#!/bin/bash
# Haven Blueshore — Wazuh agent 4.8.1 install on macOS.
# Deployment variables are written to /tmp/wazuh_envs (the installer reads
# and deletes that file); the agent enrolls on first start against
# siem.havenblueshore.cloud (TCP 1515). Agent name defaults to the hostname.
# Run with sudo from the folder containing this script and the .pkg files.
set -euo pipefail
cd "$(dirname "$0")"
[ "$(id -u)" = 0 ] || { echo "Run with sudo"; exit 1; }

ARCH="$(uname -m)"
if [ "$ARCH" = "arm64" ]; then PKG="wazuh-agent-4.8.1-1.arm64.pkg"; else PKG="wazuh-agent-4.8.1-1.intel64.pkg"; fi
[ -f "$PKG" ] || { echo "Package not found: $PKG"; exit 1; }

cat > /tmp/wazuh_envs <<'ENVS'
WAZUH_MANAGER='siem.havenblueshore.cloud'
WAZUH_REGISTRATION_SERVER='siem.havenblueshore.cloud'
WAZUH_AGENT_GROUP='default'
WAZUH_REGISTRATION_PASSWORD='807333e27cfcd64c63349d92ced93d88'
ENVS
installer -pkg "$PKG" -target /
/Library/Ossec/bin/wazuh-control start
sleep 2
/Library/Ossec/bin/wazuh-control status | head -5
echo "Wazuh agent 4.8.1 installed; enrollment to siem.havenblueshore.cloud in progress."