#!/usr/bin/env bash
set -Eeuo pipefail
umask 077
MODE="dry-run"; CONFIRM=""; LOG_DIR="/var/log/suricata"; REPORT_DIR="/var/tmp/suricata-lab-cleanup"
while (($#)); do
  case "$1" in
    --dry-run) MODE="dry-run" ;;
    --execute) MODE="execute" ;;
    --confirm) shift; CONFIRM="${1:-}" ;;
    --log-dir) shift; LOG_DIR="${1:-}" ;;
    --report-dir) shift; REPORT_DIR="${1:-}" ;;
    -h|--help) echo "Usage: sudo $0 [--dry-run] [--execute --confirm CLEAN-SURICATA-LAB] [--log-dir /var/log/suricata]"; exit 0 ;;
    *) echo "ERROR: unknown option $1" >&2; exit 2 ;;
  esac; shift
done
[[ $EUID -eq 0 ]] || { echo "ERROR: run as root." >&2; exit 1; }
[[ -d "$LOG_DIR" ]] || { echo "ERROR: log directory not found: $LOG_DIR" >&2; exit 1; }
REAL_LOG=$(realpath -e "$LOG_DIR")
[[ "$REAL_LOG" == /var/log/suricata || "$REAL_LOG" == /var/log/suricata/* ]] || {
  echo "ERROR: log directory must resolve beneath /var/log/suricata" >&2; exit 2;
}
[[ "$MODE" != execute || "$CONFIRM" == CLEAN-SURICATA-LAB ]] || { echo "ERROR: confirmation phrase missing." >&2; exit 2; }
STAMP=$(date -u +%Y%m%dT%H%M%SZ); RUN_DIR="$REPORT_DIR/$STAMP"; mkdir -p "$RUN_DIR"
RUN_REAL=$(realpath -e "$RUN_DIR")
case "$RUN_REAL" in
  "$REAL_LOG"|"$REAL_LOG"/*)
    echo "ERROR: report directory must not be inside the Suricata log cleanup target." >&2; exit 2 ;;
esac
exec > >(tee -a "$RUN_DIR/run.log") 2>&1
PROTECTED=(/etc/suricata /var/lib/suricata/rules /etc/suricata/rules /var/ossec/etc)
manifest() { local o="$1" p; : > "$o"; for p in "${PROTECTED[@]}"; do [[ -d "$p" ]] && find -P "$p" -xdev -type f -print0; done | sort -z | xargs -0 -r sha256sum > "$o"; }
manifest "$RUN_DIR/config-rules-before.sha256"
find -P "$REAL_LOG" -xdev -type f -printf '%s\t%p\n' | sort -k2 | tee "$RUN_DIR/log-targets.tsv"
if [[ "$MODE" == dry-run ]]; then echo "DRY-RUN COMPLETE: no files, rules, or configuration changed."; exit 0; fi
# Mandatory dated backups. The final .bak suffix makes them easy to identify.
CONFIG_BAK="$RUN_DIR/suricata-config-rules-$STAMP.tar.gz.bak"
LOG_BAK="$RUN_DIR/suricata-logs-$STAMP.tar.gz.bak"
protected_items=()
[[ -d /etc/suricata ]] && protected_items+=(etc/suricata)
[[ -d /var/lib/suricata/rules ]] && protected_items+=(var/lib/suricata/rules)
if [[ -d /var/ossec/etc ]]; then
  [[ -s /var/ossec/etc/client.keys ]] || {
    echo "ERROR: Ubuntu Wazuh agent client.keys is missing or empty; no logs deleted." >&2; exit 3;
  }
  protected_items+=(var/ossec/etc)
fi
tar -czf "$CONFIG_BAK" -C / "${protected_items[@]}"
tar -tzf "$CONFIG_BAK" >/dev/null
tar -czf "$LOG_BAK" -C / "${REAL_LOG#/}"
tar -tzf "$LOG_BAK" >/dev/null
echo "Backups verified: $CONFIG_BAK ; $LOG_BAK"
was_active=0; wazuh_agent_was_active=0
systemctl is-active --quiet suricata && was_active=1
systemctl is-active --quiet wazuh-agent && wazuh_agent_was_active=1
trap 'rc=$?; ((was_active)) && systemctl start suricata || true; exit $rc' EXIT
((was_active)) && systemctl stop suricata
find -P "$REAL_LOG" -xdev -type f -delete
((was_active)) && systemctl start suricata
was_active=0
manifest "$RUN_DIR/config-rules-after.sha256"
diff -u "$RUN_DIR/config-rules-before.sha256" "$RUN_DIR/config-rules-after.sha256" > "$RUN_DIR/config-rules-diff.txt" || {
  echo "CRITICAL: Suricata configuration or rules changed." >&2; exit 3;
}
suricata -T -c /etc/suricata/suricata.yaml |& tee "$RUN_DIR/suricata-test.log"
systemctl is-active --quiet suricata || { echo "ERROR: Suricata is not active." >&2; exit 4; }
if ((wazuh_agent_was_active)); then
  systemctl is-active --quiet wazuh-agent || { echo "ERROR: Wazuh agent is no longer active." >&2; exit 4; }
fi
echo "PASS: Suricata logs removed; Suricata/ET and Ubuntu Wazuh agent configuration unchanged."