#!/bin/bash


set -e

INDEXER_NODE_NAME=indexer
CERTIFIED_TAR=/usr/share/wazuh-data/certificate/wazuh-certificates.tar
WAZUH_DATA_DIR=/usr/share/wazuh-data
HYDRAPWK_WAZUH_INDEXER_DIR=/usr/share/wazuh-indexer
HYDRAPWK_WAZUH_INDEXER_ETC=/etc/wazuh-indexer

WAZUH_HYDRAPWK_USER=_wazuh

STOP_ALL_SERVICE() {
	/usr/bin/systemctl stop --quiet wazuh-manager.service wazuh-indexer.service wazuh-dashboard.service || true
}
if [[ $EUID -ne 0 ]]; then
   echo "This script must be run as root" 
   exit 1
fi

generate_pass() {
    while true; do
        password=$(openssl rand -base64 32 | tr -dc 'A-Za-z0-9.*+?-' | head -c 16)

        if echo "$password" | grep -q '[A-Z]' &&
           echo "$password" | grep -q '[a-z]' &&
           echo "$password" | grep -q '[0-9]' &&
           echo "$password" | grep -q '[\.\*\+\?\-]'; then
            echo "$password"
            return
        fi
    done
}

HYDRAPWK_WAZUH_ADMIN="$(generate_pass)"
HYDRAPWK_WAZUH_ANOMALY="$(generate_pass)"
HYDRAPWK_WAZUH_KIBANASERVER="$(generate_pass)"
HYDRAPWK_WAZUH_KIBANARO="$(generate_pass)"
HYDRAPWK_WAZUH_LOGSTASH="$(generate_pass)"
HYDRAPWK_WAZUH_READALL="$(generate_pass)"
HYDRAPWK_WAZUH_SNAPSHOTRESTORE="$(generate_pass)"

HYDRAPWK_WAZUH_ADMIN_STORE="${HYDRAPWK_WAZUH_ADMIN}"
main() {
	if [[ -e /etc/wazuh-indexer/.success ]]; then
		wazuh_start
	else
		echo "Init for the first time"
		delete_unwanted_file=($HYDRAPWK_WAZUH_INDEXER_ETC/wazuh-certificates* /usr/share/wazuh-indexer/config/certs/ /etc/filebeat/certs/)

		for del_anything in "${delete_unwanted_file[@]}"; do
			rm -rf $del_anything || true
		done

		disable_service=(wazuh-indexer.service wazuh-manager.service filebeat.service wazuh-dashboard.service)

		for cut_off_service in "${disable_service[@]}"; do
			/usr/bin/systemctl --quiet stop $cut_off_service || true
		done

		fix_perm_755_dir=("/usr/share/wazuh-indexer/config" "/usr/share/wazuh-indexer")
		fix_perm_640_files=("/usr/share/wazuh-indexer/config/opensearch.yml" "/usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh")
		fix_perm_750_dir=("/usr/share/wazuh-indexer/config")
		fix_perm_user_dir=("/var/lib/wazuh-dashboard" "/usr/share/wazuh-dashboard" "/etc/wazuh-indexer" "/usr/share/wazuh-indexer/config" "/etc/wazuh-indexer/internalusers-backup" "/etc/wazuh-indexer/security-admin")
		fix_perm_user_file=("/usr/share/wazuh-indexer/config/opensearch.yml")

		chmod +x /usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh
		
		for perm_dir_755 in "${fix_perm_755_dir[@]}"; do
			chmod 755 $perm_dir_755
			chmod 755 $perm_dir_755/*
		done

		for perm_file_640 in "${fix_perm_640_files[@]}"; do
			chmod 640 $perm_file_640
		done

		for perm_dir_750 in "${fix_perm_750_dir[@]}"; do
			chmod 750 $perm_dir_750
			chmod 750 $perm_dir_750/*
		done

		for perm_user_dir in "${fix_perm_user_dir[@]}"; do
			chown -R ${WAZUH_HYDRAPWK_USER}:${WAZUH_HYDRAPWK_USER} $perm_user_dir || true
			chown -R ${WAZUH_HYDRAPWK_USER}:${WAZUH_HYDRAPWK_USER} $perm_user_dir/* || true
		done

