#!/usr/bin/make -f

export DEB_BUILD_MAINT_OPTIONS = hardening=+all

SRC      := src
RUNDIR   := /var/ossec
VER      := 4.1.0
SRVROOT  := $(CURDIR)/debian/ossec-hids-server
AGTROOT  := $(CURDIR)/debian/ossec-hids-agent

# Write a vendor-style ossec-init.conf into a staging tree. $(1)=type $(2)=root
define mk_initconf
	printf 'DIRECTORY="%s"\nVERSION="v%s"\nDATE="%s"\nTYPE="%s"\n' \
	    '$(RUNDIR)' '$(VER)' "$$(date -u)" '$(1)' > $(2)$(RUNDIR)/etc/ossec-init.conf
	chmod 0644 $(2)$(RUNDIR)/etc/ossec-init.conf
endef

# Install-time ownership: numeric root (uid/gid 0) so `install -o`/`-g` succeed
# in the build chroot where the ossec accounts do not yet exist. The compiled-in
# user names (-DUSER="ossec" ...) come from the *build* step, which keeps the
# upstream defaults, so runtime users are still ossec/ossecm/ossecr.
OWN      := OSSEC_USER=0 OSSEC_USER_MAIL=0 OSSEC_USER_REM=0 OSSEC_GROUP=0

# PREFIX is the install (staging) location; RUNPREFIX is the directory baked
# into the binaries as the runtime chroot path (see debian/patches). They are
# decoupled so we can stage under debian/<pkg>/ while the daemons still target
# /var/ossec at runtime.
# INSTALL_LOCALTIME/RESOLVCONF would copy host /etc files into the package; keep
# them out of the build and let postinst seed /var/ossec/etc/localtime at runtime.
COMMON   := RUNPREFIX=$(RUNDIR) USE_SYSTEMD=yes PCRE2_SYSTEM=yes \
            INSTALL_LOCALTIME=no INSTALL_RESOLVCONF=no
SRVFEAT  := USE_GEOIP=yes DATABASE=mysql MY_CONFIG=mysql_config

NUMJOBS  := $(patsubst parallel=%,%,$(filter parallel=%,$(DEB_BUILD_OPTIONS)))
ifeq ($(NUMJOBS),)
NUMJOBS  := $(shell nproc)
endif

%:
	dh $@

override_dh_auto_clean:
	-$(MAKE) -C $(SRC) clean
	rm -rf $(SRVROOT) $(AGTROOT)

override_dh_auto_build:
	# No-op. The server and agent variants share a single object directory and
	# are compiled with different -D flags, so they cannot coexist in one build
	# tree. They are therefore built and staged sequentially (with a clean in
	# between) from override_dh_auto_install.

override_dh_auto_install:
	# adduser.sh would try to create system accounts inside the build chroot.
	# Account creation is deferred to the maintainer scripts, so stub it out.
	printf '#!/bin/sh\nexit 0\n' > $(SRC)/init/adduser.sh
	chmod 0755 $(SRC)/init/adduser.sh
	# ---- ossec-hids-server (TARGET=server, GeoIP + MySQL) ----
	$(MAKE) -C $(SRC) -j$(NUMJOBS) TARGET=server PREFIX=$(SRVROOT)$(RUNDIR) $(COMMON) $(SRVFEAT) build
	$(MAKE) -C $(SRC) TARGET=server PREFIX=$(SRVROOT)$(RUNDIR) $(OWN) $(COMMON) $(SRVFEAT) install
	# Vendor parity (functional extras the upstream server install omits):
	#  - ossec-agentd: lets the manager also report to an upper-tier manager
	#  - ossec-regex-convert: rule/decoder regex helper
	#  - etc/shared/ossec-agent.conf: default agent config pushed to agents
	install -m 0550 -o 0 -g 0 $(SRC)/ossec-agentd        $(SRVROOT)$(RUNDIR)/bin/
	install -m 0550 -o 0 -g 0 $(SRC)/ossec-regex-convert $(SRVROOT)$(RUNDIR)/bin/
	install -m 0640 -o 0 -g 0 etc/ossec-agent.conf       $(SRVROOT)$(RUNDIR)/etc/shared/ossec-agent.conf
	$(call mk_initconf,server,$(SRVROOT))
	$(MAKE) -C $(SRC) TARGET=server clean
	# ---- ossec-hids-agent (TARGET=agent) ----
	$(MAKE) -C $(SRC) -j$(NUMJOBS) TARGET=agent PREFIX=$(AGTROOT)$(RUNDIR) $(COMMON) build
	$(MAKE) -C $(SRC) TARGET=agent PREFIX=$(AGTROOT)$(RUNDIR) $(OWN) $(COMMON) install
	$(call mk_initconf,agent,$(AGTROOT))
	$(MAKE) -C $(SRC) TARGET=agent clean

override_dh_installsystemd:
	dh_installsystemd --name=ossec --no-start

override_dh_strip:
	dh_strip --no-automatic-dbgsym
