#!/bin/sh
[ -n "${IPKG_INSTROOT}" ] || {
	echo "Installing CrowdSec collections for SecuBox..."

	# Install standard collections
	cscli collections install crowdsecurity/linux 2>/dev/null || true
	cscli collections install crowdsecurity/sshd 2>/dev/null || true
	cscli collections install crowdsecurity/base-http-scenarios 2>/dev/null || true
	cscli collections install crowdsecurity/http-cve 2>/dev/null || true
	cscli collections install crowdsecurity/nginx 2>/dev/null || true
	cscli collections install crowdsecurity/http-dos 2>/dev/null || true
	cscli collections install crowdsecurity/haproxy 2>/dev/null || true

	# Install parsers
	cscli parsers install crowdsecurity/syslog-logs 2>/dev/null || true
	cscli parsers install crowdsecurity/http-logs 2>/dev/null || true
	cscli parsers install crowdsecurity/nginx-logs 2>/dev/null || true
	cscli parsers install crowdsecurity/haproxy-logs 2>/dev/null || true

	# Run uci-defaults
	/etc/uci-defaults/99-secubox-app-crowdsec-custom 2>/dev/null || true

	# Restart CrowdSec to load new configs
	/etc/init.d/crowdsec restart 2>/dev/null || true
	sleep 2

	# Restart bouncer
	if [ -f /etc/init.d/crowdsec-firewall-bouncer ]; then
		/etc/init.d/crowdsec-firewall-bouncer restart 2>/dev/null || true
	fi

	echo ""
	echo "SecuBox CrowdSec protection installed!"
	echo "Protected services: LuCI, uhttpd, nginx, HAProxy, Gitea, Streamlit, Webapp"
	echo ""
	echo "Useful commands:"
	echo "  cscli metrics         - View detection metrics"
	echo "  cscli alerts list     - View security alerts"
	echo "  cscli decisions list  - View active bans"
}
exit 0