		for perm_user_file in "${fix_perm_user_file[@]}"; do
			chown -R ${WAZUH_HYDRAPWK_USER}:${WAZUH_HYDRAPWK_USER} $perm_user_file
		done

		cd $HYDRAPWK_WAZUH_INDEXER_ETC && ./wazuh-certs-tool.sh -A && tar -cvf $HYDRAPWK_WAZUH_INDEXER_ETC/wazuh-certificates.tar -C $HYDRAPWK_WAZUH_INDEXER_ETC/wazuh-certificates . > /dev/null 2>&1
		mkdir -p $HYDRAPWK_WAZUH_INDEXER_ETC/certs
		mkdir -p /usr/share/wazuh-data/certificate/
		if [[ ! -e /usr/share/wazuh-data/certificate/wazuh-certificates.tar ]]; then
			cp $HYDRAPWK_WAZUH_INDEXER_ETC/wazuh-certificates.tar /usr/share/wazuh-data/certificate/
		else
			rm -f $CERTIFIED_TAR
			cp $HYDRAPWK_WAZUH_INDEXER_ETC/wazuh-certificates.tar /usr/share/wazuh-data/certificate/
		fi
		cd $HYDRAPWK_WAZUH_INDEXER_ETC && tar -xf ./wazuh-certificates.tar -C $HYDRAPWK_WAZUH_INDEXER_ETC/certs/ ./$INDEXER_NODE_NAME.pem ./$INDEXER_NODE_NAME-key.pem ./admin.pem ./admin-key.pem ./root-ca.pem
		#cp $HYDRAPWK_WAZUH_INDEXER_DIR/wazuh-certificates/* $HYDRAPWK_WAZUH_INDEXER_ETC/certs/
		mv -n $HYDRAPWK_WAZUH_INDEXER_ETC/certs/$INDEXER_NODE_NAME.pem $HYDRAPWK_WAZUH_INDEXER_ETC/certs/indexer.pem
		mv -n $HYDRAPWK_WAZUH_INDEXER_ETC/certs/$INDEXER_NODE_NAME-key.pem $HYDRAPWK_WAZUH_INDEXER_ETC/certs/indexer-key.pem
		chmod 500 $HYDRAPWK_WAZUH_INDEXER_ETC/certs
		chmod 400 $HYDRAPWK_WAZUH_INDEXER_ETC/certs/*
		chown -R ${WAZUH_HYDRAPWK_USER}:${WAZUH_HYDRAPWK_USER} $HYDRAPWK_WAZUH_INDEXER_ETC/certs


		if [[ -e /etc/filebeat/certs ]]; then
			rm -rf /etc/filebeat/certs
			echo "Directory available"
			mkdir -p /etc/filebeat/certs
		else
			mkdir -p /etc/filebeat/certs
		fi

		tar -xf $CERTIFIED_TAR -C /etc/filebeat/certs/ ./$INDEXER_NODE_NAME.pem ./$INDEXER_NODE_NAME-key.pem ./root-ca.pem
		mv -n /etc/filebeat/certs/$INDEXER_NODE_NAME.pem /etc/filebeat/certs/filebeat.pem
		mv -n /etc/filebeat/certs/$INDEXER_NODE_NAME-key.pem /etc/filebeat/certs/filebeat-key.pem
		chmod 500 /etc/filebeat/certs
		chmod 400 /etc/filebeat/certs/*
		chown -R root:root /etc/filebeat/certs

