#!/bin/bash
# postinst script for imunify-antivirus
set -e
is_imunify360_installed()
{
    test -f /var/imunify360/.i360
    return $?
}

regenerate_config_example()
{
    # re-generate imunify360.config.defaults.example from schema defaults
    /opt/imunify360/venv/share/imunify360/scripts/create_default_config \
    /etc/sysconfig/imunify360/imunify360.config.defaults.example
    chmod 0600 /etc/sysconfig/imunify360/imunify360.config.defaults.example
}

generate_merge_config_if_not_exists()
{
    merged_config=/etc/sysconfig/imunify360/imunify360-merged.config
    [[ ! -f $merged_config ]] && cat /etc/sysconfig/imunify360/imunify360.config.defaults.example > $merged_config || true
}

case "$1" in
    configure)
        # don't start AV service if IM360 is used
        if ! is_imunify360_installed
        then
            /bin/systemctl daemon-reload >/dev/null
            # will be enabled later, during imunify agent registration
            #/bin/systemctl disable imunify-antivirus.service >/dev/null 2>&1 || :
            if /bin/systemctl is-enabled imunify-antivirus.service >/dev/null
            then
                /bin/systemctl start imunify-antivirus.service >/dev/null
            fi
            regenerate_config_example
            if [ ! -e /etc/sysconfig/imunify360/imunify360-merged.config ]
            then
              # to pervent possible failures other products that might use imunify360-merged.config
              cp /etc/sysconfig/imunify360/imunify360.config.defaults.example /etc/sysconfig/imunify360/imunify360-merged.config
            fi
            if [ ! -e /etc/sysconfig/imunify360/imunify360.config ]
            then
              # create empty config file to allow
              cp /dev/null /etc/sysconfig/imunify360/imunify360.config
            fi
            # to allow malware scans by modsec
            chmod 644 /etc/sysconfig/imunify360/imunify360-merged.config
            ln -svf /usr/bin/imunify-antivirus /usr/bin/imunify360-agent
            rm -f /var/lib/rpm-state/imunify360-transaction-in-progress
            systemctl enable imunify-antivirus.service && \
            systemctl enable imunify-antivirus.socket && \
            systemctl enable imunify-antivirus-user.socket && \
            systemctl enable imunify-antivirus-sensor.socket && \
            systemctl daemon-reload >/dev/null
            systemctl start imunify-antivirus-sensor.socket && \
            systemctl start imunify-antivirus.socket && \
            systemctl start imunify-antivirus-user.socket
        fi
        chmod 01777 /var/log/imunify360_user_logs
        chmod 0600 /var/imunify360/uploads
        chmod 0600 /opt/imunify360/venv/share/imunify360/10_on_first_install_av.config
        chmod 0600 /opt/imunify360/venv/share/imunify360/10_plesk_default_av.config
        chmod 0600 /opt/imunify360/venv/share/imunify360/11_on_first_install_wp_av.config
        chmod 0700 /var/imunify360/tmp
        chmod 0750 /var/imunify360/tmp_cleanup
        chmod 0775 /var/imunify360/files
        chmod 0770 /opt/imunify360/venv/share/imunify360/scripts/send-notifications
        chmod 0755 /var/imunify360/aibolit
        chmod 0700 /var/imunify360/aibolit/run
        chmod 0700 /var/imunify360/aibolit/resident/in/notify-jobs
        chmod 0700 /var/imunify360/aibolit/resident/out
        chown root:root /opt/imunify360/venv/share/imunify360/10_on_first_install_av.config
        chown root:root /opt/imunify360/venv/share/imunify360/10_plesk_default_av.config
        chown root:root /opt/imunify360/venv/share/imunify360/11_on_first_install_wp_av.config
        chown root:root /var/imunify360/files
        chown root:root /var/imunify360/tmp
        chown root:root /var/imunify360/tmp_cleanup
        chown root:root /var/imunify360/uploads
        chown root:root /var/log/imunify360_user_logs
        chown root:root /var/imunify360/aibolit
        chown root:root /var/imunify360/aibolit/run
        chown root:root /var/imunify360/aibolit/resident/in/notify-jobs
        chown root:root /var/imunify360/aibolit/resident/out
        chown root:_imunify /opt/imunify360/venv/share/imunify360/scripts/send-notifications

        # make readable for non-root services
        id _imunify &>/dev/null || useradd --system -U -d /dev/null _imunify || true
        chmod 2755 /var/imunify360/
        chown :_imunify /var/imunify360
        chown :_imunify /var/imunify360/tmp_cleanup
        chown :_imunify /var/imunify360/imunify360.db* || true

        # make executable with root rights for non-root user
        chmod u+s /opt/imunify360/venv/share/imunify360/scripts/send-notifications

    ;;
    triggered)
        # should be triggered on imunify360-firewall (un)install/update
        regenerate_config_example
        if is_imunify360_installed
        then
            # mask imunify-antivirus service to prevent it from starting
            /bin/systemctl stop imunify-antivirus.service >/dev/null
            /bin/systemctl mask imunify-antivirus.service >/dev/null
            # fill imunify360-merged.config with defaults,
            # the agent must specify the actual settings at startup
            generate_merge_config_if_not_exists
        else
            /bin/systemctl unmask imunify-antivirus.service >/dev/null
            /bin/systemctl restart imunify-antivirus.service >/dev/null
        fi
    ;;
    abort-upgrade|abort-remove|abort-deconfigure)
    ;;
    *)
        echo "postinst called with unknown argument \`$1'" >&2
        exit 1
    ;;
esac
exit 0