#!/bin/bash


set -e

INDEXER_NODE_NAME=indexer
CERTIFIED_TAR=/usr/share/wazuh-data/certificate/wazuh-certificates.tar
WAZUH_DATA_DIR=/usr/share/wazuh-data
HYDRAPWK_WAZUH_INDEXER_DIR=/usr/share/wazuh-indexer
HYDRAPWK_WAZUH_INDEXER_ETC=/etc/wazuh-indexer

WAZUH_HYDRAPWK_USER=_wazuh

STOP_ALL_SERVICE=$(/usr/bin/systemctl stop --quiet wazuh-manager.service wazuh-indexer.service wazuh-dashboard.service || true)

if [[ $EUID -ne 0 ]]; then
   echo "This script must be run as root" 
   exit 1
fi

wazuh_start() {
      echo "Starting wazuh about 20sec..."
      chmod 640 /usr/share/wazuh-indexer/config/opensearch.yml
      chmod 755 /usr/share/wazuh-indexer/config
      chmod 755 /usr/share/wazuh-indexer
      chmod 750 /usr/share/wazuh-indexer/config

      chown -R ${WAZUH_HYDRAPWK_USER}:${WAZUH_HYDRAPWK_USER} /etc/wazuh-indexer
      chown -R ${WAZUH_HYDRAPWK_USER}:${WAZUH_HYDRAPWK_USER} /etc/wazuh-indexer/*
      chown -R ${WAZUH_HYDRAPWK_USER}:${WAZUH_HYDRAPWK_USER} /usr/share/wazuh-indexer/config
      chown -R ${WAZUH_HYDRAPWK_USER}:${WAZUH_HYDRAPWK_USER} /usr/share/wazuh-indexer/config/*
      chown -R ${WAZUH_HYDRAPWK_USER}:${WAZUH_HYDRAPWK_USER} /usr/share/wazuh-indexer/
      chown -R ${WAZUH_HYDRAPWK_USER}:${WAZUH_HYDRAPWK_USER} /usr/share/wazuh-indexer/config/opensearch.yml
      chown -R ${WAZUH_HYDRAPWK_USER}:${WAZUH_HYDRAPWK_USER} /etc/wazuh-indexer/internalusers-backup/*
      chown -R ${WAZUH_HYDRAPWK_USER}:${WAZUH_HYDRAPWK_USER} /etc/wazuh-indexer/security-admin
      chown -R ${WAZUH_HYDRAPWK_USER}:${WAZUH_HYDRAPWK_USER} /usr/share/wazuh-indexer/config/internalusers-backup
      chown -R ${WAZUH_HYDRAPWK_USER}:${WAZUH_HYDRAPWK_USER} /usr/share/wazuh-indexer/config/internalusers-backup/*
      
      /usr/bin/systemctl --quiet daemon-reload
      /usr/bin/systemctl --quiet restart wazuh-indexer.service
      /usr/bin/systemctl --quiet restart filebeat.service
      /usr/bin/systemctl --quiet restart wazuh-manager.service
      /usr/bin/systemctl --quiet restart wazuh-dashboard.service



      sleep 20

      if /usr/bin/systemctl --quiet is-active wazuh-indexer.service; then
         echo "Wazuh indexer...OK"
      else
         /usr/bin/journalctl -u wazuh-indexer.service > /tmp/wazuh-indexer.log
         echo "Wazuh indexer fail to start... /tmp/wazuh-indexer.log"
         STOP_ALL_SERVICE
         exit 1
      fi
      if /usr/bin/systemctl --quiet is-active wazuh-manager.service; then
         echo "Wazuh manager...OK"
      else
         /usr/bin/journalctl -u wazuh-manager.service > /tmp/wazuh-manager.log
         echo "Wazuh manager fail to start... /tmp/wazuh-manager.log"
         STOP_ALL_SERVICE
         exit 1
      fi
      if /usr/bin/systemctl --quiet is-active filebeat.service; then
         echo "Filebeat...OK"
         if filebeat test output; then
            :
         else
            echo "Failed to start!!! Fatal error!!!"
            echo "Generating log.... into /tmp/"
            /usr/bin/journalctl -u wazuh-indexer.service > /tmp/wazuh-filebeat-indexer.log
            /usr/bin/journalctl -u wazuh-manager.service > /tmp/wazuh-filebeat-manager.log
            /usr/bin/journalctl -u filebeat.service > /tmp/filebeat.log
            STOP_ALL_SERVICE
            exit 1
         fi
      else
         /usr/bin/journalctl -u filebeat.service > /tmp/filebeat.log
         echo "Filebeat fail to start... /tmp/wazuh-indexer.log"
         STOP_ALL_SERVICE
         exit 1
      fi
      if /usr/bin/systemctl --quiet is-active wazuh-dashboard.service; then
         echo "Wazuh dashboards...OK"
         touch /etc/wazuh-indexer/.success
      else
         /usr/bin/journalctl -u wazuh-dashboard.service > /tmp/wazuh-dashboards.log
         echo "Wazuh dashboards fail to start... /tmp/wazuh-dashboards.log"
         STOP_ALL_SERVICE
      fi

