#!/bin/bash
#
# deploy-agent.sh — Wazuh agent rollout for Ubuntu VMs [#335]
# Run as root on the target VM. Idempotent; safe to re-run.
# Manager: tsys-wazuh.knel.net (syslog/agent ports verified 2026-09-02).
#
set -euo pipefail

MGR="tsys-wazuh.knel.net"
VER="4.14.7-1"

if ! dpkg -s wazuh-agent >/dev/null 2>&1; then
  echo "installing wazuh-agent $VER (manager: $MGR)"
  curl -sSf --max-time 120 -o /tmp/wazuh-agent.deb \
    "https://packages.wazuh.com/4.x/apt/pool/main/w/wazuh-agent/wazuh-agent_${VER}_amd64.deb"
  WAZUH_MANAGER="$MGR" WAZUH_REGISTRATION_SERVER="$MGR" \
    DEBIAN_FRONTEND=noninteractive dpkg -i /tmp/wazuh-agent.deb
  rm -f /tmp/wazuh-agent.deb
else
  echo "wazuh-agent already installed: $(dpkg -l wazuh-agent | tail -1 | awk '{print $3}')"
fi

CONF=/var/ossec/etc/ossec.conf
if ! grep -q "<address>$MGR</address>" "$CONF"; then
  echo "correcting manager address in ossec.conf"
  cp "$CONF" "$CONF.bak.$(date +%Y%m%d%H%M%S)"
  sed -i "s|<address>[^<]*</address>|<address>$MGR</address>|" "$CONF"
fi

systemctl enable wazuh-agent >/dev/null 2>&1 || true
systemctl restart wazuh-agent
sleep 8
systemctl -q is-active wazuh-agent && echo "wazuh-agent ACTIVE"
grep -iE "enroll|connected to" /var/ossec/logs/ossec.log | tail -3 || echo "(no enrollment lines yet — check manager side)"