#!/bin/bash
# Nexus Scanner — Installations-Skript
# Läuft auf Debian 12 / Ubuntu 22.04+
# Aufruf: sudo bash install.sh [LUD|BAR]
set -e

SITE="${1:-LUD}"
BINARY_URL="https://it-nexus.cereda-systems.de/downloads/nexus-scanner-linux-amd64"
BINARY="/usr/local/bin/nexus-scanner"
CONFIG_DIR="/etc/nexus-scanner"
DATA_DIR="/var/lib/nexus-scanner"
SERVICE_FILE="/etc/systemd/system/nexus-scanner.service"
USER="nexus-scanner"

echo "=============================="
echo " Nexus Scanner Installation"
echo " Standort: $SITE"
echo "=============================="

# Abhängigkeiten
apt-get update -qq
apt-get install -y -qq curl iputils-ping nmap snmp 2>/dev/null || true

# Benutzer anlegen
if ! id "$USER" &>/dev/null; then
    useradd --system --no-create-home --shell /usr/sbin/nologin "$USER"
    echo "Benutzer $USER angelegt."
fi

# Verzeichnisse
mkdir -p "$CONFIG_DIR" "$DATA_DIR"
chown "$USER:$USER" "$DATA_DIR"

# Binary installieren (aus deploy/-Verzeichnis oder per Download)
if [ -f "./nexus-scanner-linux-amd64" ]; then
    cp ./nexus-scanner-linux-amd64 "$BINARY"
    echo "Binary aus lokalem Verzeichnis installiert."
else
    echo "Binary wird heruntergeladen..."
    curl -fsSL "$BINARY_URL" -o "$BINARY"
fi
chmod 755 "$BINARY"

# Config installieren
if [ ! -f "$CONFIG_DIR/config.yaml" ]; then
    if [ -f "./config.${SITE,,}.yaml" ]; then
        cp "./config.${SITE,,}.yaml" "$CONFIG_DIR/config.yaml"
    else
        # Minimal-Config erzeugen
        cat > "$CONFIG_DIR/config.yaml" << EOF
site: "$SITE"
log_level: "info"
setup_complete: false
db:
  path: "$DATA_DIR/scanner.db"
web:
  addr: ":8090"
  token: ""
nexus:
  url: "https://it-nexus.cereda-systems.de"
  api_key: "nsx-aa0193d719c2be765441e1dd24bf7480"
offline_after: 15m
modules:
  arp_discovery:
    enabled: true
    interval: 5m
    subnets: ["192.168.0.0/24"]
    interface: "eth0"
  site_monitoring:
    enabled: true
    interval: 1m
  port_scan:
    enabled: true
    interval: 15m
  snmp:
    enabled: true
    interval: 5m
    community: "public"
  nexus_reporter:
    enabled: true
    interval: 10m
EOF
    fi
    echo "Config nach $CONFIG_DIR/config.yaml installiert."
fi
chown "$USER":"$USER" "$CONFIG_DIR/config.yaml"
chmod 640 "$CONFIG_DIR/config.yaml"

# systemd Service installieren
cat > "$SERVICE_FILE" << 'EOF'
[Unit]
Description=Nexus Scanner — Netzwerk-Discovery Agent
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=nexus-scanner
Group=nexus-scanner
ExecStart=/usr/local/bin/nexus-scanner /etc/nexus-scanner/config.yaml
Restart=on-failure
RestartSec=10
StandardOutput=journal
StandardError=journal
SyslogIdentifier=nexus-scanner
NoNewPrivileges=yes
ProtectSystem=strict
ProtectHome=yes
ReadWritePaths=/var/lib/nexus-scanner /etc/nexus-scanner
PrivateTmp=yes
AmbientCapabilities=CAP_NET_RAW CAP_NET_ADMIN

[Install]
WantedBy=multi-user.target
EOF

systemctl daemon-reload
systemctl enable nexus-scanner
systemctl restart nexus-scanner

IP=$(hostname -I | awk '{print $1}')
echo ""
echo "=============================="
echo " Installation abgeschlossen!"
echo "=============================="
echo ""
echo " Web-UI:  http://$IP:8090"
echo " Status:  systemctl status nexus-scanner"
echo " Logs:    journalctl -u nexus-scanner -f"
echo ""
echo " Öffne http://$IP:8090 im Browser"
echo " um den Setup-Wizard abzuschließen."
echo ""