      echo "Login credentials. user: admin password: $(cat /opt/.wazuh-pass-latest)"
      echo "Wazuh starting on https://127.0.0.1:5601"
}

if [[ ! -f /etc/wazuh-indexer/.success ]]; then
   :
else
   rm /etc/wazuh-indexer/.success
fi
      echo "Init for the first time"
      delete_unwanted_file=($HYDRAPWK_WAZUH_INDEXER_ETC/wazuh-certificates* /usr/share/wazuh-indexer/config/certs/ /etc/filebeat/certs/)

      for del_anything in "${delete_unwanted_file[@]}"; do
         rm -rf $del_anything || true
      done

      disable_service=(wazuh-indexer.service wazuh-manager.service filebeat.service wazuh-dashboard.service)

      for cut_off_service in "${disable_service[@]}"; do
         /usr/bin/systemctl --quiet stop $cut_off_service || true
      done

      fix_perm_755_dir=("/usr/share/wazuh-indexer/config" "/usr/share/wazuh-indexer")
      fix_perm_640_files=("/usr/share/wazuh-indexer/config/opensearch.yml" "/usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh")
      fix_perm_750_dir=("/usr/share/wazuh-indexer/config")
      fix_perm_user_dir=("/var/lib/wazuh-dashboard" "/usr/share/wazuh-dashboard" "/etc/wazuh-indexer" "/usr/share/wazuh-indexer/config" "/etc/wazuh-indexer/internalusers-backup" "/etc/wazuh-indexer/security-admin")
      fix_perm_user_file=("/usr/share/wazuh-indexer/config/opensearch.yml")

      chmod +x /usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh
      
      for perm_dir_755 in "${fix_perm_755_dir[@]}"; do
         chmod 755 $perm_dir_755
         chmod 755 $perm_dir_755/*
      done

      for perm_file_640 in "${fix_perm_640_files[@]}"; do
         chmod 640 $perm_file_640
      done

      for perm_dir_750 in "${fix_perm_750_dir[@]}"; do
         chmod 750 $perm_dir_750
         chmod 750 $perm_dir_750/*
      done

      for perm_user_dir in "${fix_perm_user_dir[@]}"; do
         chown -R ${WAZUH_HYDRAPWK_USER}:${WAZUH_HYDRAPWK_USER} $perm_user_dir || true
         chown -R ${WAZUH_HYDRAPWK_USER}:${WAZUH_HYDRAPWK_USER} $perm_user_dir/* || true
      done

      for perm_user_file in "${fix_perm_user_file[@]}"; do
         chown -R ${WAZUH_HYDRAPWK_USER}:${WAZUH_HYDRAPWK_USER} $perm_user_file
      done

      cd $HYDRAPWK_WAZUH_INDEXER_ETC && ./wazuh-certs-tool.sh -A && tar -cvf $HYDRAPWK_WAZUH_INDEXER_ETC/wazuh-certificates.tar -C $HYDRAPWK_WAZUH_INDEXER_ETC/wazuh-certificates . > /dev/null 2>&1
      mkdir -p $HYDRAPWK_WAZUH_INDEXER_ETC/certs
      mkdir -p /usr/share/wazuh-data/certificate/
      if [[ ! -e /usr/share/wazuh-data/certificate/wazuh-certificates.tar ]]; then
         cp $HYDRAPWK_WAZUH_INDEXER_ETC/wazuh-certificates.tar /usr/share/wazuh-data/certificate/
      else
         rm -f $CERTIFIED_TAR
         cp $HYDRAPWK_WAZUH_INDEXER_ETC/wazuh-certificates.tar /usr/share/wazuh-data/certificate/
      fi
      cd $HYDRAPWK_WAZUH_INDEXER_ETC && tar -xf ./wazuh-certificates.tar -C $HYDRAPWK_WAZUH_INDEXER_ETC/certs/ ./$INDEXER_NODE_NAME.pem ./$INDEXER_NODE_NAME-key.pem ./admin.pem ./admin-key.pem ./root-ca.pem
      #cp $HYDRAPWK_WAZUH_INDEXER_DIR/wazuh-certificates/* $HYDRAPWK_WAZUH_INDEXER_ETC/certs/
      mv -n $HYDRAPWK_WAZUH_INDEXER_ETC/certs/$INDEXER_NODE_NAME.pem $HYDRAPWK_WAZUH_INDEXER_ETC/certs/indexer.pem
      mv -n $HYDRAPWK_WAZUH_INDEXER_ETC/certs/$INDEXER_NODE_NAME-key.pem $HYDRAPWK_WAZUH_INDEXER_ETC/certs/indexer-key.pem
      chmod 500 $HYDRAPWK_WAZUH_INDEXER_ETC/certs
      chmod 400 $HYDRAPWK_WAZUH_INDEXER_ETC/certs/*
      chown -R ${WAZUH_HYDRAPWK_USER}:${WAZUH_HYDRAPWK_USER} $HYDRAPWK_WAZUH_INDEXER_ETC/certs


