#!/bin/bash


set -e

INDEXER_NODE_NAME=indexer
CERTIFIED_TAR=/usr/share/wazuh-data/certificate/wazuh-certificates.tar
WAZUH_DATA_DIR=/usr/share/wazuh-data
HYDRAPWK_WAZUH_INDEXER_DIR=/usr/share/wazuh-indexer
HYDRAPWK_WAZUH_INDEXER_ETC=/etc/wazuh-indexer

WAZUH_HYDRAPWK_USER=_wazuh

if [[ $EUID -ne 0 ]]; then
   echo "This script must be run as root" 
   exit 1
fi

generate_pass() {
    while true; do
        password=$(openssl rand -base64 32 | tr -dc 'A-Za-z0-9.*+?-' | head -c 16)

        if echo "$password" | grep -q '[A-Z]' &&
           echo "$password" | grep -q '[a-z]' &&
           echo "$password" | grep -q '[0-9]' &&
           echo "$password" | grep -q '[\.\*\+\?\-]'; then
            echo "$password"
            return
        fi
    done
}

HYDRAPWK_WAZUH_ADMIN="$(generate_pass)"
HYDRAPWK_WAZUH_ANOMALY="$(generate_pass)"
HYDRAPWK_WAZUH_KIBANASERVER="$(generate_pass)"
HYDRAPWK_WAZUH_KIBANARO="$(generate_pass)"
HYDRAPWK_WAZUH_LOGSTASH="$(generate_pass)"
HYDRAPWK_WAZUH_READALL="$(generate_pass)"
HYDRAPWK_WAZUH_SNAPSHOTRESTORE="$(generate_pass)"

HYDRAPWK_WAZUH_ADMIN_STORE="${HYDRAPWK_WAZUH_ADMIN}"

STOP_ALL_SERVICE() {
   /usr/bin/systemctl stop --quiet wazuh-manager.service wazuh-indexer.service wazuh-dashboard.service || true
}

wazuh_start() {
      echo "Starting wazuh about 20sec..."
      chmod 640 /usr/share/wazuh-indexer/config/opensearch.yml
      chmod 755 /usr/share/wazuh-indexer/config
      chmod 755 /usr/share/wazuh-indexer
      chmod 750 /usr/share/wazuh-indexer/config

      chown -R ${WAZUH_HYDRAPWK_USER}:${WAZUH_HYDRAPWK_USER} /etc/wazuh-indexer
      chown -R ${WAZUH_HYDRAPWK_USER}:${WAZUH_HYDRAPWK_USER} /etc/wazuh-indexer/*
      chown -R ${WAZUH_HYDRAPWK_USER}:${WAZUH_HYDRAPWK_USER} /usr/share/wazuh-indexer/config
      chown -R ${WAZUH_HYDRAPWK_USER}:${WAZUH_HYDRAPWK_USER} /usr/share/wazuh-indexer/config/*
      chown -R ${WAZUH_HYDRAPWK_USER}:${WAZUH_HYDRAPWK_USER} /usr/share/wazuh-indexer/
      chown -R ${WAZUH_HYDRAPWK_USER}:${WAZUH_HYDRAPWK_USER} /usr/share/wazuh-indexer/config/opensearch.yml
      chown -R ${WAZUH_HYDRAPWK_USER}:${WAZUH_HYDRAPWK_USER} /etc/wazuh-indexer/internalusers-backup/*
      chown -R ${WAZUH_HYDRAPWK_USER}:${WAZUH_HYDRAPWK_USER} /etc/wazuh-indexer/security-admin
      chown -R ${WAZUH_HYDRAPWK_USER}:${WAZUH_HYDRAPWK_USER} /usr/share/wazuh-indexer/config/internalusers-backup
      chown -R ${WAZUH_HYDRAPWK_USER}:${WAZUH_HYDRAPWK_USER} /usr/share/wazuh-indexer/config/internalusers-backup/*
      
      /usr/bin/systemctl --quiet daemon-reload
      /usr/bin/systemctl --quiet restart wazuh-indexer.service
      /usr/bin/systemctl --quiet restart filebeat.service
      /usr/bin/systemctl --quiet restart wazuh-manager.service
      /usr/bin/systemctl --quiet restart wazuh-dashboard.service



