{% set wazuh_enabled = salt['pillar.get']('pmg:wazuh:enabled', True) %}
{% set wazuh_version = salt['pillar.get']('pmg:wazuh:version', '4.14.0-1') %}
{% set wazuh_manager = salt['pillar.get']('pmg:wazuh:manager', '10.80.120.205') %}
{% set wazuh_group = salt['pillar.get']('pmg:wazuh:group', 'test_auditd_unix') %}
{% set wazuh_pkg_name = 'wazuh-agent_' ~ wazuh_version ~ '_amd64.deb' %}
{% set wazuh_pkg_url = 'https://packages.wazuh.com/4.x/apt/pool/main/w/wazuh-agent/' ~ wazuh_pkg_name %}
{% set wazuh_pkg_path = '/var/tmp/' ~ wazuh_pkg_name %}

{% set kesl_enabled = salt['pillar.get']('pmg:kesl:enabled', True) %}
{% set kesl_package_url = salt['pillar.get']('pmg:kesl:package_url', 'https://products.s.kaspersky-labs.com/endpoints/keslinux10/12.4.0.1225/multilanguage-INT-12.4.0.1225/167a2f9c5bdb4e869f4603fbc3a829c1/kesl_12.4.0-1225_amd64.deb') %}
{% set kesl_package_path = salt['pillar.get']('pmg:kesl:package_path', '/opt/kesl_12.4.0-1225_amd64.deb') %}
{% set kesl_autoinstall_path = salt['pillar.get']('pmg:kesl:autoinstall_path', '/etc/opt/kaspersky/kesl/autoinstall.ini') %}
{% set kesl_eula_agreed = salt['pillar.get']('pmg:kesl:eula_agreed', 'Yes') %}
{% set kesl_privacy_policy_agreed = salt['pillar.get']('pmg:kesl:privacy_policy_agreed', 'Yes') %}
{% set kesl_use_ksn = salt['pillar.get']('pmg:kesl:use_ksn', 'No') %}
{% set kesl_group_clean = salt['pillar.get']('pmg:kesl:group_clean', 'No') %}
{% set kesl_locale = salt['pillar.get']('pmg:kesl:locale', '') %}
{% set kesl_updater_source = salt['pillar.get']('pmg:kesl:updater_source', 'SCServer') %}
{% set kesl_install_license = salt['pillar.get']('pmg:kesl:install_license', '') %}
{% set kesl_update_execute = salt['pillar.get']('pmg:kesl:update_execute', 'No') %}
{% set kesl_ksvla_mode = salt['pillar.get']('pmg:kesl:ksvla_mode', 'No') %}
{% set kesl_endpoint_agent_mode = salt['pillar.get']('pmg:kesl:endpoint_agent_mode', 'No') %}
{% set kesl_setup_bin = '/opt/kaspersky/kesl/bin/kesl-setup.pl' %}
{% set kesl_setup_marker = '/var/lib/salt/pmg-kesl-autoinstall.done' %}

{% set klnagent_enabled = salt['pillar.get']('pmg:klnagent:enabled', True) %}
{% set klnagent_package_url = salt['pillar.get']('pmg:klnagent:package_url', 'https://products.s.kaspersky-labs.com/administrationkit/ksc10/16.2.0.1023/russian-INT-29664057-ru/2129c97dba254c9fb8a4161f29a2241c/klnagent64_16.2.0-1023_amd64.deb') %}
{% set klnagent_package_path = salt['pillar.get']('pmg:klnagent:package_path', '/opt/klnagent64_16.2.0-1023_amd64.deb') %}
{% set klnagent_server = salt['pillar.get']('pmg:klnagent:administration_server', '10.80.38.76') %}
{% set klnagent_autoanswers_path = salt['pillar.get']('pmg:klnagent:autoanswers_path', '/etc/opt/kaspersky/klnagent64/autoanswers.conf') %}
{% set klnagent_autoinstall = salt['pillar.get']('pmg:klnagent:autoinstall', True) %}
{% set klnagent_eula_accepted = salt['pillar.get']('pmg:klnagent:eula_accepted', True) %}
{% set klnagent_config_marker = '/var/lib/salt/pmg-klnagent-autoinstall.done' %}

