#!/bin/bash
#
# SCDRM Installation wizard
#

# User check
if whoami | fgrep root > /dev/null
then printf "\n\tERROR - don't run this as root. Need normal user with sudo privileges.\nExiting.\n\n"
exit 1
fi

# Inventory check
if [[ -s ./inventory ]]
then SYSNO="$(wc -l ./inventory)"
else printf 'Default inventory file is missing or empty!\n\tPlease put your fleet into ${PWD}/inventory\nExiting\n\n'
exit 1
fi

HERE="$(pwd)"
# Setup install_dir variable
sed -i "s#INSTALLDIR#${HERE}#" playbooks/vars/main.yml

# Setup myuser variable
sed -i "s/USER/$USER/" playbooks/vars/main.yml

# Dependency installation
printf '\n\n\tChecking and installing dependencies.\n\n'
if uname -r | fgrep el7 > /dev/null
then sudo yum install ansible python-jmespath -y
elif uname -r | egrep 'el8|el9'
then sudo yum install ansible python3-jmespath -y
else sudo apt-get install python3-pip python3-jmespath -y
fi

pip3 install jmespath

# Gather info
printf '\e[32m\n\nHello and welcome to the SCDRM installation wizard!\e[0m\nJust relax and let us go over few things we need to setup SCDRM for you!\n\n'
printf '\nAre you already using any change management system like Puppet/Ansible/Chef/CFengine, which files you would like to EXCLUDE from SCDRM monitoring?\n\t(y)es | (n)o [default]\n'
read yesno
	case "$yesno" in
		y)      printf "\tOK.Please enter the 'managed by' header you are using (case insensitive)"
			read managedby
			printf '\tOK\n'
			;;
		n)      printf '\tOK\n'
			;;
		*)      true
			;;
esac

printf 'By default SCDRM check is running every 5 minutes. Do you want to change this value into something else?\n\t(y)es | (n)o [default]\n'
read yesno
	case "$yesno" in
		y)      printf "\tOK.Please enter desired frequency in seconds the check should be running?\n"
			read check_freq
			;;
		n)      printf '\tOK\n'
			;;
		*)      true
			;;
esac

printf 'By default SCDRM deletes session logs older then 60 days. Do you want to change this value into something else?\n\t(y)es | (n)o [default]\n'
read yesno
	case "$yesno" in
		y)      printf "\tOK. Logs older then how many days should be deleted?\n"
			read llog_retention
			;;
		n)      printf '\tOK\n'
			;;
		*)      true
			;;
esac

printf "Are you using upstream Git to keep host_vars in?\n\t(y)es | (n)o [default]\n"
read yesno
	case "$yesno" in
		y)      printf "\tOK.Please enter origin's branch name to push to\n"
			read git_branch
			;;
		n)      printf '\tOK\n'
			;;
		*)      true
			;;
esac

printf "In case you are not using default routes you should disable route-guard?\n\t(y)es | (n)o [default]\n"
read yesno
	case "$yesno" in
		y)      printf "\tOK\n"
			sed -i 's/#disable_route_guard: yes/disable_route_guard: yes/' playbooks/scdrm.yml
			;;
		n)      printf '\tOK\n'
			;;
		*)      true
			;;
esac

printf "If you don't wan't to use AIDE, for some reason, it can be omitted. Do you want to disable AIDE?\n\t(y)es | (n)o [default]\n"
read yesno
	case "$yesno" in
		y)      printf "\tOK\n"
			sed -i 's/#disable_aide: yes/disable_aide: yes/' playbooks/scdrm.yml
			;;
		n)      printf '\tOK\n'
			;;
		*)      true
			;;
esac

printf "For more frequent reporting you should really run AIDE check after every change. CAUTION this introduces additional load to the system.\n\tDo you want to disable this feature?\n\t(y)es or (n)o [default]\n"
read yesno
	case "$yesno" in
		y)      printf "\tOK\n"
			sed -i 's/aide_auto_check: true/aide_auto_check: false/' playbooks/vars/main.yml
			;;
		n)      printf '\tOK\n'
			;;
		*)      true
			;;
esac

printf "Do you want to install SCDRM to hosts listed in ./inventory?\n\t(y)es [default] | (n)o\n"
read yesno
	case "$yesno" in
		y)      printf "\tOK\n"
			LOCAL="false"
			;;
		n)      printf '\tOK\n'
			LOCAL="true"
			;;
		*)      LOCAL="false"
			;;
esac

printf "Do you want to enable PARANOID mode?This mode requires you to acknowledge the change before it gets reverted automatically.\nParanoid mode presumes the change needs reverting\n\t(y)es | (n)o [default]\n"
read yesno
	case "$yesno" in
		y)      printf "\tOK\n"
			PARANOIA="true"
			;;
		n)      printf '\tOK\n'
			PARANOIA="false"
			;;
		*)      PARANOIA="false"
			;;
esac

