
        factory = cqlshlib.ssl.ssl_transport_factory

        [ssl]
        certfile = {certfile}
        ; Note: If validate = true then the certificate name must match the machine's hostname
        validate = true
        ; If using client authentication (require_client_auth = true in cassandra.yaml) you'll also need to point to your uesrkey and usercert.
        ; SSL client authentication is only supported via cqlsh on C* 2.1 and greater.
        ; This is disabled by default on all Instaclustr-managed clusters.
        ; userkey = /path/to/userkey.pem
        ; usercert = /path/to/usercert.pem
        """.format(hostname=node_address, port=node_port, certfile=certfile))