		# tar -xf $CERTIFIED_TAR -C /var/ossec/etc/ ./$INDEXER_NODE_NAME.pem ./$INDEXER_NODE_NAME-key.pem ./root-ca.pem

		chown -R ${WAZUH_HYDRAPWK_USER}:${WAZUH_HYDRAPWK_USER} /usr/share/wazuh-indexer/config/wazuh-certificates/*
		chown -R ${WAZUH_HYDRAPWK_USER}:${WAZUH_HYDRAPWK_USER} /usr/share/wazuh-indexer/config/wazuh-certificates
		
		echo "Starting wazuh manager"
		/usr/bin/systemctl start wazuh-manager.service
		if /usr/bin/systemctl --quiet is-active wazuh-manager.service; then
			echo "Wazuh manager is online"
		else
			echo "Fail to start wazuh-manager"
			/usr/bin/journalctl -u wazuh-manager.service > /tmp/wazuh-manager.log
			touch /etc/.fail
			STOP_ALL_SERVICE
			exit 1
		fi

		echo "Starting Filebeat giving 8sec to Up"
		/usr/bin/systemctl start filebeat.service
		sleep 8
		if /usr/bin/systemctl --quiet is-active filebeat.service; then
			echo "Filebeat is online"
		else
			echo "Fail to start wazuh-filebeat"
			/usr/bin/journalctl -u wazuh-filebeat.service > /tmp/filebeat.log
			touch /etc/.fail
			STOP_ALL_SERVICE
			exit 1
		fi

		echo "Starting Wazuh indexer giving 60sec to UP"
		/usr/bin/systemctl start wazuh-indexer.service

		sleep 60

		if /usr/bin/systemctl --quiet is-active wazuh-indexer.service; then
			echo "Filebeat is online"
		else
			echo "Fail to start wazuh-indexer"
			/usr/bin/journalctl -u wazuh-indexer.service > /tmp/indexer.log
			touch /etc/.fail
			STOP_ALL_SERVICE
			exit 1
		fi

		echo "Init filebeat"
		
		# Pull filebeat.yml from wazuh-data hydrapwk package

		cp $WAZUH_DATA_DIR/filebeat.yml /etc/filebeat/filebeat.yml

		filebeat keystore create
		if echo admin | filebeat keystore add username --stdin --force; then
			if echo "${HYDRAPWK_WAZUH_ADMIN}" | filebeat keystore add password --stdin --force; then
				:
			else
				echo "Fail to add failbeat keystore"
				touch /etc/.fail
				STOP_ALL_SERVICE
				exit 1
			fi
		else
			echo "Fail to add new failbeat keystore"
			touch /etc/.fail
			STOP_ALL_SERVICE
			exit 1
		fi


		# Pull wazuh template from wazuh-data hydrapwk package  
		if cp $WAZUH_DATA_DIR/wazuh-template.json /etc/filebeat/wazuh-template.json;then
			chmod go+r /etc/filebeat/wazuh-template.json
		else
			echo "Fail to update wazuh-template"
			touch /etc/.fail
			STOP_ALL_SERVICE
			exit 1
		fi

		if echo "admin" | /var/ossec/bin/wazuh-keystore -f indexer -k username; then
			if echo "${HYDRAPWK_WAZUH_ADMIN}" | /var/ossec/bin/wazuh-keystore -f indexer -k password; then
				:
			else
				echo "Failed to update keystore"
				touch /etc/wazuh-indexer/.fail
				STOP_ALL_SERVICE
				exit 1
			fi
		else
			echo "Failed to update keystore."
			STOP_ALL_SERVICE
			exit 1
		fi

		/usr/bin/systemctl daemon-reload
		/usr/bin/systemctl restart wazuh-indexer.service
		echo "Waiting 60 second until indexer online"
		sleep 60
		
		# Update cluster indexer
		
		if systemctl --quiet is-active wazuh-indexer.service; then
			echo "wazuh-indexer online"
		else
			echo "wazuh-indexer is not active..."
			journalctl -u wazuh-indexer > /tmp/wazuh-indexer.log 
			touch /etc/wazuh-indexer/.fail
			STOP_ALL_SERVICE
			exit 1
		fi
		
		chmod +x /usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh

		# /usr/share/wazuh-indexer/bin/indexer-security-init.sh
		echo "Updating wazuh roles"

		# if; then
		# 	:
		# else
		# 	touch /etc/wazuh-indexer/.fail
		# 	STOP_ALL_SERVICE
		# fi
	 	/usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh -cd /etc/wazuh-indexer/security-admin/ -cacert /etc/wazuh-indexer/certs/root-ca.pem -cert /etc/wazuh-indexer/certs/admin.pem -key /etc/wazuh-indexer/certs/admin-key.pem -nhnv
		echo "Update default wazuh-indexer credentials"
		
