#!/usr/bin/env bash
set -e

OS_ARCH=$(dpkg --print-architecture) || (echo "Not Debian Based Distro" && exit 1)
OS_CODE=$(source /etc/os-release && echo "$VERSION_CODENAME")

main(){
    echo "deb https://packagecloud.io/crowdsec/crowdsec/debian/ $OS_CODE main" | \
        tee /etc/apt/sources.list.d/crowdsec_crowdsec.list
    curl -fsSL "https://packagecloud.io/crowdsec/crowdsec/gpgkey" | \
        gpg --dearmor | tee /etc/apt/trusted.gpg.d/crowdsec_crowdsec-archive-keyring.gpg  > /dev/null

    command="nala"
    command -v $command &>/dev/null || command="apt"
    $command update
    $command install -y crowdsec crowdsec-firewall-bouncer-iptables
}

setup(){
    echo -e "db_config:
  use_wal: true" | tee /etc/crowdsec/config.yaml.local

    echo -e "name: crowdsecurity/whitelists
description: "Whitelist events from custom ip addresses"
whitelist:
  reason: "private ip ranges"
  ip:
    - "127.0.0.1"
    - "::1"
  cidr:
    - "192.168.0.0/16"
    - "10.0.0.0/8"
    - "172.16.0.0/12"
    - "fc00::/7"
  # expression:
  #   - "'foo.com' in evt.Meta.source_ip.reverse"
" | tee /etc/crowdsec/parsers/s02-enrich/custom-whitelists.yaml

    sed -i -r "s/#  - DOCKER-USER/  - DOCKER-USER/g" /etc/crowdsec/bouncers/crowdsec-firewall-bouncer.yaml

    systemctl reload crowdsec
}

usage(){
    echo "Usage: $0 [OPTIONS]";
    echo "OPTIONS:";
    echo "    -i                    install only";
}

INSTALL_ONLY=0;
while getopts ":i" OPT; do
    case $OPT in
    i)
            INSTALL_ONLY=1;
            ;;
    ?)
            echo "Invalid Option: -$OPTARG";
            usage;
            exit 1;;
    esac;
done;

main;
if [ $INSTALL_ONLY -eq 0 ]; then
    setup;
fi;