#!/bin/sh
set -eu

PERSIST_ROOT="${PERSIST_ROOT:-/data}"
PERSIST_LOG_DIR="${SURICATA_PERSIST_LOG_DIR:-${PERSIST_ROOT}/logs/suricata}"
PERSIST_LIB_DIR="${SURICATA_PERSIST_LIB_DIR:-${PERSIST_ROOT}/lib/suricata}"
PERSIST_STATE_DIR="${SURICATA_STATE_DIR:-${PERSIST_ROOT}/suricata}"

mkdir -p \
  "$PERSIST_ROOT" \
  "$PERSIST_LOG_DIR" \
  "$PERSIST_LIB_DIR/rules" \
  "$PERSIST_STATE_DIR" \
  /run/suricata \
  /run/mikrosuricata

if ! id -u suricata >/dev/null 2>&1 || ! getent group suricata >/dev/null 2>&1; then
  echo "[entrypoint] FATAL: missing suricata user/group in the image; rebuild the image from the current Dockerfile" >&2
  exit 70
fi


init_file() {
  src="$1"
  dst="$2"
  if [ ! -e "$dst" ]; then
    cp "$src" "$dst"
  fi
  chmod 0644 "$dst"
}

cp /opt/ids/suricata/local.rules "$PERSIST_STATE_DIR/local.rules"
chmod 0644 "$PERSIST_STATE_DIR/local.rules"
init_file /opt/ids/suricata/custom.rules.default "$PERSIST_STATE_DIR/custom.rules"
init_file /opt/ids/suricata/threshold.config "$PERSIST_STATE_DIR/threshold.config"
init_file /opt/ids/suricata/disable.conf "$PERSIST_STATE_DIR/disable.conf"
init_file /opt/ids/suricata/enable.conf "$PERSIST_STATE_DIR/enable.conf"
init_file /opt/ids/suricata/modify.conf "$PERSIST_STATE_DIR/modify.conf"

# Seed vendor rule state into /data/lib/suricata on first start.
if [ ! -s "$PERSIST_LIB_DIR/rules/suricata.rules" ] && [ -d /opt/ids/vendor-rules-seed ]; then
  echo "[entrypoint] seeding baseline vendor rules into /data"
  cp -a /opt/ids/vendor-rules-seed/. "$PERSIST_LIB_DIR/"
fi

case "${UPDATE_RULES_ON_START:-false}" in
  1|true|TRUE|yes|YES|on|ON)
    echo "[entrypoint] updating managed rules"
    if ! /opt/ids/scripts/update-rules.sh --no-reload; then
      echo "[entrypoint] WARNING: suricata-update failed; continuing with existing rules" >&2
    fi
    ;;
esac

RULES="$PERSIST_LIB_DIR/rules/suricata.rules"
[ -f "$RULES" ] || : > "$RULES"

chown -R suricata:suricata "$PERSIST_LOG_DIR" "$PERSIST_LIB_DIR" /run/suricata
chmod 0755 "$PERSIST_ROOT" "$PERSIST_STATE_DIR" || true
chmod 0644 "$PERSIST_STATE_DIR"/* 2>/dev/null || true

exec python3 -m app.main