#!/bin/bash
# wazuh-agent-maint.sh
# Installs or upgrades Wazuh Agent, installs lynx + mail utilities,
# emails a daily health report, and sets up a daily cron job.
# Tested on Debian/Ubuntu, RHEL/CentOS/Amazon/Rocky/Alma, SUSE.

set -euo pipefail

# ====== USER SETTINGS ======
EMAIL_TO="bitdefender@mail2.calltekcenter.com"          # <- set recipient
WAZUH_MANAGER="wazuh.calltekcenter.com"            # <- set Wazuh manager IP/hostname (optional but recommended)
CRON_HOUR="4"                       # daily run hour (0-23)
CRON_MIN="25"                       # daily run minute (0-59)
# ===========================

LOG_DIR="/var/log"
LOG_FILE="$LOG_DIR/wazuh-agent-maint.log"
REPORT_FILE="/tmp/wazuh-agent-report.$$.txt"
SCRIPT_PATH="/usr/local/sbin/wazuh-agent-maint.sh"
CRON_FILE="/etc/cron.d/wazuh-agent-maint"
OS_RELEASE="/etc/os-release"

need_cmd() { command -v "$1" >/dev/null 2>&1; }
pm=""
detect_pm() {
  if need_cmd apt-get; then pm="apt"
  elif need_cmd dnf; then pm="dnf"
  elif need_cmd yum; then pm="yum"
  elif need_cmd zypper; then pm="zypper"
  else
    echo "Unsupported system: no apt/dnf/yum/zypper found" >&2; exit 1
  fi
}

as_root() {
  if [ "$EUID" -ne 0 ]; then
    echo "This script must run as root." >&2
    exit 1
  fi
}

log() { echo "$(date '+%F %T') $*" | tee -a "$LOG_FILE"; }

add_wazuh_repo() {
  # Per official docs: add Wazuh package repository before install. :contentReference[oaicite:0]{index=0}
  case "$pm" in
    apt)
      mkdir -p /usr/share/keyrings
      curl -fsSL https://packages.wazuh.com/key/GPG-KEY-WAZUH \
        | gpg --no-default-keyring --keyring gnupg-ring:/usr/share/keyrings/wazuh.gpg --import
      chmod 644 /usr/share/keyrings/wazuh.gpg
      echo 'deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main' \
        | tee /etc/apt/sources.list.d/wazuh.list >/dev/null
      apt-get update
      ;;
    yum|dnf)
      rpm --import https://packages.wazuh.com/key/GPG-KEY-WAZUH
      cat >/etc/yum.repos.d/wazuh.repo <<'EOF'
[wazuh]
name=EL-$releasever - Wazuh
baseurl=https://packages.wazuh.com/4.x/yum/
gpgcheck=1
gpgkey=https://packages.wazuh.com/key/GPG-KEY-WAZUH
enabled=1
priority=1
EOF
      ;;
    zypper)
      rpm --import https://packages.wazuh.com/key/GPG-KEY-WAZUH
      cat >/etc/zypp/repos.d/wazuh.repo <<'EOF'
[wazuh]
name=EL-$releasever - Wazuh
baseurl=https://packages.wazuh.com/4.x/yum/
gpgcheck=1
gpgkey=https://packages.wazuh.com/key/GPG-KEY-WAZUH
enabled=1
protect=1
EOF
      zypper --non-interactive refresh
      ;;
  esac
}

install_pkgs() {
  case "$pm" in
    apt)
      DEBIAN_FRONTEND=noninteractive apt-get install -y wazuh-agent lynx mailutils
      ;;
    yum)  yum install -y wazuh-agent lynx mailx ;;
    dnf)  dnf install -y  wazuh-agent lynx mailx ;;
    zypper) zypper --non-interactive install -y wazuh-agent lynx mailx ;;
  esac
}

upgrade_wazuh() {
  case "$pm" in
    apt)   DEBIAN_FRONTEND=noninteractive apt-get install -y --only-upgrade wazuh-agent ;;
    yum)   yum update -y  wazuh-agent ;;
    dnf)   dnf upgrade -y wazuh-agent ;;
    zypper) zypper --non-interactive update -y wazuh-agent ;;
  esac
}

