#!/usr/bin/env bash
set -euo pipefail

# ============================================================
# CrowdSec Setup Script
# ============================================================
# Este script prepara los directorios, genera la clave del
# bouncer y despliega la configuracion dinamica de Traefik.
# ============================================================

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
ENV_FILE="${SCRIPT_DIR}/.env"

echo "=== CrowdSec Setup ==="

# 1. Cargar .env
if [ ! -f "${ENV_FILE}" ]; then
  echo "ERROR: No se encontro ${ENV_FILE}"
  echo "Crea ${ENV_FILE} con las variables reales y editalo:"
  echo "  nano ${ENV_FILE}"
  exit 1
fi
set -a
source "${ENV_FILE}"
set +a

# 2. Generar clave del bouncer si no esta definida
if [ "${CROWDSEC_BOUNCER_API_KEY}" = "change-me-to-a-random-64-char-hex" ] || [ -z "${CROWDSEC_BOUNCER_API_KEY}" ]; then
  CROWDSEC_BOUNCER_API_KEY=$(openssl rand -hex 32)
  echo "INFO: Generada nueva CROWDSEC_BOUNCER_API_KEY"
  sed -i "s/^CROWDSEC_BOUNCER_API_KEY=.*/CROWDSEC_BOUNCER_API_KEY=${CROWDSEC_BOUNCER_API_KEY}/" "${ENV_FILE}"
fi

# 3. Crear directorios necesarios
sudo mkdir -p "${CROWDSEC_CONFIG_PATH}"
sudo mkdir -p "${CROWDSEC_DATA_PATH}"
sudo mkdir -p "${TRAEFIK_LOG_PATH}"

# 4. Ajustar permisos para SELinux
if command -v selinuxenabled &>/dev/null && selinuxenabled; then
  sudo chcon -Rt svirt_sandbox_file_t "${CROWDSEC_CONFIG_PATH}" 2>/dev/null || true
  sudo chcon -Rt svirt_sandbox_file_t "${CROWDSEC_DATA_PATH}" 2>/dev/null || true
  sudo chcon -Rt svirt_sandbox_file_t "${TRAEFIK_LOG_PATH}" 2>/dev/null || true
fi

# 5. Generar Traefik dynamic config con la key del bouncer
TRAEFIK_DYNAMIC_DIR="/opt/traefik/dynamic"
TEMPLATE="${SCRIPT_DIR}/traefik-crowdsec-bouncer.yml"
OUTPUT="${TRAEFIK_DYNAMIC_DIR}/crowdsec-bouncer.yml"

if [ -f "${TEMPLATE}" ]; then
  sudo mkdir -p "${TRAEFIK_DYNAMIC_DIR}"
  sed "s/{{CROWDSEC_BOUNCER_API_KEY}}/${CROWDSEC_BOUNCER_API_KEY}/g" "${TEMPLATE}" | sudo tee "${OUTPUT}" > /dev/null
  echo "INFO: Traefik dynamic config generado en ${OUTPUT}"
else
  echo "WARN: No se encontro ${TEMPLATE}, la config dinamica de Traefik debe crearse manualmente"
fi

# 6. Generar acquis.yaml para CrowdSec (lee logs de Traefik)
ACQUIS_FILE="${CROWDSEC_CONFIG_PATH}/acquis.yaml"
if [ ! -f "${ACQUIS_FILE}" ]; then
  sudo tee "${ACQUIS_FILE}" > /dev/null <<EOF
---
source: file
filenames:
  - /var/log/traefik/access.log
labels:
  type: traefik
EOF
  echo "INFO: acquis.yaml generado en ${ACQUIS_FILE}"
fi

# 7. Generar acquis.yaml para Docker logs
ACQUIS_DOCKER="${CROWDSEC_CONFIG_PATH}/acquis-docker.yaml"
if [ ! -f "${ACQUIS_DOCKER}" ]; then
  sudo tee "${ACQUIS_DOCKER}" > /dev/null <<EOF
---
source: docker
EOF
  echo "INFO: acquis-docker.yaml generado para logs de contenedores"
fi

# ============================================================
echo ""
echo "=== Setup completado ==="
echo ""
echo "Siguientes pasos:"
echo "  1. (Re)desplegar Traefik para activar los plugins y access logs"
echo "  2. Desplegar CrowdSec: cd ${SCRIPT_DIR} && docker compose up -d"
echo "  3. Verificar: docker logs crowdsec"
echo "  4. El middleware se usa asi: crowdsec-bouncer@file"
echo ""
echo "Para proteger un servicio, agrega el middleware en sus labels de Traefik:"
echo '  traefik.http.routers.<svc>.middlewares: "crowdsec-bouncer@file"'
echo ""
echo "Dashboard Grafana (requiere Authentik): https://${CROWDSEC_GRAFANA_DOMAIN}"