#!/bin/sh
set -eu

mkdir -p /data /data/suricata /var/log/suricata /var/lib/suricata/rules /run/suricata

if ! id -u suricata >/dev/null 2>&1 || ! getent group suricata >/dev/null 2>&1; then
  echo "[entrypoint] FATAL: missing suricata user/group in the image; rebuild the image from the current Dockerfile" >&2
  exit 70
fi

init_file() {
  src="$1"
  dst="$2"
  if [ ! -e "$dst" ]; then
    cp "$src" "$dst"
  fi
  chmod 0644 "$dst"
}

cp /opt/ids/suricata/local.rules /data/suricata/local.rules
chmod 0644 /data/suricata/local.rules
init_file /opt/ids/suricata/custom.rules.default /data/suricata/custom.rules
init_file /opt/ids/suricata/threshold.config /data/suricata/threshold.config
init_file /opt/ids/suricata/disable.conf /data/suricata/disable.conf
init_file /opt/ids/suricata/enable.conf /data/suricata/enable.conf
init_file /opt/ids/suricata/modify.conf /data/suricata/modify.conf

# RouterOS mounts /var/lib/suricata from persistent storage. On the first
# deployment that mount is empty, so seed it from the ET/Open snapshot baked
# into the image before optional online updates run.
if [ ! -s /var/lib/suricata/rules/suricata.rules ] && [ -d /opt/ids/vendor-rules-seed ]; then
  echo "[entrypoint] seeding baseline vendor rules into persistent storage"
  cp -a /opt/ids/vendor-rules-seed/. /var/lib/suricata/
fi

case "${UPDATE_RULES_ON_START:-false}" in
  1|true|TRUE|yes|YES|on|ON)
    echo "[entrypoint] updating managed rules"
    if ! /opt/ids/scripts/update-rules.sh --no-reload; then
      echo "[entrypoint] WARNING: suricata-update failed; continuing with existing rules" >&2
    fi
    ;;
esac

RULES=/var/lib/suricata/rules/suricata.rules
[ -f "$RULES" ] || : > "$RULES"

chown -R suricata:suricata /var/log/suricata /var/lib/suricata /run/suricata
# Rule state is edited by the root Python supervisor but must remain readable by
# the Suricata process after it drops privileges.
chmod 0755 /data /data/suricata || true
chmod 0644 /data/suricata/* 2>/dev/null || true

exec python3 -m app.main