#!/bin/bash
# Einrichtung und Hilfsbefehle fuer den Wazuh-SSH-Pull-Stack.
#
#   ./setup.sh                 Erstinstallation (Passwoerter, Zertifikate, SSH-Key, Images)
#   ./setup.sh host-script     Skript zum Vorbereiten eines Zielhosts ausgeben
#                                ./setup.sh host-script | ssh admin@host sudo sh
#                                Optionen: --sudo (NOPASSWD-sudo), --tunnel (fuer agent_tunnel),
#                                          --user=NAME (Standard wazuh-pull)
#   ./setup.sh keyscan         Host-Keys aller Hosts aus hosts.yml nach ssh/known_hosts
#   ./setup.sh test            SSH-Zugriff und Rechte auf allen Hosts pruefen
#   ./setup.sh apply           hosts.yml uebernehmen (Manager + Collector neu starten)
#   ./setup.sh passwords       Zugangsdaten anzeigen
set -euo pipefail
cd "$(dirname "$0")"

if docker compose version >/dev/null 2>&1; then DC=(docker compose); else DC=(docker-compose); fi

info() { echo -e "\e[1;32m==>\e[0m $*"; }
warn() { echo -e "\e[1;33m!!\e[0m  $*" >&2; }
die()  { echo -e "\e[1;31mFEHLER:\e[0m $*" >&2; exit 1; }

genpw() {
    # Erfuellt die Wazuh-API-Richtlinie (Gross, klein, Ziffer, Sonderzeichen) und
    # enthaelt keine Zeichen, die in den sed-Aufrufen der Wazuh-Images stoeren.
    echo "$(tr -dc 'A-Za-z0-9' </dev/urandom | head -c 24)Aa1."
}

set_env() {  # set_env KEY VALUE
    if grep -q "^$1=" .env; then sed -i "s|^$1=.*|$1=$2|" .env; else echo "$1=$2" >> .env; fi
}

env_get() { grep "^$1=" .env | cut -d= -f2-; }

cmd_init() {
    command -v docker >/dev/null || die "docker fehlt"

    # --- Kernel-Parameter fuer den Indexer ---------------------------------
    local mmc
    mmc=$(cat /proc/sys/vm/max_map_count)
    if [ "$mmc" -lt 262144 ]; then
        warn "vm.max_map_count ist $mmc (empfohlen 262144). Dauerhaft setzen mit:"
        warn "  echo 'vm.max_map_count=262144' | sudo tee /etc/sysctl.d/99-wazuh.conf && sudo sysctl --system"
    fi

    # --- .env + Passwoerter -------------------------------------------------
    [ -f .env ] || cp .env.example .env
    for k in INDEXER_PASSWORD DASHBOARD_PASSWORD API_PASSWORD; do
        if [ -z "$(env_get $k)" ]; then set_env "$k" "$(genpw)"; info "$k erzeugt"; fi
    done
    chmod 600 .env
    local version
    version=$(env_get WAZUH_VERSION)

    # --- internal_users.yml mit Hashes -------------------------------------
    if [ ! -f config/wazuh_indexer/internal_users.yml ]; then
        info "Erzeuge Indexer-Benutzer (Passwort-Hashes)"
        hash() {
            docker run --rm -e JAVA_HOME=/usr/share/wazuh-indexer/jdk --entrypoint bash \
                "wazuh/wazuh-indexer:$version" \
                /usr/share/wazuh-indexer/plugins/opensearch-security/tools/hash.sh -p "$1" 2>/dev/null | tail -1
        }
        local h_admin h_kibana
        h_admin=$(hash "$(env_get INDEXER_PASSWORD)")
        h_kibana=$(hash "$(env_get DASHBOARD_PASSWORD)")
        [[ $h_admin == \$2* && $h_kibana == \$2* ]] || die "Hash-Erzeugung fehlgeschlagen"
        cat > config/wazuh_indexer/internal_users.yml <<EOF
---
# Automatisch erzeugt von setup.sh. Passwoerter stehen in .env.
_meta:
  type: "internalusers"
  config_version: 2

admin:
  hash: "$h_admin"
  reserved: true
  backend_roles:
  - "admin"
  description: "Admin user"

kibanaserver:
  hash: "$h_kibana"
  reserved: true
  description: "Dashboard server user"
EOF
        chmod 644 config/wazuh_indexer/internal_users.yml
    fi

    # --- TLS-Zertifikate ---------------------------------------------------
    if [ ! -f config/wazuh_indexer_ssl_certs/root-ca.pem ]; then
        info "Erzeuge TLS-Zertifikate"
        mkdir -p config/wazuh_indexer_ssl_certs
        docker run --rm \
            -e CERT_TOOL_VERSION="${version%.*}" \
            -v "$PWD/config/wazuh_indexer_ssl_certs/:/certificates/" \
            -v "$PWD/config/certs.yml:/config/certs.yml:ro" \
            wazuh/wazuh-certs-generator:0.0.4
        [ -f config/wazuh_indexer_ssl_certs/root-ca.pem ] || die "Zertifikate wurden nicht erzeugt"
    fi