		if /usr/bin/wazuh-password-tool -u admin -p ${HYDRAPWK_WAZUH_ADMIN_STORE}; then
			echo "user: admin password: ${HYDRAPWK_WAZUH_ADMIN_STORE}" > "/opt/wazuh-pass.$(date +'%d-%m-%Y')"
			echo "${HYDRAPWK_WAZUH_ADMIN_STORE}" > "/opt/.wazuh-pass-latest"
			sed -i "s/hydrapwk-admin-pass/${HYDRAPWK_WAZUH_ADMIN_STORE}/g" /etc/wazuh-dashboard/opensearch_dashboards.yml
		else
			echo "Failed"
			touch /etc/wazuh-indexer/.fail
			STOP_ALL_SERVICE
			exit 1
		fi

		if /usr/bin/wazuh-password-tool -u anomalyadmin -p ${HYDRAPWK_WAZUH_ANOMALY}; then
			echo "user: anomalyadmin password: ${HYDRAPWK_WAZUH_ANOMALY}" >> "/opt/wazuh-pass.$(date +'%d-%m-%Y')"
		else
			echo "Failed"
			touch /etc/wazuh-indexer/.fail
			STOP_ALL_SERVICE
			exit 1
		fi

		if /usr/bin/wazuh-password-tool -u kibanaserver -p ${HYDRAPWK_WAZUH_KIBANASERVER}; then
			echo "user: kibanaserver password: ${HYDRAPWK_WAZUH_KIBANASERVER}" >> "/opt/wazuh-pass.$(date +'%d-%m-%Y')"
		else
			echo "Failed"
			touch /etc/wazuh-indexer/.fail
			STOP_ALL_SERVICE
			exit 1
		fi
		
		if /usr/bin/wazuh-password-tool -u kibanaro -p ${HYDRAPWK_WAZUH_KIBANARO}; then
			echo "user: kibanaro password: ${HYDRAPWK_WAZUH_KIBANARO}" >> "/opt/wazuh-pass.$(date +'%d-%m-%Y')"
		else
			echo "Failed"
			touch /etc/wazuh-indexer/.fail
			STOP_ALL_SERVICE
			exit 1
		fi

		if /usr/bin/wazuh-password-tool -u logstash -p ${HYDRAPWK_WAZUH_LOGSTASH}; then
			echo "user: logstash password: ${HYDRAPWK_WAZUH_LOGSTASH}" >> "/opt/wazuh-pass.$(date +'%d-%m-%Y')"
		else
			echo "Failed"
			touch /etc/wazuh-indexer/.fail
			STOP_ALL_SERVICE
			exit 1
		fi

		if /usr/bin/wazuh-password-tool -u readall -p ${HYDRAPWK_WAZUH_READALL}; then
			echo "user: readall password: ${HYDRAPWK_WAZUH_READALL}" >> "/opt/wazuh-pass.$(date +'%d-%m-%Y')"
		else
			echo "Failed"
			touch /etc/wazuh-indexer/.fail
			STOP_ALL_SERVICE
			exit 1
		fi

		if /usr/bin/wazuh-password-tool -u snapshotrestore -p ${HYDRAPWK_WAZUH_SNAPSHOTRESTORE}; then
			echo "user: snapshotrestore password: ${HYDRAPWK_WAZUH_SNAPSHOTRESTORE}" >> "/opt/wazuh-pass.$(date +'%d-%m-%Y')"
		else
			echo "Failed"
			touch /etc/wazuh-indexer/.fail
			STOP_ALL_SERVICE
			exit 1
		fi

		if [[ ! -f /etc/wazuh-indexer/.fail ]]; then
			touch /etc/wazuh-indexer/.success
		else
			rm /etc/wazuh-indexer/.fail
			touch /etc/wazuh-indexer/.success
			/usr/bin/systemctl stop --quiet wazuh-manager.service wazuh-indexer.service wazuh-dashboard.service || true
		fi

