install.sh

#!/bin/bash
set -euo pipefail

cleanup() {
    local exit_code=$?
    if [[ -d "${HOST_TMP:-}/qualys" ]]; then
        rm -rf "${HOST_TMP}/qualys" 2>/dev/null || true
    fi
    exit $exit_code
}
trap cleanup EXIT

# Required settings
ACTIVATION_ID="${ACTIVATION_ID:-}"
CUSTOMER_ID="${CUSTOMER_ID:-}"
SERVER_URI="${SERVER_URI:-}"

# Logging settings
LOG_LEVEL="${LOG_LEVEL:-3}"
LOG_FILE_DIR="${LOG_FILE_DIR:-}"
LOG_DEST_TYPE="${LOG_DEST_TYPE:-}"
LOG_COMPRESSION="${LOG_COMPRESSION:-}"

# Performance settings
CMD_MAX_TIMEOUT="${CMD_MAX_TIMEOUT:-}"
PROCESS_PRIORITY="${PROCESS_PRIORITY:-}"
SCAN_DELAY_VM="${SCAN_DELAY_VM:-}"
SCAN_DELAY_PC="${SCAN_DELAY_PC:-}"
MAX_RANDOM_SCAN_INTERVAL_VM="${MAX_RANDOM_SCAN_INTERVAL_VM:-}"
MAX_RANDOM_SCAN_INTERVAL_PC="${MAX_RANDOM_SCAN_INTERVAL_PC:-}"

# Permission settings
USE_SUDO="${USE_SUDO:-}"
SUDO_COMMAND="${SUDO_COMMAND:-}"
AGENT_USER="${AGENT_USER:-}"
AGENT_GROUP="${AGENT_GROUP:-}"

# Other settings
USE_AUDIT_DISPATCHER="${USE_AUDIT_DISPATCHER:-}"
HOST_ID_SEARCH_DIR="${HOST_ID_SEARCH_DIR:-}"

# Proxy settings
QUALYS_HTTPS_PROXY="${QUALYS_HTTPS_PROXY:-}"
HTTPS_PROXY="${HTTPS_PROXY:-}"
QUALYS_PROXY_ORDER="${QUALYS_PROXY_ORDER:-}"
PROXY_FAIL_OPEN="${PROXY_FAIL_OPEN:-}"
CA_CERT_BUNDLE="${CA_CERT_BUNDLE:-}"

# Host paths
HOST_TMP="/host/tmp"
HOST_ETC="/host/etc"
HOST_VAR="/host/var"
HOST_RUN="/host/run"
AGENT_CONFIG_PATH="${HOST_ETC}/qualys/cloud-agent"
INSTALL_COMPLETE_MARKER="/opt/qualys/.install_complete"

run_on_host() {
    nsenter --target 1 --mount --uts --ipc --net --pid -- "$@"
}

run_package_install() {
    local pkg_manager="$1"
    local package_path="$2"
    local package_name
    package_name=$(basename "$package_path")

    if [[ "$pkg_manager" == "dpkg" ]]; then
        run_on_host bash -c 'cd /tmp/qualys && if ! dpkg -i "$1"; then apt-get install -f -y || exit 1; dpkg -i "$1" || exit 1; fi' _ "$package_name"
    else
        run_on_host bash -c '
            cd /tmp/qualys
            pkg="$1"
            if ! rpm -ivh "$pkg" 2>/dev/null; then
                if command -v dnf >/dev/null 2>&1; then
                    dnf install -y "/tmp/qualys/$pkg" || exit 1
                elif command -v yum >/dev/null 2>&1; then
                    yum install -y "/tmp/qualys/$pkg" || exit 1
                elif command -v zypper >/dev/null 2>&1; then
                    zypper --non-interactive install "/tmp/qualys/$pkg" || exit 1
                else
                    rpm -ivh --nodeps "$pkg" || exit 1
                fi
            fi
        ' _ "$package_name"
    fi
}

echo "Checking for existing Qualys Cloud Agent installation..."
if run_on_host systemctl is-active qualys-cloud-agent --quiet 2>/dev/null; then
    echo "Qualys Cloud Agent is already installed and running on this host."
    echo "Skipping installation. Container will maintain DaemonSet pod..."
    touch "$INSTALL_COMPLETE_MARKER"
    exec sleep infinity
fi

echo "Starting Qualys Cloud Agent installation..."
echo "Activation ID: [REDACTED - ${#ACTIVATION_ID} chars]"
echo "Customer ID: [REDACTED - ${#CUSTOMER_ID} chars]"
echo "Server URI: ${SERVER_URI}"

if [[ -z "$ACTIVATION_ID" ]]; then
    echo "ERROR: Missing required environment variable: ACTIVATION_ID"
    exit 1
fi
if [[ -z "$CUSTOMER_ID" ]]; then
    echo "ERROR: Missing required environment variable: CUSTOMER_ID"
    exit 1
fi
if [[ -z "$SERVER_URI" ]]; then
    echo "ERROR: Missing required environment variable: SERVER_URI"
    exit 1
fi

echo "Detecting host operating system and architecture..."

