#!/bin/bash
#
# deploy-rsyslog.sh — rsyslog forwarding to Wazuh for PVE hosts [#335]
# Run as root on the target host. Idempotent; safe to re-run.
# Forwards everything via TCP/514 to tsys-wazuh.knel.net (Tailscale
# overlay; manager allowlist = 100.64.0.0/10). journald stays the local SoR.
#
set -euo pipefail

MGR="tsys-wazuh.knel.net"

if ! dpkg -s rsyslog >/dev/null 2>&1; then
  echo "installing rsyslog"
  DEBIAN_FRONTEND=noninteractive apt-get install -y rsyslog
fi

F=/etc/rsyslog.d/90-forward-wazuh.conf
if [ ! -f "$F" ]; then
  printf '# Wazuh syslog forwarding (Tailscale overlay) [#335]\n*.* @@%s:514\n' "$MGR" > "$F"
  echo "forward rule installed"
else
  echo "forward rule already present"
fi

systemctl enable --now rsyslog >/dev/null 2>&1 || true
systemctl restart rsyslog
sleep 2
systemctl -q is-active rsyslog && echo "rsyslog ACTIVE"
logger -p auth.warning "wazuh-trail-test host=$(hostname) stamp=$(date +%s)"
echo "trail event sent from $(hostname)"