      sleep 20

      if /usr/bin/systemctl --quiet is-active wazuh-indexer.service; then
         echo "Wazuh indexer...OK"
      else
         /usr/bin/journalctl -u wazuh-indexer.service > /tmp/wazuh-indexer.log
         echo "Wazuh indexer fail to start... /tmp/wazuh-indexer.log"
         STOP_ALL_SERVICE
         exit 1
      fi
      if /usr/bin/systemctl --quiet is-active filebeat.service; then
         echo "Filebeat...OK"
      else
         /usr/bin/journalctl -u filebeat.service > /tmp/filebeat.log
         echo "Filebeat fail to start... /tmp/wazuh-indexer.log"
         STOP_ALL_SERVICE
         exit 1
      fi
      if /usr/bin/systemctl --quiet is-active wazuh-manager.service; then
         echo "Wazuh manager...OK"
      else
         /usr/bin/journalctl -u wazuh-manager.service > /tmp/wazuh-manager.log
         echo "Wazuh manager fail to start... /tmp/wazuh-manager.log"
         STOP_ALL_SERVICE
         exit 1
      fi
      if /usr/bin/systemctl --quiet is-active wazuh-dashboard.service; then
         echo "Wazuh dashboards...OK"
      else
         /usr/bin/journalctl -u wazuh-dashboard.service > /tmp/wazuh-dashboard.log
         echo "Wazuh dashboards fail to start... /tmp/wazuh-dashboards.log"
         STOP_ALL_SERVICE
      fi

      echo "Login credentials. user: admin password: ${HYDRAPWK_WAZUH_ADMIN}"
      echo "Wazuh starting on https://127.0.0.1:5800"
}

echo "Generate new password"
if [[ ! -f /etc/wazuh-indexer/.success ]]; then
   :
else
   rm /etc/wazuh-indexer/.success
fi

disable_service=(wazuh-indexer.service wazuh-manager.service filebeat.service wazuh-dashboard.service)

for cut_off_service in "${disable_service[@]}"; do
   /usr/bin/systemctl --quiet stop $cut_off_service || true
done

fix_perm_755_dir=("/usr/share/wazuh-indexer/config" "/usr/share/wazuh-indexer")
fix_perm_640_files=("/usr/share/wazuh-indexer/config/opensearch.yml" "/usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh")
fix_perm_750_dir=("/usr/share/wazuh-indexer/config")
fix_perm_user_dir=("/var/lib/wazuh-dashboard" "/usr/share/wazuh-dashboard" "/etc/wazuh-indexer" "/usr/share/wazuh-indexer/config" "/etc/wazuh-indexer/internalusers-backup" "/etc/wazuh-indexer/security-admin")
fix_perm_user_file=("/usr/share/wazuh-indexer/config/opensearch.yml")

chmod +x /usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh
      
for perm_dir_755 in "${fix_perm_755_dir[@]}"; do
   chmod 755 $perm_dir_755
   chmod 755 $perm_dir_755/*
done

for perm_file_640 in "${fix_perm_640_files[@]}"; do
   chmod 640 $perm_file_640
done

for perm_dir_750 in "${fix_perm_750_dir[@]}"; do
   chmod 750 $perm_dir_750
   chmod 750 $perm_dir_750/*
done

for perm_user_dir in "${fix_perm_user_dir[@]}"; do
   chown -R ${WAZUH_HYDRAPWK_USER}:${WAZUH_HYDRAPWK_USER} $perm_user_dir || true
   chown -R ${WAZUH_HYDRAPWK_USER}:${WAZUH_HYDRAPWK_USER} $perm_user_dir/* || true
done

for perm_user_file in "${fix_perm_user_file[@]}"; do
   chown -R ${WAZUH_HYDRAPWK_USER}:${WAZUH_HYDRAPWK_USER} $perm_user_file
done

cd $HYDRAPWK_WAZUH_INDEXER_ETC && ./wazuh-certs-tool.sh -A && tar -cvf $HYDRAPWK_WAZUH_INDEXER_ETC/wazuh-certificates.tar -C $HYDRAPWK_WAZUH_INDEXER_ETC/wazuh-certificates . > /dev/null 2>&1
mkdir -p $HYDRAPWK_WAZUH_INDEXER_ETC/certs
mkdir -p /usr/share/wazuh-data/certificate/
if [[ ! -e /usr/share/wazuh-data/certificate/wazuh-certificates.tar ]]; then
   cp $HYDRAPWK_WAZUH_INDEXER_ETC/wazuh-certificates.tar /usr/share/wazuh-data/certificate/
else
   rm -f $CERTIFIED_TAR
   cp $HYDRAPWK_WAZUH_INDEXER_ETC/wazuh-certificates.tar /usr/share/wazuh-data/certificate/
fi
cd $HYDRAPWK_WAZUH_INDEXER_ETC && tar -xf ./wazuh-certificates.tar -C $HYDRAPWK_WAZUH_INDEXER_ETC/certs/ ./$INDEXER_NODE_NAME.pem ./$INDEXER_NODE_NAME-key.pem ./admin.pem ./admin-key.pem ./root-ca.pem
      #cp $HYDRAPWK_WAZUH_INDEXER_DIR/wazuh-certificates/* $HYDRAPWK_WAZUH_INDEXER_ETC/certs/
mv -n $HYDRAPWK_WAZUH_INDEXER_ETC/certs/$INDEXER_NODE_NAME.pem $HYDRAPWK_WAZUH_INDEXER_ETC/certs/indexer.pem
mv -n $HYDRAPWK_WAZUH_INDEXER_ETC/certs/$INDEXER_NODE_NAME-key.pem $HYDRAPWK_WAZUH_INDEXER_ETC/certs/indexer-key.pem
chmod 500 $HYDRAPWK_WAZUH_INDEXER_ETC/certs
chmod 400 $HYDRAPWK_WAZUH_INDEXER_ETC/certs/*
chown -R ${WAZUH_HYDRAPWK_USER}:${WAZUH_HYDRAPWK_USER} $HYDRAPWK_WAZUH_INDEXER_ETC/certs