OS_ID=""
OS_ID_LIKE=""
if [[ -f "${HOST_ETC}/os-release" ]]; then
    OS_ID=$(grep -E '^ID=' "${HOST_ETC}/os-release" | head -1 | cut -d= -f2 | tr -d '"' | tr -d "'" || true)
    OS_ID_LIKE=$(grep -E '^ID_LIKE=' "${HOST_ETC}/os-release" | head -1 | cut -d= -f2 | tr -d '"' | tr -d "'" || true)
    echo "Detected OS ID: ${OS_ID:-unknown}"
    echo "OS ID_LIKE: ${OS_ID_LIKE:-none}"
else
    echo "WARNING: Cannot read /etc/os-release from host"
fi

HOST_ARCH=$(run_on_host uname -m)
echo "Detected architecture: $HOST_ARCH"

ARCH=""
case "$HOST_ARCH" in
    x86_64|amd64)
        ARCH="x64"
        ;;
    aarch64|arm64)
        ARCH="arm64"
        ;;
    *)
        echo "ERROR: Unsupported architecture: $HOST_ARCH"
        echo "Supported architectures: x86_64, aarch64"
        exit 1
        ;;
esac

PACKAGE_MGR=""
OS_FAMILY=""

if run_on_host which dpkg > /dev/null 2>&1; then
    PACKAGE_MGR="dpkg"
    OS_FAMILY="debian"
    echo "Detected Debian-based system (Ubuntu, Debian, etc.)"
elif run_on_host which rpm > /dev/null 2>&1; then
    PACKAGE_MGR="rpm"
    OS_FAMILY="rhel"
    echo "Detected RPM-based system (RHEL, CentOS, CoreOS, etc.)"
else
    echo "ERROR: Could not detect supported package manager on host"
    echo "Host must have either dpkg (Debian/Ubuntu) or rpm (RHEL/CentOS/CoreOS)"
    exit 1
fi

case "$OS_FAMILY" in
    debian)
        case "$OS_ID" in
            ubuntu)  echo "Confirmed Ubuntu system" ;;
            debian)  echo "Confirmed Debian system" ;;
            *)       echo "Debian-based system (ID: ${OS_ID:-unknown})" ;;
        esac
        ;;
    rhel)
        case "$OS_ID" in
            rhel|rhel*)     echo "Confirmed Red Hat Enterprise Linux" ;;
            centos)         echo "Confirmed CentOS system" ;;
            fedora)         echo "Confirmed Fedora system" ;;
            *coreos*|flatcar) echo "Confirmed CoreOS/Container Linux system" ;;
            amzn)           echo "Confirmed Amazon Linux system" ;;
            sles|opensuse*) echo "Confirmed SUSE Linux system" ;;
            *)              echo "RPM-based system (ID: ${OS_ID:-unknown})" ;;
        esac
        ;;
esac

echo "Looking for Qualys Cloud Agent package for ${OS_FAMILY}-${ARCH}..."

PACKAGE_EXTENSION=""
if [[ "$OS_FAMILY" == "debian" ]]; then
    PACKAGE_EXTENSION="deb"
else
    PACKAGE_EXTENSION="rpm"
fi

PACKAGE_PATH=""
PACKAGE_NAME=""

