#!/bin/bash
set -e  # Detener el script si ocurre un error

# Configurar Filebeat
echo "Verificando conectividad"
curl -I --connect-timeout 10 --max-time 30 -s -o /dev/null --retry 5 https://artifacts.elastic.co/downloads/beats/filebeat/

if [[ $? -ne 0 ]]; then
  echo "ERROR: No se puede conectar a https://artifacts.elastic.co/downloads/beats/filebeat. Verifica tu conexión a Internet o la disponibilidad"
  exit 1
fi

curl --connect-timeout 10 --max-time 60 --retry 5 -L -o /tmp/filebeat-oss-7.12.1-amd64.deb https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-oss-7.12.1-amd64.deb
sudo dpkg -i /tmp/filebeat-oss-7.12.1-amd64.deb
cp CA/certs/ogagent-fb.mytld.crt.pem          /etc/filebeat/
cp CA/private/ogagent-fb.mytld.key.nopass.pem /etc/filebeat/ogagent-fb.mytld.key.pem

cat >/etc/filebeat/filebeat.yml <<EOF
filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /var/log/opengnsys.log
    - /home/*/opengnsys.log

setup.template.settings:
  index.number_of_shards: 1

output.elasticsearch:
  hosts: ["oglog-os.mytld:9200"]
  username: "admin"
  password: "\$OPENSEARCH_INITIAL_ADMIN_PASSWORD"
  protocol: "https"
  ssl.enabled: true
  ssl.verification_mode: full
  ssl.certificate: "/etc/filebeat/ogagent-fb.mytld.crt.pem"
  ssl.key: "/etc/filebeat/ogagent-fb.mytld.key.pem"

processors:
  - add_host_metadata:
      when.not.contains.tags: forwarded
  - add_cloud_metadata: ~
  - add_docker_metadata: ~
  - add_kubernetes_metadata: ~

seccomp.enabled: false
EOF

systemctl enable --now filebeat

# Verificar que la variable de entorno IP_SERVER esté configurada
if [[ -z "$IP_SERVER" ]]; then
  echo "ERROR: La variable de entorno IP_SERVER no está configurada."
  echo "Por favor, exporta IP_SERVER antes de ejecutar este script."
  exit 1
fi

# Actualizar /etc/hosts con los nombres de dominio
cat >>/etc/hosts <<EOF
$IP_SERVER oglog-jrem.mytld
EOF

echo "Actualizando paquetes e instalando dependencias..."
apt-get update
apt-get -y install \
  prometheus-node-exporter \
  systemd-journal-remote

echo "Configurando TLS y copiando certificados..."
cp CA/certs/ca.crt.pem /etc/ssl/certs/
ln -sf /etc/ssl/certs/ca.crt.pem /etc/ssl/certs/$(openssl x509 -in /etc/ssl/certs/ca.crt.pem -hash -noout).0
cp CA/certs/ogserver.mytld.crt.pem /etc/ssl/certs/
cp CA/private/ogserver.mytld.key.nopass.pem /etc/ssl/private/ogserver.mytld.key.pem
chmod 600 /etc/ssl/private/ogserver.mytld.key.pem
chown root:root /etc/ssl/private/ogserver.mytld.key.pem

echo "Configurando systemd-journal-upload..."
sed -i -e '/DynamicUser/s/.*/DynamicUser=no/' /usr/lib/systemd/system/systemd-journal-upload.service
sed -i -e '/User/       s/.*/User=root/'      /usr/lib/systemd/system/systemd-journal-upload.service
systemctl daemon-reload

sed -i -e '/URL/                   s%.*%URL=https://oglog-jrem.mytld:19532%'                          /etc/systemd/journal-upload.conf
sed -i -e '/ServerKeyFile/         s%.*%ServerKeyFile=/etc/ssl/private/ogserver.mytld.key.pem%'       /etc/systemd/journal-upload.conf
sed -i -e '/ServerCertificateFile/ s%.*%ServerCertificateFile=/etc/ssl/certs/ogserver.mytld.crt.pem%' /etc/systemd/journal-upload.conf
sed -i -e '/TrustedCertificateFile/s%.*%TrustedCertificateFile=/etc/ssl/certs/ca.crt.pem%'            /etc/systemd/journal-upload.conf

echo "Habilitando y arrancando systemd-journal-upload..."
systemctl enable --now systemd-journal-upload

systemctl status systemd-journal-upload --no-pager

echo "Configuración completada con éxito. Los logs se están enviando al servidor remoto."