if [[ -e /etc/filebeat/certs ]]; then
   rm -rf /etc/filebeat/certs
   echo "Directory available"
   mkdir -p /etc/filebeat/certs
else
   mkdir -p /etc/filebeat/certs
fi

tar -xf $CERTIFIED_TAR -C /etc/filebeat/certs/ ./$INDEXER_NODE_NAME.pem ./$INDEXER_NODE_NAME-key.pem ./root-ca.pem
mv -n /etc/filebeat/certs/$INDEXER_NODE_NAME.pem /etc/filebeat/certs/filebeat.pem
mv -n /etc/filebeat/certs/$INDEXER_NODE_NAME-key.pem /etc/filebeat/certs/filebeat-key.pem
chmod 500 /etc/filebeat/certs
chmod 400 /etc/filebeat/certs/*
chown -R root:root /etc/filebeat/certs

      # tar -xf $CERTIFIED_TAR -C /var/ossec/etc/ ./$INDEXER_NODE_NAME.pem ./$INDEXER_NODE_NAME-key.pem ./root-ca.pem

chown -R ${WAZUH_HYDRAPWK_USER}:${WAZUH_HYDRAPWK_USER} /usr/share/wazuh-indexer/config/wazuh-certificates/*
chown -R ${WAZUH_HYDRAPWK_USER}:${WAZUH_HYDRAPWK_USER} /usr/share/wazuh-indexer/config/wazuh-certificates
      
echo "Starting wazuh manager"
/usr/bin/systemctl start wazuh-manager.service
if /usr/bin/systemctl --quiet is-active wazuh-manager.service; then
   echo "Wazuh manager is online"
else
   echo "Fail to start wazuh-manager"
   /usr/bin/journalctl -u wazuh-manager.service > /tmp/wazuh-manager.log
   touch /etc/.fail
   STOP_ALL_SERVICE
   exit 1
fi

echo "Starting Filebeat giving 8sec to Up"
/usr/bin/systemctl start filebeat.service
sleep 8
if /usr/bin/systemctl --quiet is-active filebeat.service; then
   echo "Filebeat is online"
else
   echo "Fail to start wazuh-filebeat"
   /usr/bin/journalctl -u wazuh-filebeat.service > /tmp/filebeat.log
   touch /etc/.fail
   STOP_ALL_SERVICE
   exit 1
fi

echo "Starting Wazuh indexer giving 60sec to UP"
/usr/bin/systemctl start wazuh-indexer.service

sleep 60

if /usr/bin/systemctl --quiet is-active wazuh-indexer.service; then
   echo "Filebeat is online"
else
   echo "Fail to start wazuh-indexer"
   /usr/bin/journalctl -u wazuh-indexer.service > /tmp/indexer.log
   touch /etc/.fail
   STOP_ALL_SERVICE
   exit 1
fi

echo "Init filebeat"
      
filebeat keystore create
if echo admin | filebeat keystore add username --stdin --force; then
   if echo "${HYDRAPWK_WAZUH_ADMIN}" | filebeat keystore add password --stdin --force; then
      :
   else
      echo "Fail to add failbeat keystore"
      touch /etc/.fail
      STOP_ALL_SERVICE
      exit 1
   fi
else
   echo "Fail to add new failbeat keystore"
   touch /etc/.fail
   STOP_ALL_SERVICE
   exit 1
fi

if echo "admin" | /var/ossec/bin/wazuh-keystore -f indexer -k username; then
   if echo "${HYDRAPWK_WAZUH_ADMIN}" | /var/ossec/bin/wazuh-keystore -f indexer -k password; then
      :
   else
      echo "Failed to update keystore"
      touch /etc/wazuh-indexer/.fail
      STOP_ALL_SERVICE
      exit 1
   fi
else
   echo "Failed to update keystore."
   STOP_ALL_SERVICE
   exit 1
fi

/usr/bin/systemctl daemon-reload
/usr/bin/systemctl restart wazuh-indexer.service
echo "Waiting 60 second until indexer online"
sleep 60
      
