#!/bin/sh
set -eu

mkdir -p /data /var/log/suricata /var/lib/suricata/rules /run/suricata

case "${UPDATE_RULES_ON_START:-false}" in
  1|true|TRUE|yes|YES|on|ON)
    echo "[entrypoint] updating ET Open rules"
    if ! suricata-update; then
      echo "[entrypoint] WARNING: suricata-update failed; continuing with existing/local rules" >&2
    fi
    ;;
esac

RULES=/var/lib/suricata/rules/suricata.rules
LOCAL=/opt/ids/suricata/local.rules
[ -f "$RULES" ] || : > "$RULES"
if ! grep -q 'sid:1000001;' "$RULES"; then
  printf '\n# ---- local project rules ----\n' >> "$RULES"
  cat "$LOCAL" >> "$RULES"
fi

chown -R suricata:suricata /var/log/suricata /var/lib/suricata /run/suricata

exec python3 -m app.main