ARCH_SPECIFIC_PACKAGE="/opt/qualys/qualys-cloud-agent-${ARCH}.${PACKAGE_EXTENSION}"
GENERIC_PACKAGE="/opt/qualys/qualys-cloud-agent.${PACKAGE_EXTENSION}"

if [[ -f "$ARCH_SPECIFIC_PACKAGE" ]] && [[ -s "$ARCH_SPECIFIC_PACKAGE" ]]; then
    PACKAGE_PATH="$ARCH_SPECIFIC_PACKAGE"
    PACKAGE_NAME=$(basename "$PACKAGE_PATH")
    echo "Found architecture-specific package: $PACKAGE_NAME"
elif [[ -f "$GENERIC_PACKAGE" ]] && [[ -s "$GENERIC_PACKAGE" ]]; then
    PACKAGE_PATH="$GENERIC_PACKAGE"
    PACKAGE_NAME=$(basename "$PACKAGE_PATH")
    echo "Found generic package: $PACKAGE_NAME"
    echo "WARNING: Using generic package - may not be optimized for $ARCH architecture"
else
    echo "ERROR: No suitable Qualys Cloud Agent package found"
    echo "Expected packages:"
    echo "  - Architecture-specific: qualys-cloud-agent-${ARCH}.${PACKAGE_EXTENSION}"
    echo "  - Generic fallback: qualys-cloud-agent.${PACKAGE_EXTENSION}"
    echo ""
    echo "Available packages in /opt/qualys/:"
    ls -la /opt/qualys/qualys-cloud-agent* 2>/dev/null || echo "  None found"
    exit 1
fi

if command -v file >/dev/null 2>&1; then
    PACKAGE_ARCH_INFO=$(file "$PACKAGE_PATH" 2>/dev/null || echo "unknown")
    echo "Package info: $PACKAGE_ARCH_INFO"

    if [[ "$ARCH" == "arm64" ]] && [[ "$PACKAGE_ARCH_INFO" == *"x86-64"* ]]; then
        echo "WARNING: x86_64 package detected on ARM64 system - this may not work"
    elif [[ "$ARCH" == "x64" ]] && [[ "$PACKAGE_ARCH_INFO" == *"aarch64"* ]]; then
        echo "WARNING: ARM64 package detected on x86_64 system - this may not work"
    fi
fi

echo "Creating staging directory..."
mkdir -p "${HOST_TMP}/qualys"

cp "$PACKAGE_PATH" "${HOST_TMP}/qualys/"

echo "Installing Qualys Cloud Agent on host system..."
echo "Package: $PACKAGE_NAME"
echo "Target: $OS_FAMILY system on $ARCH architecture"

if run_package_install "$PACKAGE_MGR" "$PACKAGE_PATH"; then
    echo "Package installation completed successfully."
else
    echo "ERROR: Package installation failed!"
    echo "Please check the package compatibility with your host OS."
    exit 1
fi

echo "Configuring Qualys Cloud Agent..."

mkdir -p "${AGENT_CONFIG_PATH}"

# Build the configuration file with all available settings
(
    umask 077
    cat > "${AGENT_CONFIG_PATH}/qualys-cloud-agent.conf" << EOF
[Configuration]
LogLevel=${LOG_LEVEL}
EOF

    # Add optional logging settings
    if [[ -n "$LOG_FILE_DIR" ]]; then
        echo "LogFileDir=${LOG_FILE_DIR}" >> "${AGENT_CONFIG_PATH}/qualys-cloud-agent.conf"
    fi
    if [[ -n "$LOG_DEST_TYPE" ]]; then
        echo "LogDestType=${LOG_DEST_TYPE}" >> "${AGENT_CONFIG_PATH}/qualys-cloud-agent.conf"
    fi
    if [[ -n "$LOG_COMPRESSION" ]]; then
        echo "LogCompression=${LOG_COMPRESSION}" >> "${AGENT_CONFIG_PATH}/qualys-cloud-agent.conf"
    fi

    # Add performance settings
    if [[ -n "$CMD_MAX_TIMEOUT" ]]; then
        echo "CmdMaxTimeOut=${CMD_MAX_TIMEOUT}" >> "${AGENT_CONFIG_PATH}/qualys-cloud-agent.conf"
    fi
    if [[ -n "$PROCESS_PRIORITY" ]]; then
        echo "ProcessPriority=${PROCESS_PRIORITY}" >> "${AGENT_CONFIG_PATH}/qualys-cloud-agent.conf"
    fi
    if [[ -n "$SCAN_DELAY_VM" ]]; then
        echo "ScanDelayVM=${SCAN_DELAY_VM}" >> "${AGENT_CONFIG_PATH}/qualys-cloud-agent.conf"
    fi
    if [[ -n "$SCAN_DELAY_PC" ]]; then
        echo "ScanDelayPC=${SCAN_DELAY_PC}" >> "${AGENT_CONFIG_PATH}/qualys-cloud-agent.conf"
    fi
    if [[ -n "$MAX_RANDOM_SCAN_INTERVAL_VM" ]]; then
        echo "MaxRandomScanIntervalVM=${MAX_RANDOM_SCAN_INTERVAL_VM}" >> "${AGENT_CONFIG_PATH}/qualys-cloud-agent.conf"
    fi
    if [[ -n "$MAX_RANDOM_SCAN_INTERVAL_PC" ]]; then
        echo "MaxRandomScanIntervalPC=${MAX_RANDOM_SCAN_INTERVAL_PC}" >> "${AGENT_CONFIG_PATH}/qualys-cloud-agent.conf"
    fi