      if [[ -e /etc/filebeat/certs ]]; then
         rm -rf /etc/filebeat/certs
         echo "Directory available"
         mkdir -p /etc/filebeat/certs
      else
         mkdir -p /etc/filebeat/certs
      fi

      tar -xf $CERTIFIED_TAR -C /etc/filebeat/certs/ ./$INDEXER_NODE_NAME.pem ./$INDEXER_NODE_NAME-key.pem ./root-ca.pem
      mv -n /etc/filebeat/certs/$INDEXER_NODE_NAME.pem /etc/filebeat/certs/filebeat.pem
      mv -n /etc/filebeat/certs/$INDEXER_NODE_NAME-key.pem /etc/filebeat/certs/filebeat-key.pem
      chmod 500 /etc/filebeat/certs
      chmod 400 /etc/filebeat/certs/*
      chown -R root:root /etc/filebeat/certs

      # tar -xf $CERTIFIED_TAR -C /var/ossec/etc/ ./$INDEXER_NODE_NAME.pem ./$INDEXER_NODE_NAME-key.pem ./root-ca.pem

      chown -R ${WAZUH_HYDRAPWK_USER}:${WAZUH_HYDRAPWK_USER} /usr/share/wazuh-indexer/config/wazuh-certificates/*
      chown -R ${WAZUH_HYDRAPWK_USER}:${WAZUH_HYDRAPWK_USER} /usr/share/wazuh-indexer/config/wazuh-certificates
      
      echo "Starting wazuh manager"
      /usr/bin/systemctl start wazuh-manager.service
      if /usr/bin/systemctl --quiet is-active wazuh-manager.service; then
         echo "Wazuh manager is online"
      else
         echo "Fail to start wazuh-manager"
         /usr/bin/journalctl -u wazuh-manager.service > /tmp/wazuh-manager.log
         touch /etc/.fail
         STOP_ALL_SERVICE
         exit 1
      fi

      echo "Starting Filebeat giving 8sec to Up"
      /usr/bin/systemctl start filebeat.service
      sleep 8
      if /usr/bin/systemctl --quiet is-active filebeat.service; then
         echo "Filebeat is online"
      else
         echo "Fail to start wazuh-filebeat"
         /usr/bin/journalctl -u wazuh-filebeat.service > /tmp/filebeat.log
         touch /etc/.fail
         STOP_ALL_SERVICE
         exit 1
      fi

      echo "Starting Wazuh indexer giving 30sec to UP"
      /usr/bin/systemctl start wazuh-indexer.service

      sleep 30

      if /usr/bin/systemctl --quiet is-active wazuh-indexer.service; then
         echo "Filebeat is online"
      else
         echo "Fail to start wazuh-indexer"
         /usr/bin/journalctl -u wazuh-indexer.service > /tmp/indexer.log
         touch /etc/.fail
         STOP_ALL_SERVICE
         exit 1
      fi

      echo "Init filebeat"
      
      # Pull filebeat.yml from wazuh-data hydrapwk package
   if [[ ! -f /etc/wazuh-indexer/.fail ]]; then
         touch /etc/wazuh-indexer/.success
      else
         rm /etc/wazuh-indexer/.fail
         touch /etc/wazuh-indexer/.success
         /usr/bin/systemctl stop --quiet wazuh-manager.service wazuh-indexer.service wazuh-dashboard.service || true
      fi

      wazuh_start