#!/usr/bin/env bash
#
# agentbee — customer-facing bootstrap. Served at https://install.securitybeez.com
#
#   Cloud:       curl -fsSL https://install.securitybeez.com | sudo FLEET_TOKEN=xxxx bash
#   Self-hosted: curl -fsSL --cacert internal-ca.crt https://<ip>:7447/bootstrap/install | sudo \
#                  FLEET_TOKEN=xxxx REPO_SERVER=<ip>:7447 FLEET_SERVER=<ip>:7446 \
#                  FLEET_CA=/path/internal-ca.crt bash
#
# Detects the OS/arch, adds the GPG-signed SecurityBeez repo (REPO_SERVER, default
# repo.securitybeez.com), writes the token (+ any self-hosted FLEET_SERVER/FLEET_CA) to
# /etc/agentbee/agent.conf, and installs `agentbee` — which auto-enrolls on install.

set -euo pipefail

# REPO_SERVER points at the package repo — cloud default, or "<ip>:7447" for a self-hosted
# box (whose repo is served on its own port). Must be reachable over HTTPS.
REPO_HOST="${REPO_SERVER:-repo.securitybeez.com}"
GPG_KEY_URL="https://${REPO_HOST}/agentbee.gpg"   # binary keyring (apt signed-by)
GPG_ASC_URL="https://${REPO_HOST}/agentbee.asc"   # ASCII-armored (rpm --import)
KEYRING="/usr/share/keyrings/agentbee.gpg"

[ "$(id -u)" -eq 0 ] || { echo "run as root (sudo)"; exit 1; }
: "${FLEET_TOKEN:?set FLEET_TOKEN=... (from the SecurityBeez portal)}"

. /etc/os-release 2>/dev/null || true
say() { printf '\033[0;36m[agentbee]\033[0m %s\n' "$*"; }

# Self-hosted / self-signed repo: trust the internal CA BEFORE we curl/apt the repo,
# else every fetch fails TLS. (lib.sh isn't available yet — the package ships it.)
trust_ca_bootstrap() {
  [ -n "${FLEET_CA:-}" ] && [ -s "${FLEET_CA:-}" ] || return 0
  say "trusting internal CA (${FLEET_CA})"
  if command -v update-ca-certificates >/dev/null 2>&1 && [ -d /usr/local/share/ca-certificates ]; then
    install -m 0644 "$FLEET_CA" /usr/local/share/ca-certificates/securitybeez-internal-ca.crt
    update-ca-certificates >/dev/null 2>&1 || true
  elif command -v update-ca-trust >/dev/null 2>&1 && [ -d /etc/pki/ca-trust/source/anchors ]; then
    install -m 0644 "$FLEET_CA" /etc/pki/ca-trust/source/anchors/securitybeez-internal-ca.crt
    update-ca-trust extract >/dev/null 2>&1 || true
  fi
}
trust_ca_bootstrap

install_apt() {
  say "adding apt repo (${REPO_HOST})"
  install -m 0755 -d /usr/share/keyrings
  # key is served as a BINARY keyring — no gpg needed on the endpoint
  # (minimal Debian/Ubuntu images don't ship gpg)
  curl -fsSL "$GPG_KEY_URL" -o "$KEYRING"
  chmod 0644 "$KEYRING"
  echo "deb [signed-by=${KEYRING}] https://${REPO_HOST}/apt stable main" \
    > /etc/apt/sources.list.d/agentbee.list
  apt-get update -o Dir::Etc::sourcelist=sources.list.d/agentbee.list \
    -o Dir::Etc::sourceparts=- -o APT::Get::List-Cleanup=0
  write_conf
  apt-get install -y agentbee
}

install_yum() {
  say "adding yum repo (${REPO_HOST})"
  rpm --import "$GPG_ASC_URL"
  cat >/etc/yum.repos.d/agentbee.repo <<EOF
[agentbee]
name=SecurityBeez agentbee
baseurl=https://${REPO_HOST}/yum/\$basearch
enabled=1
gpgcheck=1
gpgkey=${GPG_ASC_URL}
       https://${REPO_HOST}/GPG-KEY-WAZUH
EOF
  rpm --import "https://${REPO_HOST}/GPG-KEY-WAZUH" 2>/dev/null || true
  write_conf
  if command -v dnf >/dev/null; then dnf install -y agentbee; else yum install -y agentbee; fi
}

# Write the token (+ optional self-hosted server/CA) BEFORE install so the package's
# postinstall auto-enrolls against the right server.
write_conf() {
  install -m 0700 -d /etc/agentbee
  umask 077
  {
    printf 'FLEET_TOKEN="%s"\n' "$FLEET_TOKEN"
    # Self-hosted (IP:port) deploy: FLEET_SERVER=<ip>:7446 + FLEET_CA=<internal-ca.crt>.
    # Cloud install = neither (defaults to fleet.securitybeez.com, public cert).
    [ -n "${FLEET_SERVER:-}" ] && printf 'FLEET_HOST="%s"\n' "$FLEET_SERVER"
    if [ -n "${FLEET_CA:-}" ] && [ -s "${FLEET_CA:-}" ]; then
      cp -f "$FLEET_CA" /etc/agentbee/internal-ca.crt
      chmod 0644 /etc/agentbee/internal-ca.crt
      printf 'FLEET_CA="%s"\n' /etc/agentbee/internal-ca.crt
    fi
  } > /etc/agentbee/agent.conf
}

if   command -v apt-get >/dev/null 2>&1; then install_apt
elif command -v dnf >/dev/null 2>&1 || command -v yum >/dev/null 2>&1; then install_yum
else echo "unsupported distro: need apt or yum/dnf" >&2; exit 1
fi

say "done — check status with: sudo agentbee status"