    # Add permission settings
    if [[ -n "$USE_SUDO" ]]; then
        echo "UseSudo=${USE_SUDO}" >> "${AGENT_CONFIG_PATH}/qualys-cloud-agent.conf"
    fi
    if [[ -n "$SUDO_COMMAND" ]]; then
        echo "SudoCommand=${SUDO_COMMAND}" >> "${AGENT_CONFIG_PATH}/qualys-cloud-agent.conf"
    fi

    # Add other settings
    if [[ -n "$USE_AUDIT_DISPATCHER" ]]; then
        echo "UseAuditDispatcher=${USE_AUDIT_DISPATCHER}" >> "${AGENT_CONFIG_PATH}/qualys-cloud-agent.conf"
    fi
    if [[ -n "$HOST_ID_SEARCH_DIR" ]]; then
        echo "HostIdSearchDir=${HOST_ID_SEARCH_DIR}" >> "${AGENT_CONFIG_PATH}/qualys-cloud-agent.conf"
    fi

    # Add proxy settings to config
    if [[ -n "$QUALYS_PROXY_ORDER" ]]; then
        echo "QualysProxyOrder=${QUALYS_PROXY_ORDER}" >> "${AGENT_CONFIG_PATH}/qualys-cloud-agent.conf"
    fi
    if [[ -n "$PROXY_FAIL_OPEN" ]]; then
        echo "ProxyFailOpen=${PROXY_FAIL_OPEN}" >> "${AGENT_CONFIG_PATH}/qualys-cloud-agent.conf"
    fi

    # Add startup section
    cat >> "${AGENT_CONFIG_PATH}/qualys-cloud-agent.conf" << EOF

[Startup]
SuppressPopup=1
RunAs=0
ActivationId=${ACTIVATION_ID}
CustomerId=${CUSTOMER_ID}
ServerUri=${SERVER_URI}
EOF

    # Add user/group settings
    if [[ -n "$AGENT_USER" ]]; then
        echo "User=${AGENT_USER}" >> "${AGENT_CONFIG_PATH}/qualys-cloud-agent.conf"
    else
        echo "UserGroup=root" >> "${AGENT_CONFIG_PATH}/qualys-cloud-agent.conf"
    fi
    if [[ -n "$AGENT_GROUP" ]]; then
        echo "Group=${AGENT_GROUP}" >> "${AGENT_CONFIG_PATH}/qualys-cloud-agent.conf"
    fi
)

# Configure proxy settings in the appropriate file based on OS family
if [[ -n "$QUALYS_HTTPS_PROXY" ]] || [[ -n "$HTTPS_PROXY" ]]; then
    echo "Configuring proxy settings..."

    if [[ "$OS_FAMILY" == "debian" ]]; then
        PROXY_CONFIG_FILE="${HOST_ETC}/default/qualys-cloud-agent"
    else
        PROXY_CONFIG_FILE="${HOST_ETC}/sysconfig/qualys-cloud-agent"
    fi

    # Create parent directory if needed
    mkdir -p "$(dirname "$PROXY_CONFIG_FILE")"

    (
        umask 077
        # Write proxy configuration
        if [[ -n "$QUALYS_HTTPS_PROXY" ]]; then
            echo "qualys_https_proxy=\"${QUALYS_HTTPS_PROXY}\"" > "$PROXY_CONFIG_FILE"
            echo "Configured qualys_https_proxy for Qualys-only traffic"
        fi
        if [[ -n "$HTTPS_PROXY" ]]; then
            echo "https_proxy=\"${HTTPS_PROXY}\"" >> "$PROXY_CONFIG_FILE"
            echo "Configured https_proxy for all agent traffic"
        fi
    )

    chown 0:0 "$PROXY_CONFIG_FILE"
    chmod 600 "$PROXY_CONFIG_FILE"
    echo "Proxy configuration written to: $PROXY_CONFIG_FILE"
fi