    # --- SSH-Schluessel ----------------------------------------------------
    if [ ! -f ssh/id_ed25519 ]; then
        info "Erzeuge SSH-Schluessel ssh/id_ed25519"
        ssh-keygen -q -t ed25519 -N "" -C "wazuh-sshpull@$(hostname)" -f ssh/id_ed25519
    fi
    touch ssh/known_hosts
    chmod 600 ssh/id_ed25519

    [ -f hosts.yml ] || { cp hosts.yml.example hosts.yml; warn "hosts.yml aus Beispiel angelegt - bitte anpassen!"; }

    info "Baue Images"
    "${DC[@]}" build

    cat <<EOF

Fertig. Naechste Schritte:
  1. hosts.yml anpassen
  2. Zielhosts vorbereiten:   ./setup.sh host-script | ssh admin@HOST sudo sh
  3. Host-Keys holen:         ./setup.sh keyscan   (Fingerprints pruefen!)
  4. Zugriff testen:          ./setup.sh test
  5. Starten:                 ${DC[*]} up -d
  6. Dashboard:               https://<dieser-server>:$(env_get DASHBOARD_PORT)  (admin / siehe ./setup.sh passwords)
EOF
}

cmd_host_script() {
    [ -f ssh/id_ed25519.pub ] || die "ssh/id_ed25519.pub fehlt - erst ./setup.sh ausfuehren"
    local pub user="wazuh-pull" sudo=no opts="restrict"
    pub=$(cat ssh/id_ed25519.pub)
    for a in "$@"; do
        case "$a" in
            --sudo) sudo=yes ;;
            --tunnel) opts='restrict,port-forwarding,permitlisten="127.0.0.1:1514",permitlisten="127.0.0.1:1515",permitopen="127.0.0.1:1"' ;;
            --user=*) user="${a#--user=}" ;;
            *) die "unbekannte Option $a" ;;
        esac
    done
    cat <<EOF
#!/bin/sh
# Vorbereitung eines Hosts fuer Wazuh-SSH-Pull (als root ausfuehren)
set -e
U='$user'
if ! id "\$U" >/dev/null 2>&1; then
    useradd --system --create-home --shell /bin/sh "\$U" 2>/dev/null || adduser -D -s /bin/sh "\$U"
    usermod -p '*' "\$U" 2>/dev/null || true   # kein Passwort, aber nicht gesperrt (sonst lehnt sshd ab)
fi
# Leserechte auf Logs: journald (systemd-journal) und /var/log (adm)
for g in systemd-journal adm; do
    getent group "\$g" >/dev/null && usermod -aG "\$g" "\$U" 2>/dev/null || true
done
H=\$(getent passwd "\$U" | cut -d: -f6)
mkdir -p "\$H/.ssh"
# restrict: kein PTY, kein Agent-/X11-/Port-Forwarding.
# Mit --tunnel nur Reverse-Forwarding auf 127.0.0.1:1514/1515 (fuer agent_tunnel).
KEY='$opts $pub'
grep -qF '$pub' "\$H/.ssh/authorized_keys" 2>/dev/null || echo "\$KEY" >> "\$H/.ssh/authorized_keys"
chown -R "\$U:" "\$H/.ssh"; chmod 700 "\$H/.ssh"; chmod 600 "\$H/.ssh/authorized_keys"
EOF
    if [ "$sudo" = yes ]; then
        cat <<EOF
echo "\$U ALL=(root) NOPASSWD: ALL" > /etc/sudoers.d/wazuh-pull
chmod 440 /etc/sudoers.d/wazuh-pull
visudo -cf /etc/sudoers.d/wazuh-pull
EOF
    fi
    echo 'echo "Host vorbereitet: Benutzer $U ($(id $U))"'
}

case "${1:-init}" in
    init)        cmd_init ;;
    host-script) shift; cmd_host_script "$@" ;;
    keyscan)     "${DC[@]}" run --rm --no-deps sshpull.collector keyscan ;;
    test)        "${DC[@]}" run --rm --no-deps sshpull.collector test ;;
    apply)       "${DC[@]}" up -d --force-recreate wazuh.manager sshpull.collector ;;
    passwords)
        echo "Dashboard:  admin / $(env_get INDEXER_PASSWORD)"
        echo "Wazuh-API:  wazuh-wui / $(env_get API_PASSWORD)"
        ;;
    *) sed -n '2,13p' "$0"; exit 2 ;;
esac