set -euo pipefail

ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"

CERT_DIR="${ROOT}/config/wazuh/certs"

cd "${ROOT}"

if [[ ! -f .env ]]; then

    echo "no .env found - copy .env.example to .env and fill it in first" >&2

    exit 1

fi

generate_certs() {

    if [[ -f "${CERT_DIR}/root-ca.pem" ]]; then

        echo "certs already present, skipping generation"

        return

    fi

    echo "generating indexer certificates"

    mkdir -p "${CERT_DIR}"

    docker run --rm \

        -v "${CERT_DIR}:/certificates" \

        -v "${ROOT}/config/wazuh/certs.yml:/config/certs.yml:ro" \

        wazuh/wazuh-certs-generator:0.0.2

    chmod 640 "${CERT_DIR}"/*.pem

}

wait_for_indexer() {

    echo "waiting for the indexer to come up"

    for _ in $(seq 1 40); do

        if curl -sk -u "${INDEXER_USERNAME}:${INDEXER_PASSWORD}" \

            https://localhost:9200/_cluster/health | grep -q '"status"'; then

            echo "indexer is responding"

            return 0

        fi

        sleep 10

    done

    echo "indexer did not become ready in time" >&2

    return 1

}

set -a

source .env

set +a

seed_cti_lists() {

    echo "seeding CTI watchlists into the manager"

    for list in cti-malicious-ip cti-malicious-domain cti-malware-hash; do

        docker compose cp "config/wazuh/lists/${list}" "wazuh.manager:/var/ossec/etc/lists/${list}"

    done

    docker compose exec -T wazuh.manager chown -R wazuh:wazuh /var/ossec/etc/lists

    docker compose exec -T wazuh.manager /var/ossec/bin/wazuh-control restart >/dev/null

}

generate_certs

docker compose up -d

wait_for_indexer

seed_cti_lists

cat <<EOF

stack is up.

  Wazuh dashboard   https://localhost:5601   (${DASHBOARD_USERNAME})

  TheHive           http://localhost:${THEHIVE_PORT}

  Cortex            http://localhost:${CORTEX_PORT}

Next: bring up Shuffle (cd shuffle && docker compose up -d), import the

workflow, and paste the webhook URL into config/wazuh/manager/ossec.conf.

EOF