#!/bin/bash
# Silent RootManage agent installer for the CLIENT Linux VPS.
# curl -fsSL https://rootmanage.com/agent/install.sh | sudo bash -s -- --url https://rootmanage.com --key ANON --token TOKEN
set -euo pipefail

URL=""
KEY=""
TOKEN=""
INTERVAL=60
GITHUB_RAW=""

while [[ $# -gt 0 ]]; do
  case "$1" in
    --url) URL="$2"; shift 2 ;;
    --key) KEY="$2"; shift 2 ;;
    --token) TOKEN="$2"; shift 2 ;;
    --interval) INTERVAL="$2"; shift 2 ;;
    --github) GITHUB_RAW="$2"; shift 2 ;;
    *) echo "unknown arg $1" >&2; exit 1 ;;
  esac
done

if [[ -z "$URL" || -z "$KEY" || -z "$TOKEN" ]]; then
  echo "Need --url --key --token from RootManage → Server Health." >&2
  exit 1
fi
if [[ "$(id -u)" -ne 0 ]]; then
  echo "Run as root: sudo bash" >&2
  exit 1
fi

mkdir -p /etc/rootmanage /var/lib/rootmanage /usr/local/bin /var/log
umask 077
cat > /etc/rootmanage/agent.env <<EOF
API_URL=${URL}
ANON_KEY=${KEY}
AGENT_TOKEN=${TOKEN}
INTERVAL=${INTERVAL}
UPDATE_URL=${URL%/}/agent/rootmanage-agent.sh
GITHUB_RAW=${GITHUB_RAW}
EOF
chmod 600 /etc/rootmanage/agent.env

curl -fsSL "${URL%/}/agent/rootmanage-agent.sh" -o /usr/local/bin/rootmanage-agent
chmod 755 /usr/local/bin/rootmanage-agent
ln -sf /usr/local/bin/rootmanage-agent /usr/bin/rootmanage-agent
ln -sf /usr/local/bin/rootmanage-agent /usr/sbin/rootmanage-agent

install_scanners() {
  echo "Installing RootManage security engines..."
  if ! command -v lynis >/dev/null 2>&1; then
    if command -v apt-get >/dev/null 2>&1; then
      DEBIAN_FRONTEND=noninteractive apt-get update -qq >/dev/null 2>&1 || true
      DEBIAN_FRONTEND=noninteractive apt-get install -y -qq lynis >/dev/null 2>&1 || true
    elif command -v dnf >/dev/null 2>&1; then
      dnf install -y -q lynis >/dev/null 2>&1 || true
    elif command -v yum >/dev/null 2>&1; then
      yum install -y -q lynis >/dev/null 2>&1 || true
    fi
  fi
  if ! command -v trivy >/dev/null 2>&1; then
    if command -v apt-get >/dev/null 2>&1; then
      DEBIAN_FRONTEND=noninteractive apt-get install -y -qq wget >/dev/null 2>&1 || true
    fi
    nice -n 19 timeout 90 sh -c 'curl -fsSL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin' || true
  fi
  command -v lynis >/dev/null && echo "rootmanage.com hardening engine: on" || echo "rootmanage.com hardening engine: built-in checks only"
  command -v trivy >/dev/null && echo "rootmanage.com package scan: on" || echo "rootmanage.com package scan: built-in checks only"
}
install_scanners || true

cat > /etc/systemd/system/rootmanage-agent.service <<'EOF'
[Unit]
Description=RootManage server health agent
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
ExecStart=/usr/local/bin/rootmanage-agent --loop
Restart=always
RestartSec=15
Nice=19
CPUQuota=15%
IOSchedulingClass=3
IOSchedulingPriority=7
MemoryMax=256M

[Install]
WantedBy=multi-user.target
EOF

cat > /etc/systemd/system/rootmanage-scan.service <<'EOF'
[Unit]
Description=RootManage daily security scan and agent self-update (01:00 IST)
After=network-online.target

[Service]
Type=oneshot
Nice=19
CPUQuota=12%
IOSchedulingClass=3
ExecStart=/usr/local/bin/rootmanage-agent --scan
EOF

cat > /etc/systemd/system/rootmanage-scan.timer <<'EOF'
[Unit]
Description=RootManage daily scan at 01:00 Asia/Kolkata

[Timer]
OnCalendar=*-*-* 01:00:00
Timezone=Asia/Kolkata
Persistent=true
RandomizedDelaySec=180
Unit=rootmanage-scan.service

[Install]
WantedBy=timers.target
EOF

systemctl daemon-reload
systemctl enable --now rootmanage-agent.service
systemctl enable --now rootmanage-scan.timer
/usr/local/bin/rootmanage-agent --once || true
echo "RootManage agent is running on this server."
echo "Portal: https://rootmanage.com"
echo "rootmanage.com scan findings: Server Health and https://rootmanage.com/admin/monitor"
echo "Daily scan: 01:00 IST (low CPU)."
echo "On cPanel/WHM use the full path (sudo PATH often skips /usr/local/bin):"
echo "  /usr/bin/rootmanage-agent --once"
echo "  /usr/bin/rootmanage-agent --scan"
echo "  /usr/bin/rootmanage-agent --version"
echo "Scan does not probe the gateway. It allow-lists your SSH IP (CSF/Guard) first."
echo "Uninstall this agent only: curl -fsSL ${URL%/}/agent/uninstall-health.sh | sudo bash"