#!/usr/bin/env bash
# Instala Zeek en Debian 12/13 + servicio systemd
set -euo pipefail

#--- instalar gpg
sudo apt install -y gpg

#--- detectar versión
. /etc/os-release
case "${VERSION_CODENAME:-}" in
  trixie) DIST="Debian_13" ;;
  bookworm) DIST="Debian_12" ;;
  *) echo "Solo soporta Debian 12/13 (detectado: ${VERSION_CODENAME:-unknown})"; exit 1 ;;
esac

#--- repo Zeek
echo "deb http://download.opensuse.org/repositories/security:/zeek/${DIST}/ /" \
  | sudo tee /etc/apt/sources.list.d/security:zeek.list
curl -fsSL "https://download.opensuse.org/repositories/security:zeek/${DIST}/Release.key" \
  | gpg --dearmor | sudo tee /etc/apt/trusted.gpg.d/security_zeek.gpg > /dev/null

sudo apt update
sudo apt install -y --no-install-recommends zeek

#--- PATH global
echo 'export PATH="$PATH:/opt/zeek/bin"' | sudo tee /etc/profile.d/zeek.sh
sudo chmod 644 /etc/profile.d/zeek.sh

#--- interfaz por default
IFACE="$(ip -o -4 route show to default | awk '{print $5}' | head -n1)"
[ -z "$IFACE" ] && { echo "No se detectó interfaz. Edita /opt/zeek/etc/node.cfg manualmente."; exit 1; }

#--- node.cfg standalone
cat <<EOF | sudo tee /opt/zeek/etc/node.cfg
[zeek]
type=standalone
host=localhost
interface=${IFACE}
EOF

#--- primer deploy
sudo /opt/zeek/bin/zeekctl deploy || true

#--- servicio systemd
cat <<'EOF' | sudo tee /etc/systemd/system/zeek.service
[Unit]
Description=Zeek Network Security Monitor
After=network-online.target
Wants=network-online.target

[Service]
Type=forking
ExecStart=/opt/zeek/bin/zeekctl start
ExecStop=/opt/zeek/bin/zeekctl stop
ExecReload=/opt/zeek/bin/zeekctl restart
WorkingDirectory=/opt/zeek
Restart=on-failure

[Install]
WantedBy=multi-user.target
EOF

sudo systemctl daemon-reload
sudo systemctl enable --now zeek
source /etc/profile.d/zeek.sh

echo -e "\n\e[92m✅ Zeek instalado y corriendo en interfaz:\e[0m  \e[96m${IFACE}\e[0m\n"
echo -e "\e[93mConfig:\e[0m  \e[96m/opt/zeek/etc/node.cfg\e[0m\n"
echo -e "\e[93mLogs:\e[0m    \e[96m/opt/zeek/spool/zeek (live)\e[0m"
echo -e "         \e[96m/opt/zeek/logs/<timestamp>/ (rotados)\e[0m\n"

echo -e "         \e[96msource /etc/profile.d/zeek.sh \e[0m\n"
echo -e "\n\e[92m✅ Execute: sudo systemctl stop zeek && sudo systemctl restart zeek\e[0m"
zeek -v