#!/usr/bin/env bash
# monsys-agent installer (Linux).
# Usage: curl -fsSL https://get.monsys.ai/install.sh | MONSYS_TOKEN=<token> sudo bash

set -euo pipefail

MONSYS_HUB_URL="${MONSYS_HUB_URL:-https://api.monsys.ai}"
MONSYS_TOKEN="${MONSYS_TOKEN:?MONSYS_TOKEN is required}"
VERSION="${MONSYS_VERSION:-latest}"

ARCH="$(uname -m)"
case "$ARCH" in
  x86_64|amd64) ARCH=x64 ;;
  aarch64|arm64) ARCH=arm64 ;;
  *) echo "unsupported arch $ARCH" >&2; exit 1 ;;
esac

OS="$(uname -s | tr '[:upper:]' '[:lower:]')"

if [[ "$EUID" -ne 0 ]]; then
  echo "must run as root (use sudo)" >&2; exit 1
fi

echo "→ creating monsys user/dirs"
useradd -r -s /bin/false -d /var/lib/monsys monsys 2>/dev/null || true
install -d -o monsys -g monsys -m 0755 /var/lib/monsys /var/lib/monsys/dumps /var/lib/monsys/quarantine /var/log/monsys
install -d -o root   -g root   -m 0755 /etc/monsys

echo "→ downloading agent ${VERSION} (${OS}-${ARCH})"
curl -fsSL "https://monsys.ai/releases/latest/monsys-agent-${OS}-${ARCH}" \
  -o /usr/local/bin/monsys-agent
chmod 0755 /usr/local/bin/monsys-agent

echo "→ writing /etc/monsys/agent.toml"
cat > /etc/monsys/agent.toml <<EOF
hub_url = "${MONSYS_HUB_URL}"
agent_token = "${MONSYS_TOKEN}"
collect_interval_secs = 15
EOF
chown root:monsys /etc/monsys/agent.toml
chmod 0640 /etc/monsys/agent.toml

echo "→ installing sudoers"
install -m 0440 -o root -g root /dev/stdin /etc/sudoers.d/monsys <<'SUDOERS'
Defaults:monsys !requiretty
monsys ALL=(ALL) NOPASSWD: /usr/sbin/iptables -P INPUT DROP
monsys ALL=(ALL) NOPASSWD: /usr/sbin/iptables -P OUTPUT DROP
monsys ALL=(ALL) NOPASSWD: /usr/sbin/iptables -P FORWARD DROP
monsys ALL=(ALL) NOPASSWD: /usr/sbin/iptables -F
monsys ALL=(ALL) NOPASSWD: /usr/sbin/iptables -A INPUT *
monsys ALL=(ALL) NOPASSWD: /usr/sbin/iptables -A OUTPUT *
monsys ALL=(ALL) NOPASSWD: /usr/sbin/iptables-save
monsys ALL=(ALL) NOPASSWD: /usr/sbin/iptables-restore /var/lib/monsys/iptables-backup.rules
monsys ALL=(ALL) NOPASSWD: /bin/systemctl stop *
monsys ALL=(ALL) NOPASSWD: /bin/systemctl start *
monsys ALL=(ALL) NOPASSWD: /bin/kill -9 *
monsys ALL=(ALL) NOPASSWD: /usr/bin/apt-get install -y *
monsys ALL=(ALL) NOPASSWD: /usr/bin/apt-get upgrade -y *
monsys ALL=(ALL) NOPASSWD: /usr/bin/dnf install -y *
monsys ALL=(ALL) NOPASSWD: /sbin/shutdown -r *
monsys ALL=(ALL) NOPASSWD: /usr/bin/avml /var/lib/monsys/dumps/*
SUDOERS

echo "→ planting honeypot canaries"
/usr/local/bin/monsys-agent --setup-honeypots --config /etc/monsys/agent.toml || true

echo "→ installing systemd unit"
install -m 0644 -o root -g root /dev/stdin /etc/systemd/system/monsys-agent.service <<'UNIT'
[Unit]
Description=Monsys System Monitoring Agent
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=monsys
ExecStart=/usr/local/bin/monsys-agent --config /etc/monsys/agent.toml
Restart=always
RestartSec=10
StandardOutput=journal
StandardError=journal
SyslogIdentifier=monsys-agent
CapabilityBoundingSet=CAP_NET_ADMIN CAP_SYS_PTRACE

[Install]
WantedBy=multi-user.target
UNIT

systemctl daemon-reload
systemctl enable --now monsys-agent

echo
echo "✓ monsys-agent installed."
echo "  status: systemctl status monsys-agent"
echo "  logs:   journalctl -u monsys-agent -f"