#!/bin/bash

# 安装和配置CrowdSec脚本
# 用于提供现代化的安全防护和威胁情报

set -e

echo "=================================================================================="
echo "🛡️  安装和配置 CrowdSec - 现代化安全引擎"
echo "=================================================================================="

# 检测操作系统
if [ -f /etc/redhat-release ]; then
    OS="centos"
    PKG_MANAGER="dnf"
elif [ -f /etc/debian_version ]; then
    OS="debian"
    PKG_MANAGER="apt-get"
else
    echo "❌ 不支持的操作系统"
    exit 1
fi

echo "检测到操作系统: $OS"

# 安装CrowdSec
echo ""
echo "📦 安装 CrowdSec..."

if [ "$OS" = "centos" ]; then
    # CentOS/RHEL安装
    echo "添加CrowdSec仓库..."
    curl -s https://packagecloud.io/install/repositories/crowdsec/crowdsec/script.rpm.sh | bash
    
    echo "安装CrowdSec..."
    dnf install -y crowdsec
    
elif [ "$OS" = "debian" ]; then
    # Debian/Ubuntu安装
    echo "添加CrowdSec仓库..."
    curl -s https://packagecloud.io/install/repositories/crowdsec/crowdsec/script.deb.sh | bash
    
    echo "安装CrowdSec..."
    apt-get update
    apt-get install -y crowdsec
fi

# 安装CrowdSec bouncer（用于实际封禁）
echo ""
echo "📦 安装 CrowdSec Firewall Bouncer..."
if [ "$OS" = "centos" ]; then
    dnf install -y crowdsec-firewall-bouncer
elif [ "$OS" = "debian" ]; then
    apt-get install -y crowdsec-firewall-bouncer
fi

# 配置CrowdSec
echo ""
echo "⚙️  配置 CrowdSec..."

# 初始化CrowdSec（如果需要）
if [ ! -f /etc/crowdsec/config.yaml ]; then
    echo "初始化CrowdSec配置..."
    cscli hub update
fi

# 安装常用的解析器和场景
echo ""
echo "📥 安装常用解析器和场景..."
cscli hub update

# 安装SSH解析器
cscli parsers install crowdsecurity/sshd-logs || echo "SSH解析器可能已安装"

# 安装HTTP解析器（用于Web应用保护）
cscli parsers install crowdsecurity/httpd-logs || echo "HTTP解析器可能已安装"

# 安装常见攻击场景
cscli scenarios install crowdsecurity/http-probing || echo "HTTP探测场景可能已安装"
cscli scenarios install crowdsecurity/http-bad-user-agent || echo "Bad User-Agent场景可能已安装"
cscli scenarios install crowdsecurity/http-crawl-non_statics || echo "爬虫场景可能已安装"
cscli scenarios install crowdsecurity/http-sensitive-files || echo "敏感文件访问场景可能已安装"

# 配置本地API
echo ""
echo "🔧 配置本地API..."
if [ ! -f /etc/crowdsec/local_api_credentials.yaml ]; then
    cscli machines add --auto
fi

# 配置bouncer
echo ""
echo "🔧 配置 Firewall Bouncer..."
if [ -f /etc/crowdsec/bouncers/crowdsec-firewall-bouncer.yaml ]; then
    # 备份原配置
    cp /etc/crowdsec/bouncers/crowdsec-firewall-bouncer.yaml /etc/crowdsec/bouncers/crowdsec-firewall-bouncer.yaml.bak.$(date +%Y%m%d_%H%M%S) 2>/dev/null || true
    
    # 确保使用iptables
    sed -i 's/mode: nftables/mode: iptables/' /etc/crowdsec/bouncers/crowdsec-firewall-bouncer.yaml 2>/dev/null || true
    sed -i 's/mode: ipset/mode: iptables/' /etc/crowdsec/bouncers/crowdsec-firewall-bouncer.yaml 2>/dev/null || true
fi

# 启动服务
echo ""
echo "🚀 启动 CrowdSec 服务..."
systemctl enable crowdsec
systemctl restart crowdsec

# 启动bouncer
echo ""
echo "🚀 启动 Firewall Bouncer..."
systemctl enable crowdsec-firewall-bouncer
systemctl restart crowdsec-firewall-bouncer

# 等待服务启动
sleep 3

# 检查服务状态
echo ""
echo "📊 检查服务状态..."
if systemctl is-active --quiet crowdsec; then
    echo "✅ CrowdSec 服务已启动"
else
    echo "❌ CrowdSec 服务启动失败"
    systemctl status crowdsec --no-pager | head -10
    exit 1
fi

if systemctl is-active --quiet crowdsec-firewall-bouncer; then
    echo "✅ Firewall Bouncer 服务已启动"
else
    echo "⚠️  Firewall Bouncer 服务启动失败（可能不影响基本功能）"
fi

# 显示状态
echo ""
echo "📊 CrowdSec 状态："
cscli hub list

echo ""
echo "📊 已安装的场景："
cscli scenarios list

echo ""
echo "📊 机器列表："
cscli machines list

echo ""
echo "=================================================================================="
echo "✅ CrowdSec 安装和配置完成！"
echo "=================================================================================="
echo ""
echo "📋 常用命令："
echo "  - 查看状态: cscli hub list"
echo "  - 查看场景: cscli scenarios list"
echo "  - 查看决策: cscli decisions list"
echo "  - 查看指标: cscli metrics"
echo "  - 手动封禁: cscli decisions add --ip <IP地址> --duration 1h --reason 'Manual ban'"
echo "  - 手动解封: cscli decisions delete --ip <IP地址>"
echo "  - 查看日志: journalctl -u crowdsec -f"
echo ""
echo "🔄 与fail2ban的关系："
echo "  - CrowdSec和fail2ban可以共存"
echo "  - CrowdSec提供威胁情报和更智能的检测"
echo "  - fail2ban继续保护SSH服务"
echo ""
echo "=================================================================================="