#!/usr/bin/env sh
set -eu
cd "$(dirname "$0")"
command -v docker >/dev/null 2>&1 || { echo "Docker fehlt." >&2; exit 1; }
docker compose version >/dev/null 2>&1 || { echo "Docker Compose Plugin fehlt." >&2; exit 1; }

PRESET_ENROLLMENT_KEY="${ENROLLMENT_KEY:-}"
randhex(){ n="$1"; if command -v openssl >/dev/null 2>&1; then openssl rand -hex "$n"; else dd if=/dev/urandom bs="$n" count=1 2>/dev/null | od -An -tx1 | tr -d ' \n'; fi; }
http_ok(){
  url="$1"
  if command -v curl >/dev/null 2>&1; then curl -fsS "$url" >/dev/null 2>&1; return $?; fi
  if command -v wget >/dev/null 2>&1; then wget -q -O /dev/null "$url" >/dev/null 2>&1; return $?; fi
  return 2
}
if [ ! -f .env ]; then
  POSTGRES_PASSWORD="$(randhex 24)"
  CLICKHOUSE_PASSWORD="$(randhex 24)"
  ENROLLMENT_KEY="${PRESET_ENROLLMENT_KEY:-$(randhex 32)}"
  UI_PASSWORD="$(randhex 18)"
  GARAGE_ACCESS_KEY="GK$(randhex 16)"
  GARAGE_SECRET_KEY="$(randhex 32)"
  GARAGE_RPC_SECRET="$(randhex 32)"
  GARAGE_ADMIN_TOKEN="$(randhex 32)"
  GARAGE_METRICS_TOKEN="$(randhex 32)"
  cat > .env <<EOT
INGRESS_BIND=0.0.0.0
INGRESS_PORT=8090
UI_BIND=0.0.0.0
UI_PORT=8080
TENANT_ID=default
UI_USERNAME=admin
UI_PASSWORD=$UI_PASSWORD
POSTGRES_PASSWORD=$POSTGRES_PASSWORD
CLICKHOUSE_PASSWORD=$CLICKHOUSE_PASSWORD
ENROLLMENT_KEY=$ENROLLMENT_KEY
GARAGE_ACCESS_KEY=$GARAGE_ACCESS_KEY
GARAGE_SECRET_KEY=$GARAGE_SECRET_KEY
GARAGE_RPC_SECRET=$GARAGE_RPC_SECRET
GARAGE_ADMIN_TOKEN=$GARAGE_ADMIN_TOKEN
GARAGE_METRICS_TOKEN=$GARAGE_METRICS_TOKEN
GARAGE_BUCKET=siem-raw
EVENT_RETENTION_DAYS=90
ROLLUP_RETENTION_DAYS=730
RAW_RETENTION=720h
RAW_ARCHIVE_ENABLED=true
KAFKA_RETENTION_MS=86400000
KAFKA_PARTITIONS=6
DETECTOR_INTERVAL=30s
DETECTOR_LOOKBACK=20m
UI_QUERY_LIMIT=500
EOT
  chmod 600 .env 2>/dev/null || true
fi
set -a; . ./.env; set +a
UI_USERNAME="${UI_USERNAME:-admin}"
if [ -z "${UI_PASSWORD:-}" ]; then
  UI_PASSWORD="$(randhex 18)"
  printf '\nUI_USERNAME=%s\nUI_PASSWORD=%s\n' "$UI_USERNAME" "$UI_PASSWORD" >> .env
  export UI_USERNAME UI_PASSWORD
fi
sed -e "s/__GARAGE_RPC_SECRET__/$GARAGE_RPC_SECRET/g" -e "s/__GARAGE_ADMIN_TOKEN__/$GARAGE_ADMIN_TOKEN/g" -e "s/__GARAGE_METRICS_TOKEN__/$GARAGE_METRICS_TOKEN/g" deploy/garage/garage.toml.template > deploy/garage/garage.toml
sed -e "s/__EVENT_RETENTION_DAYS__/${EVENT_RETENTION_DAYS:-90}/g" -e "s/__ROLLUP_RETENTION_DAYS__/${ROLLUP_RETENTION_DAYS:-730}/g" deploy/clickhouse/init.sql.template > deploy/clickhouse/init.sql
chmod 600 deploy/garage/garage.toml 2>/dev/null || true

echo "Baue und starte Greenfield SIEM ..."
docker compose build --pull
docker compose up -d --remove-orphans

echo "Prüfe Dienste ..."
if command -v curl >/dev/null 2>&1 || command -v wget >/dev/null 2>&1; then
  i=0
  while [ "$i" -lt 60 ]; do
    if http_ok "http://127.0.0.1:${UI_PORT:-8080}/readyz" && http_ok "http://127.0.0.1:${INGRESS_PORT:-8090}/readyz"; then break; fi
    i=$((i+1)); sleep 2
  done
  if [ "$i" -ge 60 ]; then echo "Deployment gestartet, Healthcheck noch nicht grün. Prüfe: docker compose ps && docker compose logs" >&2; exit 1; fi
else
  echo "Hinweis: curl/wget fehlt; HTTP-Healthcheck wird übersprungen."
  docker compose ps
fi

echo
echo "Greenfield SIEM läuft."
echo "UI:      http://127.0.0.1:${UI_PORT:-8080}/ui"
echo "Ingress: http://127.0.0.1:${INGRESS_PORT:-8090}/ingest"
echo "UI-Login: $UI_USERNAME / $UI_PASSWORD"
echo "Enrollment-Key: $ENROLLMENT_KEY"
echo "Secrets stehen in .env (Datei schützen und sichern)."