{% set qualys_enabled = salt['pillar.get']('pmg:qualys:enabled', True) %}
{% set qualys_package_url = salt['pillar.get']('pmg:qualys:package_url', 'https://storage.yandexcloud.net/qualys-agent/QualysCloudAgent.deb') %}
{% set qualys_package_path = salt['pillar.get']('pmg:qualys:package_path', '/opt/QualysCloudAgent.deb') %}
{% set qualys_activation_id = salt['pillar.get']('pmg:qualys:activation_id', '') %}
{% set qualys_customer_id = salt['pillar.get']('pmg:qualys:customer_id', '') %}
{% set qualys_server_uri = salt['pillar.get']('pmg:qualys:server_uri', 'https://qagpublic.qg1.apps.qualys.eu/CloudAgent/') %}

{% if kesl_enabled and kesl_package_path %}
pmg-kesl-download:
  cmd.run:
    - name: wget -qO {{ kesl_package_path }} {{ kesl_package_url }}
    - unless: test -f {{ kesl_package_path }}

pmg-kesl-autoinstall-config:
  file.managed:
    - name: {{ kesl_autoinstall_path }}
    - user: root
    - group: root
    - mode: '0600'
    - makedirs: true
    - contents:
      - "KSVLA_MODE={{ kesl_ksvla_mode }}"
      - "ENDPOINT_AGENT_MODE={{ kesl_endpoint_agent_mode }}"
      - "EULA_AGREED={{ kesl_eula_agreed }}"
      - "PRIVACY_POLICY_AGREED={{ kesl_privacy_policy_agreed }}"
      - "USE_KSN={{ kesl_use_ksn }}"
      - "GROUP_CLEAN={{ kesl_group_clean }}"
{% if kesl_locale %}
      - "LOCALE={{ kesl_locale }}"
{% endif %}
{% if kesl_install_license %}
      - "INSTALL_LICENSE={{ kesl_install_license }}"
{% endif %}
      - "UPDATER_SOURCE={{ kesl_updater_source }}"
      - "UPDATE_EXECUTE={{ kesl_update_execute }}"
    - require:
      - cmd: pmg-kesl-install

pmg-kesl-install:
  cmd.run:
    - name: apt-get install -y {{ kesl_package_path }}
    - onlyif: test -f {{ kesl_package_path }}
    - unless: dpkg-query -W -f='${Status}' kesl 2>/dev/null | grep -q 'install ok installed'
    - require:
      - cmd: pmg-kesl-download

pmg-kesl-setup:
  cmd.run:
    - name: mkdir -p /var/lib/salt && {{ kesl_setup_bin }} --autoinstall={{ kesl_autoinstall_path }} && touch {{ kesl_setup_marker }}
    - onlyif: test -x {{ kesl_setup_bin }}
    - unless: test -f {{ kesl_setup_marker }}
    - require:
      - cmd: pmg-kesl-install
      - file: pmg-kesl-autoinstall-config

pmg-kesl-service:
  service.running:
    - name: kesl
    - enable: true
    - require:
      - cmd: pmg-kesl-install
      - cmd: pmg-kesl-setup
{% elif kesl_enabled %}
pmg-kesl-skipped:
  test.show_notification:
    - text: "Kaspersky Endpoint Security skipped: set package_url + package_path in pillar."
{% endif %}

{% if klnagent_enabled and klnagent_package_path and klnagent_server %}
pmg-klnagent-download:
  cmd.run:
    - name: wget -qO {{ klnagent_package_path }} {{ klnagent_package_url }}
    - unless: test -f {{ klnagent_package_path }}

pmg-klnagent-autoanswers:
  file.managed:
    - name: {{ klnagent_autoanswers_path }}
    - user: root
    - group: root
    - mode: '0600'
    - makedirs: true
    - contents:
      - "KLNAGENT_SERVER={{ klnagent_server }}"
      - "KLNAGENT_AUTOINSTALL={{ '1' if klnagent_autoinstall else '0' }}"
      - "EULA_ACCEPTED={{ '1' if klnagent_eula_accepted else '0' }}"