configure_manager() {
  # Set manager <address> if WAZUH_MANAGER is set.
  [ -z "${WAZUH_MANAGER:-}" ] && return 0
  local conf="/var/ossec/etc/ossec.conf"
  if [ -f "$conf" ]; then
    # If a <client><server><address> exists, replace the first one; else insert minimal client/server block.
    if grep -q "<client>" "$conf" && grep -q "<server>" "$conf"; then
      sed -i '0,/<address>.*<\/address>/{s|<address>.*</address>|<address>'"$WAZUH_MANAGER"'</address>|}' "$conf"
    else
      # Insert basic client-server block near end before </ossec_config> if present.
      sed -i 's|</ossec_config>|  <client>\n    <server>\n      <address>'"$WAZUH_MANAGER"'</address>\n    </server>\n  </client>\n</ossec_config>|' "$conf" || true
    fi
  fi
  # The <client>/<server>/<address> config defines where the agent connects. :contentReference[oaicite:1]{index=1}
}

enable_start_agent() {
  systemctl daemon-reload || true
  systemctl enable wazuh-agent
  systemctl restart wazuh-agent
}

ensure_mailer() {
  # We already attempted to install a simple mailer. Verify presence of 'mail'.
  if ! need_cmd mail; then
    log "WARN: 'mail' command not found. Email sending may fail until an MTA/SMTP client is configured."
  fi
}

make_report() {
  {
    echo "Wazuh Agent Daily Report - $(hostname) - $(date -Is)"
    echo "====================================================="
    echo
    echo "[Agent status]"
    systemctl is-enabled wazuh-agent 2>&1 | sed 's/^/  /'
    systemctl is-active  wazuh-agent 2>&1 | sed 's/^/  /'
    echo
    echo "[Agent version]"
    if need_cmd dpkg; then dpkg -s wazuh-agent 2>/dev/null | awk -F': ' '/^Version/ {print "  " $0}'
    elif need_cmd rpm; then rpm -q wazuh-agent 2>/dev/null | sed 's/^/  /'
    else echo "  (pkg manager not detected)"
    fi
    echo
    echo "[Configured manager (from ossec.conf)]"
    awk '/<client>/{flag=1} flag{print} /<\/client>/{flag=0}' /var/ossec/etc/ossec.conf 2>/dev/null | sed 's/^/  /' || true
    echo
    echo "[Recent service log (last 100 lines, 24h)]"
    if need_cmd journalctl; then
      journalctl -u wazuh-agent --since "24 hours ago" -n 100 2>/dev/null | sed 's/^/  /' || true
    else
      tail -n 100 /var/ossec/logs/ossec.log 2>/dev/null | sed 's/^/  /' || true
    fi
  } >"$REPORT_FILE"
}

send_report() {
  if need_cmd mail; then
    mail -s "Wazuh Agent Report: $(hostname) $(date '+%F')" "$EMAIL_TO" < "$REPORT_FILE" || \
      log "WARN: mail send exit code $?"
  else
    log "WARN: 'mail' not available; skipping email."
  fi
}

install_or_upgrade() {
  if rpm -q wazuh-agent >/dev/null 2>&1 || dpkg -s wazuh-agent >/dev/null 2>&1; then
    log "Wazuh agent detected; upgrading..."
    upgrade_wazuh
  else
    log "Wazuh agent not found; adding repo and installing..."
    add_wazuh_repo
    install_pkgs
  fi
  configure_manager
  enable_start_agent
  ensure_mailer
}

install_cron() {
  log "Installing cron entry at $CRON_FILE"
  cat >"$CRON_FILE" <<EOF
# Run daily Wazuh agent maintenance/report
$CRON_MIN $CRON_HOUR * * * root $SCRIPT_PATH >> $LOG_FILE 2>&1
EOF
  chmod 644 "$CRON_FILE"
}

self_install() {
  if [ ! -x "$SCRIPT_PATH" ]; then
    cp -f "$0" "$SCRIPT_PATH"
    chmod 755 "$SCRIPT_PATH"
    log "Installed script to $SCRIPT_PATH"
  fi
  install_cron
  log "Setup complete. Logs: $LOG_FILE"
}

usage() {
  cat <<EOF
Usage: $0 [--setup] [--now]
  --setup  Copy script to $SCRIPT_PATH and install daily cron ($CRON_HOUR:$CRON_MIN).
  --now    Run install/upgrade + generate and email report immediately.
No args:  Run install/upgrade + generate and email report (normal daily run).
EOF
}

main() {
  as_root
  detect_pm
  case "${1:-}" in
    --setup) self_install ;;
    --now|"")
      install_or_upgrade
      make_report
      send_report
      ;;
    -h|--help) usage ;;
    *)
      echo "Unknown option: $1" >&2; usage; exit 1 ;;
  esac
  rm -f "$REPORT_FILE" || true
}

main "$@"