      # Update cluster indexer
      
if systemctl --quiet is-active wazuh-indexer.service; then
   echo "wazuh-indexer online"
else
   echo "wazuh-indexer is not active..."
   journalctl -u wazuh-indexer > /tmp/wazuh-indexer.log 
   touch /etc/wazuh-indexer/.fail
   STOP_ALL_SERVICE
   exit 1
fi
      
chmod +x /usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh

echo "Updating wazuh roles"

/usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh -cd /etc/wazuh-indexer/security-admin/ -cacert /etc/wazuh-indexer/certs/root-ca.pem -cert /etc/wazuh-indexer/certs/admin.pem -key /etc/wazuh-indexer/certs/admin-key.pem -nhnv
echo "Update default wazuh-indexer credentials"
      
if /usr/bin/wazuh-password-tool -u admin -p ${HYDRAPWK_WAZUH_ADMIN_STORE}; then
   echo "user: admin password: ${HYDRAPWK_WAZUH_ADMIN_STORE}" > "/opt/wazuh-pass.$(date +'%d-%m-%Y')"
   echo "user: admin password: ${HYDRAPWK_WAZUH_ADMIN_STORE}" > "/opt/.wazuh-pass-latest"
   sed -i "s/hydrapwk-admin-pass/${HYDRAPWK_WAZUH_ADMIN_STORE}/g" /etc/wazuh-dashboard/opensearch_dashboards.yml
else
   echo "Failed"
   touch /etc/wazuh-indexer/.fail
   STOP_ALL_SERVICE
   exit 1
fi

if /usr/bin/wazuh-password-tool -u anomalyadmin -p ${HYDRAPWK_WAZUH_ANOMALY}; then
   echo "user: anomalyadmin password: ${HYDRAPWK_WAZUH_ANOMALY}" >> "/opt/wazuh-pass.$(date +'%d-%m-%Y')"
else
   echo "Failed"
touch /etc/wazuh-indexer/.fail
   STOP_ALL_SERVICE
   exit 1
fi

if /usr/bin/wazuh-password-tool -u kibanaserver -p ${HYDRAPWK_WAZUH_KIBANASERVER}; then
   echo "user: kibanaserver password: ${HYDRAPWK_WAZUH_KIBANASERVER}" >> "/opt/wazuh-pass.$(date +'%d-%m-%Y')"
else
   echo "Failed"
   touch /etc/wazuh-indexer/.fail
   STOP_ALL_SERVICE
   exit 1
fi
      
if /usr/bin/wazuh-password-tool -u kibanaro -p ${HYDRAPWK_WAZUH_KIBANARO}; then
   echo "user: kibanaro password: ${HYDRAPWK_WAZUH_KIBANARO}" >> "/opt/wazuh-pass.$(date +'%d-%m-%Y')"
else
   echo "Failed"
   touch /etc/wazuh-indexer/.fail
   STOP_ALL_SERVICE
   exit 1
fi

if /usr/bin/wazuh-password-tool -u logstash -p ${HYDRAPWK_WAZUH_LOGSTASH}; then
   echo "user: logstash password: ${HYDRAPWK_WAZUH_LOGSTASH}" >> "/opt/wazuh-pass.$(date +'%d-%m-%Y')"
else
   echo "Failed"
   touch /etc/wazuh-indexer/.fail
   STOP_ALL_SERVICE
   exit 1
fi

if /usr/bin/wazuh-password-tool -u readall -p ${HYDRAPWK_WAZUH_READALL}; then
   echo "user: readall password: ${HYDRAPWK_WAZUH_READALL}" >> "/opt/wazuh-pass.$(date +'%d-%m-%Y')"
else
   echo "Failed"
   touch /etc/wazuh-indexer/.fail
   STOP_ALL_SERVICE
   exit 1
fi

if /usr/bin/wazuh-password-tool -u snapshotrestore -p ${HYDRAPWK_WAZUH_SNAPSHOTRESTORE}; then
   echo "user: snapshotrestore password: ${HYDRAPWK_WAZUH_SNAPSHOTRESTORE}" >> "/opt/wazuh-pass.$(date +'%d-%m-%Y')"
else
   echo "Failed"
   touch /etc/wazuh-indexer/.fail
   STOP_ALL_SERVICE
   exit 1
fi

if [[ ! -f /etc/wazuh-indexer/.fail ]]; then
   touch /etc/wazuh-indexer/.success
else
   rm /etc/wazuh-indexer/.fail
   touch /etc/wazuh-indexer/.success
   /usr/bin/systemctl stop --quiet wazuh-manager.service wazuh-indexer.service wazuh-dashboard.service || true
fi
echo "You may need to update your wazuh kibanaserver opensearch.password: ""  in /etc/wazuh-dashboard/opensearch_dashboard.yml"