		wazuh_start
	fi
}

wazuh_start() {
		echo "Starting wazuh about 20sec..."
		chmod 640 /usr/share/wazuh-indexer/config/opensearch.yml
		chmod 755 /usr/share/wazuh-indexer/config
      chmod 755 /usr/share/wazuh-indexer
      chmod 750 /usr/share/wazuh-indexer/config

      chown -R ${WAZUH_HYDRAPWK_USER}:${WAZUH_HYDRAPWK_USER} /etc/wazuh-indexer
      chown -R ${WAZUH_HYDRAPWK_USER}:${WAZUH_HYDRAPWK_USER} /etc/wazuh-indexer/*
		chown -R ${WAZUH_HYDRAPWK_USER}:${WAZUH_HYDRAPWK_USER} /usr/share/wazuh-indexer/config
		chown -R ${WAZUH_HYDRAPWK_USER}:${WAZUH_HYDRAPWK_USER} /usr/share/wazuh-indexer/config/*
		chown -R ${WAZUH_HYDRAPWK_USER}:${WAZUH_HYDRAPWK_USER} /usr/share/wazuh-indexer/
		chown -R ${WAZUH_HYDRAPWK_USER}:${WAZUH_HYDRAPWK_USER} /usr/share/wazuh-indexer/config/opensearch.yml
		chown -R ${WAZUH_HYDRAPWK_USER}:${WAZUH_HYDRAPWK_USER} /etc/wazuh-indexer/internalusers-backup/* || true
		chown -R ${WAZUH_HYDRAPWK_USER}:${WAZUH_HYDRAPWK_USER} /etc/wazuh-indexer/security-admin || true
		chown -R ${WAZUH_HYDRAPWK_USER}:${WAZUH_HYDRAPWK_USER} /usr/share/wazuh-indexer/config/internalusers-backup
		chown -R ${WAZUH_HYDRAPWK_USER}:${WAZUH_HYDRAPWK_USER} /usr/share/wazuh-indexer/config/internalusers-backup/*
		
		/usr/bin/systemctl --quiet daemon-reload
		/usr/bin/systemctl --quiet restart wazuh-indexer.service
		/usr/bin/systemctl --quiet restart filebeat.service
		/usr/bin/systemctl --quiet restart wazuh-manager.service
		/usr/bin/systemctl --quiet restart wazuh-dashboard.service



		sleep 20

		if /usr/bin/systemctl --quiet is-active wazuh-indexer.service; then
			echo "Wazuh indexer...OK"
		else
			/usr/bin/journalctl -u wazuh-indexer.service > /tmp/wazuh-indexer.log
			echo "Wazuh indexer fail to start... /tmp/wazuh-indexer.log"
			STOP_ALL_SERVICE
			exit 1
		fi
		if /usr/bin/systemctl --quiet is-active wazuh-manager.service; then
			echo "Wazuh manager...OK"
		else
			/usr/bin/journalctl -u wazuh-manager.service > /tmp/wazuh-manager.log
			echo "Wazuh manager fail to start... /tmp/wazuh-manager.log"
			STOP_ALL_SERVICE
			exit 1
		fi
		if /usr/bin/systemctl --quiet is-active filebeat.service; then
			echo "Filebeat...OK"
		else
			/usr/bin/journalctl -u filebeat.service > /tmp/filebeat.log
			echo "Filebeat fail to start... /tmp/wazuh-indexer.log"
			STOP_ALL_SERVICE
			exit 1
		fi
		if /usr/bin/systemctl --quiet is-active wazuh-dashboard.service; then
			echo "Wazuh dashboards...OK"
		else
			/usr/bin/journalctl -u wazuh-dashboard.service > /tmp/wazuh-dashboards.log
			echo "Wazuh dashboards fail to start... /tmp/wazuh-dashboards.log"
			STOP_ALL_SERVICE
		fi

		echo "Login credentials. user: admin password: $(cat /opt/.wazuh-pass-latest)"
		echo "Your pass has been stored in /opt/wazuh-pass.date"
		echo "Wazuh starting on https://127.0.0.1:5601"
}


main
