#!/usr/bin/env bash
#
# Install and enrol a Wazuh 5.0 agent on a Debian/Ubuntu or RHEL-family host.
#
# Every command below is taken from the Wazuh 5.0-beta installation guide:
# https://documentation.wazuh.com/5.0-beta/installation-guide/wazuh-agent/wazuh-agent-package-linux.html
#
# WARNING: the repository URLs are the PRE-RELEASE STAGING repositories
# published for the 5.0 beta. They are not the production repositories at
# packages.wazuh.com. Re-point this script at the GA repository when 5.0 ships.
#
# Lesson: https://maheshtata.com/wazuh/wazuh-agent-linux/

set -euo pipefail

# ----------------------------------------------------------------------------
# Settings. Override from the environment, e.g.
#   WAZUH_MANAGER=10.0.0.2 AGENT_GROUP=linux-servers ./install-wazuh-agent.sh
# ----------------------------------------------------------------------------
WAZUH_MANAGER="${WAZUH_MANAGER:?set WAZUH_MANAGER to the manager IP or FQDN}"
WAZUH_REGISTRATION_PASSWORD="${WAZUH_REGISTRATION_PASSWORD:?set WAZUH_REGISTRATION_PASSWORD (cat /var/wazuh-manager/etc/authd.pass on the manager)}"

# Optional. The group MUST already exist on the manager or enrolment is
# rejected. Leave empty to land in the 'default' group.
AGENT_GROUP="${AGENT_GROUP:-}"

# Optional. Defaults to the hostname. Set it on cloned hosts.
AGENT_NAME="${AGENT_NAME:-}"

GPG_KEY_URL="https://packages-staging.xdrsiem.wazuh.info/key/GPG-KEY-WAZUH"
APT_REPO="https://packages-staging.xdrsiem.wazuh.info/pre-release/5.x/apt/"
YUM_REPO="https://packages-staging.xdrsiem.wazuh.info/pre-release/5.x/yum/"

AGENT_CONF="/var/ossec/etc/ossec.conf"

require_root() {
  [ "$(id -u)" -eq 0 ] || { echo "Run as root." >&2; exit 1; }
}

add_repo_apt() {
  apt-get install -y gnupg apt-transport-https
  curl -s "$GPG_KEY_URL" \
    | gpg --no-default-keyring --keyring gnupg-ring:/usr/share/keyrings/wazuh.gpg --import
  chmod 644 /usr/share/keyrings/wazuh.gpg
  echo "deb [signed-by=/usr/share/keyrings/wazuh.gpg] ${APT_REPO} unstable main" \
    > /etc/apt/sources.list.d/wazuh.list
  apt-get update
}

add_repo_rpm() {
  rpm --import "$GPG_KEY_URL"
  # Layout for RHEL-compatible systems version 9 and later.
  cat > /etc/yum.repos.d/wazuh.repo << EOF
[wazuh]
gpgcheck=1
gpgkey=${GPG_KEY_URL}
enabled=1
name=EL-\$releasever - Wazuh
baseurl=${YUM_REPO}
priority=1
EOF
}

install_agent() {
  if command -v apt-get >/dev/null 2>&1; then
    add_repo_apt
    WAZUH_MANAGER="$WAZUH_MANAGER" \
    WAZUH_REGISTRATION_PASSWORD="$WAZUH_REGISTRATION_PASSWORD" \
      apt-get install -y wazuh-agent
  elif command -v dnf >/dev/null 2>&1; then
    add_repo_rpm
    WAZUH_MANAGER="$WAZUH_MANAGER" \
    WAZUH_REGISTRATION_PASSWORD="$WAZUH_REGISTRATION_PASSWORD" \
      dnf install -y wazuh-agent
  elif command -v yum >/dev/null 2>&1; then
    add_repo_rpm
    WAZUH_MANAGER="$WAZUH_MANAGER" \
    WAZUH_REGISTRATION_PASSWORD="$WAZUH_REGISTRATION_PASSWORD" \
      yum install -y wazuh-agent
  else
    echo "No supported package manager found (apt-get, dnf, yum)." >&2
    exit 1
  fi
}

# WAZUH_MANAGER and WAZUH_REGISTRATION_PASSWORD are the only deployment
# variables the 5.0-beta Linux install guide documents. Agent name and group
# are set in the configuration file instead, before the first start.
set_name_and_group() {
  [ -n "$AGENT_NAME" ] && \
    echo "Set <agent><enrollment><agent_name>${AGENT_NAME}</agent_name> in ${AGENT_CONF}"
  [ -n "$AGENT_GROUP" ] && \
    echo "Set <agent><enrollment><groups>${AGENT_GROUP}</groups> in ${AGENT_CONF} (the group must already exist on the manager)"
  echo "See ossec.conf.fragment.xml in this folder for the full block."
}

enable_service() {
  systemctl daemon-reload
  systemctl enable wazuh-agent
  systemctl start wazuh-agent
}

pin_version() {
  # Keep the agent from outrunning the manager on an unattended OS update.
  if [ -f /etc/apt/sources.list.d/wazuh.list ]; then
    sed -i "s/^deb /#deb /" /etc/apt/sources.list.d/wazuh.list
    apt-get update
  elif [ -f /etc/yum.repos.d/wazuh.repo ]; then
    sed -i "s/^enabled=1/enabled=0/" /etc/yum.repos.d/wazuh.repo
  fi
}

verify() {
  # Documented values: pending, disconnected, connected.
  grep '^status' /var/ossec/var/run/wazuh-agentd.state || true
}

require_root
install_agent
set_name_and_group
enable_service
pin_version
verify