pmg-klnagent-install:
  cmd.run:
    - name: DEBIAN_FRONTEND=noninteractive KLAUTOANSWERS={{ klnagent_autoanswers_path }} apt-get install -y {{ klnagent_package_path }}
    - onlyif: test -f {{ klnagent_package_path }}
    - unless: dpkg-query -W -f='${Status}' klnagent64 2>/dev/null | grep -q 'install ok installed'
    - require:
      - cmd: pmg-klnagent-download
      - file: pmg-klnagent-autoanswers

pmg-klnagent-autoinstall-configure:
  cmd.run:
    - name: >-
        mkdir -p /var/lib/salt &&
        DEBIAN_FRONTEND=noninteractive KLAUTOANSWERS={{ klnagent_autoanswers_path }} apt-get install -y --reinstall {{ klnagent_package_path }} &&
        touch {{ klnagent_config_marker }}
    - onlyif: dpkg-query -W -f='${Status}' klnagent64 2>/dev/null | grep -q 'install ok installed'
    - unless: test -f {{ klnagent_config_marker }}
    - require:
      - cmd: pmg-klnagent-install
      - file: pmg-klnagent-autoanswers

pmg-klnagent-service:
  service.running:
    - name: klnagent64
    - enable: true
    - require:
      - cmd: pmg-klnagent-install
      - cmd: pmg-klnagent-autoinstall-configure
{% elif klnagent_enabled %}
pmg-klnagent-skipped:
  test.show_notification:
    - text: "Kaspersky Administration Agent skipped: set package_url + package_path + administration_server in pillar."
{% endif %}

{% if wazuh_enabled %}
pmg-wazuh-download:
  cmd.run:
    - name: wget -qO {{ wazuh_pkg_path }} {{ wazuh_pkg_url }}
    - unless: test -f {{ wazuh_pkg_path }}

pmg-wazuh-install:
  cmd.run:
    - name: WAZUH_MANAGER='{{ wazuh_manager }}' WAZUH_AGENT_GROUP='{{ wazuh_group }}' WAZUH_AGENT_NAME="$(hostname -f)" dpkg -i {{ wazuh_pkg_path }}
    - unless: dpkg-query -W -f='${Status}' wazuh-agent 2>/dev/null | grep -q 'install ok installed'
    - require:
      - cmd: pmg-wazuh-download

pmg-wazuh-service:
  service.running:
    - name: wazuh-agent
    - enable: true
    - require:
      - cmd: pmg-wazuh-install
{% endif %}

{% if qualys_enabled and qualys_package_path and qualys_activation_id and qualys_customer_id %}
pmg-qualys-download:
  cmd.run:
    - name: wget -qO {{ qualys_package_path }} {{ qualys_package_url }}
    - unless: test -f {{ qualys_package_path }}

pmg-qualys-install:
  cmd.run:
    - name: dpkg --install {{ qualys_package_path }}
    - onlyif: test -f {{ qualys_package_path }}
    - unless: dpkg-query -W -f='${Status}' qualys-cloud-agent 2>/dev/null | grep -q 'install ok installed'
    - require:
      - cmd: pmg-qualys-download

pmg-qualys-activate:
  cmd.run:
    - name: /usr/local/qualys/cloud-agent/bin/qualys-cloud-agent.sh ActivationId={{ qualys_activation_id }} CustomerId={{ qualys_customer_id }} ServerUri={{ qualys_server_uri }}
    - onchanges:
      - cmd: pmg-qualys-install
    - onlyif: test -x /usr/local/qualys/cloud-agent/bin/qualys-cloud-agent.sh

pmg-qualys-service:
  service.running:
    - name: qualys-cloud-agent
    - enable: true
    - onlyif: test -f {{ qualys_package_path }}
    - require:
      - cmd: pmg-qualys-install
{% elif qualys_enabled %}
pmg-qualys-skipped:
  test.show_notification:
    - text: "Qualys agent skipped: set package_url + package_path + activation_id + customer_id in pillar."
{% endif %}