if [[ $PARANOIA == "true" ]]
then
printf "Default paranoia time to wait for change confirmation is 300 seconds\nDo you wish to change this value?\n\t(y)es | (n)o [default]\n"
read yesno
	case "$yesno" in
		y)      printf '\tOK\t- how many seconds should we wait before reverting changes?'
			read paranoia_time
			;;
		n)      printf '\tOK\n'
			;;
		*)      true
			;;
esac
fi

printf "Would you like to install MOTD for extra visibility?\n\t(y)es [default] | (n)o\n"
read yesno
	case "$yesno" in
		y)      printf '\tOK\n'
			set_motd=true
			;;
		n)      printf '\tOK\n'
			set_motd=false
			;;
		*)      true
			set_motd=true
			;;
esac


printf '\nBy default SCDRM runs in DRYRUN mode, meaning no files will be reverted or restored\nThis alows you to collect intelligence about changes in your environment before running active SCDRM.\n'
printf '\e[91m\nInstalling SCDRM now, please wait.\e[0m\n\n'
sleep 2

if [[ $managedby != "" ]]
then sed -i "s/^\ \{4\}my_managed_by_strings_too_look_for/${managedby}/" playbooks/scdrm.yml
sed -i  's/^\ \{4\]managed: 0/    managed: 1/' playbooks/scdrm.yml
fi

if [[ $check_freq != "" ]]
then sed -i "s/^\ \{4\}check_freq.*/    check_freq: ${check_freq}/" playbooks/scdrm.yml
fi

if [[ $llog_retention != "" ]]
then sed -i "s/^\ \{4\}llog_retention:.*/    llog_retention: ${llog_retention}/" playbooks/scdrm.yml
fi

if [[ $PARANOIA == "true" ]]
then sed -i "s/paranoid:.*/paranoid: true/" playbooks/vars/main.yml
fi

if [[ $paranoia_time != "" ]]
then sed -i "s/paranoid_time:.*/paranoid_time: $paranoia_time/" playbooks/vars/main.yml
fi

if [[ $set_motd == "false" ]]
then sed -i "s/set_motd:.*/set_motd: false/" playbooks/vars/main.yml
fi

# Setup change tracking
if [[ ! -d /scdrm/host_vars ]]
then
sudo mkdir -p -m 2775 /scdrm/host_vars > /dev/null 2>&1
sudo groupadd scdrm > /dev/null 2>&1
sudo usermod -a -G scdrm $(whoami) > /dev/null 2>&1
sudo chown -R $(whoami) /scdrm > /dev/null 2>&1
sudo chgrp -R scdrm /scdrm > /dev/null 2>&1
ln -sf /scdrm/host_vars . > /dev/null 2>&1
cd /scdrm/host_vars > /dev/null
git init > /dev/null
git add . > /dev/null
git config init.defaultBranch main
git commit -a -m "Installation init" > /dev/null
	#if [[ ! -d /scdrm/.git ]]
	#then cd /scdrm/host_vars > /dev/null
	#git init > /dev/null
	#git add . > /dev/null
	#git commit -a -m "Installation init" > /dev/null
	#fi
else
# Check group presence
fgrep scdrm /etc/group > /dev/null || (sudo groupadd scdrm && sudo chgrp -R scdrm /scdrm) > /dev/null 2>&1
fgrep scdrm /etc/group | fgrep $USER > /dev/null || sudo usermod -a -G scdrm $(whoami) > /dev/null 2>&1
stat /scdrm/host_vars | awk '/Access/ {print $2}' | fgrep 2775 > /dev/null || sudo chmod 2775 /scdrm/host_vars > /dev/null 2>&1
cd $HERE
ln -s /scdrm/host_vars .
fi

cd $HERE
mkdir log reports > /dev/null 2>&1

if [[ $LOCAL == "false" ]]
then
ansible-playbook playbooks/scdrm.yml | tee log/scdrm-install-log-$(date '+%F-%T').log
fi

if [[ $git_branch != "" ]]
then sed -i "s/^git_branch: main/git_branch: $git_branch/" playbooks/vars/main.yml
sed -i 's/^upstream_git: false/upstream_git: true/' playbooks/vars/main.yml
fi

ansible-playbook playbooks/adminssh.yml

printf '\t\e[32mALL DONE\e[0m\n'
printf '\nFirst thing to do now is to add you team members to "scdrm" group to be able to write to /scdrm/host_vars\n'
printf 'Then you can start using \e[91madminssh\e[0m from this node to enforce new change management process.\nYou can also start using \e[91madminstart-auto\e[0m for your scripts...\n\n'
printf '\t\e[91mThank you for using SCDRM installation wizard!\e[0m\n'
printf '\t\e[32mHave a wonderfull day!\e[0m\n'

exit 0
