#!/bin/sh
# Managed by Ansible. crowdsec-hubupdate.service runs this script instead of /usr/libexec/crowdsec/hubupdate.sh.
#
# "cscli scenarios remove --force" taints the collection that holds the scenario, and a plain "cscli hub upgrade" skips tainted
# collections for good. The upgrade therefore runs with --force, which also brings the removed scenarios back, and the removal is
# applied again. crowdsec is reloaded only when the installed hub files or the data files differ afterwards; with NO_RELOAD=1
# the script prints "changed" instead, for the role, which restarts crowdsec once at the end of its run. A failed step does not skip
# the later ones, so the removal of the disabled scenarios always runs; the script then exits non-zero.
set -eu

test -x /usr/bin/cscli || exit 0

fingerprint() {
  {
    find -L /etc/crowdsec -path /etc/crowdsec/hub -prune -o -type f -exec sha256sum {} +
    find /var/lib/crowdsec/data -maxdepth 1 -type f ! -name 'crowdsec.db*' ! -name trace -exec sha256sum {} +
  } 2>/dev/null | sort -k2 | sha256sum
}

before="$(fingerprint)"

failed=0

# A failed list command does not skip the removal: the scenario is then removed without knowing whether it is installed.
remove_scenario() {
  if list="$(/usr/bin/cscli scenarios list -o raw)"; then
    printf '%s\n' "$list" | cut -d, -f1 | grep -qxF "$1" || return 0
  else
    failed=1
  fi
  /usr/bin/cscli --error scenarios remove "$1" --force >/dev/null || failed=1
}

/usr/bin/cscli --error hub update >/dev/null || failed=1
/usr/bin/cscli --error hub upgrade --force >/dev/null || failed=1

{% for scenario in crowdsec.disabled_scenarios.values() | reject('none') | unique | sort %}
remove_scenario '{{ scenario }}'
{% endfor %}

if [ "$before" != "$(fingerprint)" ]; then
  if [ -n "${NO_RELOAD:-}" ]; then
    echo changed
  else
    systemctl reload crowdsec.service
  fi
fi

exit "$failed"