#!/bin/sh
# Managed by Ansible. crowdsec-hubupdate.service runs this script instead of /usr/libexec/crowdsec/hubupdate.sh.
#
# "cscli scenarios remove --force" taints the collection that holds the scenario, and a plain "cscli hub upgrade" skips tainted
# collections for good. The upgrade therefore runs with --force, which also brings the removed scenarios back, and the removal is
# applied again. crowdsec is reloaded only when the installed hub files or the data files differ afterwards; with NO_RELOAD=1
# the script prints "changed" instead, for the role, which restarts crowdsec once at the end of its run.
set -eu

test -x /usr/bin/cscli || exit 0

fingerprint() {
  {
    find -L /etc/crowdsec -path /etc/crowdsec/hub -prune -o -type f -exec sha256sum {} +
    find /var/lib/crowdsec/data -maxdepth 1 -type f ! -name 'crowdsec.db*' ! -name trace -exec sha256sum {} +
  } 2>/dev/null | sort -k2 | sha256sum
}

before="$(fingerprint)"

/usr/bin/cscli --error hub update >/dev/null
/usr/bin/cscli --error hub upgrade --force >/dev/null

{% for scenario in crowdsec.disabled_scenarios.values() | reject('none') | unique | sort %}
if /usr/bin/cscli scenarios list -o raw | cut -d, -f1 | grep -qxF '{{ scenario }}'; then
  /usr/bin/cscli --error scenarios remove '{{ scenario }}' --force >/dev/null
fi
{% endfor %}

if [ "$before" != "$(fingerprint)" ]; then
  if [ -n "${NO_RELOAD:-}" ]; then
    echo changed
  else
    systemctl reload crowdsec.service
  fi
fi