# Install custom CA certificate bundle if provided
if [[ -n "$CA_CERT_BUNDLE" ]]; then
    echo "Installing custom CA certificate bundle..."
    CERT_DIR="${HOST_ETC}/qualys/cloud-agent/cert"
    mkdir -p "$CERT_DIR"

    (
        umask 077
        echo "$CA_CERT_BUNDLE" | base64 -d > "${CERT_DIR}/ca-bundle.crt"
    )

    chown -R 0:0 "$CERT_DIR"
    chmod 700 "$CERT_DIR"
    chmod 600 "${CERT_DIR}/ca-bundle.crt"
    echo "CA certificate bundle installed to: ${CERT_DIR}/ca-bundle.crt"
fi

chown -R 0:0 "${HOST_ETC}/qualys"
chmod 700 "${HOST_ETC}/qualys"
chmod 700 "${AGENT_CONFIG_PATH}"
chmod 600 "${AGENT_CONFIG_PATH}/qualys-cloud-agent.conf"

echo "Starting Qualys Cloud Agent service..."
run_on_host systemctl enable qualys-cloud-agent
run_on_host systemctl start qualys-cloud-agent

echo "Waiting for Qualys Cloud Agent service to become active..."
TIMEOUT=60
ELAPSED=0
while ! run_on_host systemctl is-active qualys-cloud-agent --quiet 2>/dev/null; do
    if [[ $ELAPSED -ge $TIMEOUT ]]; then
        echo "WARNING: Service did not become active within ${TIMEOUT}s"
        run_on_host systemctl status qualys-cloud-agent --no-pager || true
        break
    fi
    sleep 2
    ELAPSED=$((ELAPSED + 2))
    echo "  Waiting... (${ELAPSED}s/${TIMEOUT}s)"
done

if run_on_host systemctl is-active qualys-cloud-agent --quiet 2>/dev/null; then
    echo "Qualys Cloud Agent service is active!"
    run_on_host systemctl status qualys-cloud-agent --no-pager || true
fi

echo "Checking agent activation status..."
ACTIVATION_TIMEOUT=30
ACTIVATION_ELAPSED=0
ACTIVATION_SUCCESS=false

while [[ $ACTIVATION_ELAPSED -lt $ACTIVATION_TIMEOUT ]]; do
    if compgen -G "${HOST_VAR}/log/qualys/*.log" > /dev/null 2>&1; then
        if grep -l 'Connection.*established\|Successfully.*activated\|Agent.*registered' "${HOST_VAR}/log/qualys"/*.log >/dev/null 2>&1; then
            echo "Agent appears to be connecting to Qualys servers!"
            ACTIVATION_SUCCESS=true
            break
        fi
    fi

    if compgen -G "${HOST_ETC}/qualys/*agent*id*" > /dev/null 2>&1 || \
       compgen -G "${HOST_ETC}/qualys/*uuid*" > /dev/null 2>&1; then
        echo "Agent ID files found - activation likely successful!"
        ACTIVATION_SUCCESS=true
        break
    fi

    sleep 3
    ACTIVATION_ELAPSED=$((ACTIVATION_ELAPSED + 3))
    echo "  Waiting for activation... (${ACTIVATION_ELAPSED}s/${ACTIVATION_TIMEOUT}s)"
done

if [[ "$ACTIVATION_SUCCESS" == "false" ]]; then
    echo "NOTE: Activation not confirmed within ${ACTIVATION_TIMEOUT}s - agent may still be initializing."
    echo "Checking agent logs for any connection attempts..."
    if compgen -G "${HOST_VAR}/log/qualys/*.log" > /dev/null 2>&1; then
        tail -5 "${HOST_VAR}/log/qualys"/*.log 2>/dev/null || echo "Could not read logs"
    else
        echo "No Qualys logs found yet"
    fi
fi

rm -rf "${HOST_TMP}/qualys"

touch "$INSTALL_COMPLETE_MARKER"

echo ""
echo "=============================================="
echo "Qualys Cloud Agent installation completed!"
echo "=============================================="
echo "Package: $PACKAGE_NAME"
echo "OS: ${OS_ID:-unknown} ($ARCH)"
echo "Status: Agent should now be active and reporting to Qualys console"
if [[ -n "$QUALYS_HTTPS_PROXY" ]] || [[ -n "$HTTPS_PROXY" ]]; then
    echo "Proxy: Configured"
fi
echo ""

echo "Container will now sleep to maintain DaemonSet pod..."
exec sleep infinity