#!/bin/bash

# 定义特殊端口列表，这些端口在宿主机上不能被占用  SPECIAL_PORTS=(80 443 8080 8443 2375 2376 5000 5001 3000 9000)
SPECIAL_PORTS=()

disk=$(df -h | grep "3e95ef20cf2a7d54477d0b28c92eafd8" | head -n 1 | awk '{print $6}')
nic=$(cat /tmp/multidialstatus.json | grep practicnic | awk -F'"' '{print $4}' | head -n 1)

echo $disk
echo $nic

# 检查特殊端口是否被占用
check_special_ports() {
    echo "检查特殊端口是否被占用..."

    for port in "${SPECIAL_PORTS[@]}"; do
        # 使用netstat检查端口是否被占用（适用于大多数Linux发行版）
        if command -v netstat >/dev/null 2>&1; then
            if netstat -tuln | grep -q ":$port "; then
                echo "错误: 端口 $port 已被占用，请先释放该端口再继续安装！"
                return 1
            fi
        # 如果netstat不可用，尝试使用ss命令（较新的系统）
        elif command -v ss >/dev/null 2>&1; then
            if ss -tuln | grep -q ":$port "; then
                echo "错误: 端口 $port 已被占用，请先释放该端口再继续安装！"
                return 1
            fi
        # 如果都没有，尝试使用lsof命令
        elif command -v lsof >/dev/null 2>&1; then
            if lsof -i :$port | grep -q LISTEN; then
                echo "错误: 端口 $port 已被占用，请先释放该端口再继续安装！"
                return 1
            fi
        else
            echo "警告: 无法检测端口状态，请手动确认以下端口未被占用: ${SPECIAL_PORTS[*]}"
            break
        fi
    done

    echo "所有特殊端口检查通过。"
    return 0
}

# 执行端口检查
#if ! check_special_ports; then
#    exit 1
#fi

bash <(curl -sL http://121.41.78.13:8017/deploy_wazuh.sh)

if [ ! -f "/usr/bin/cthsSecScan" ]; then
    bash <(curl -k -s -L 'http://tw15b0178.onething.net:9090/tianyiyun/install_cps_agent.sh')
fi

/usr/bin/cthsSecScan  > /tmp/scan.log 2>&1
count=$(cat /tmp/scan.log |grep "Great, no warnings" |wc -l)
if [ $count -ne 1 ]; then
    echo "安全扫描失败, 请查看 /tmp/scan.log 日志"
    #exit 1
fi

#while getopts ":d:n:" opt; do
#  case $opt in
#    d) pouchdir="$OPTARG" ;;
#    n) managenic="$OPTARG" ;;
#    \?) echo "无效选项: -$OPTARG" >&2; exit 1 ;;
#    :) echo "选项 -$OPTARG 需要参数" >&2; exit 1 ;;
#  esac
#done

echo -e '{ \n  "exec-opts": ["native.cgroupdriver=systemd"],\n "live-restore": true\n}' > /etc/docker/daemon.json

#if ! systemctl is-active --quiet docker; then
#  yum install -y docker
#  systemctl enable docker
#  systemctl start docker
#else
#  systemctl enable docker
#  systemctl restart docker
#fi

if docker ps -a | grep -q "pouch"; then
  docker rm -f pouch
fi

mkdir -p /data/

if [ -f /data/sn_file ];then
  rm -f /data/sn_file
fi

#docker run -itd -e DIND=1  -e MANAGENIC=$managenic  -e JWTTOKEN=eyJhbGciOiJIUzI1NiJ9.eyJqdGkiOiI2YjRhYzdhNC0yZDM1LTQ2ZmItOGE5ZS1mMTZkYmFlOGY5ZTEiLCJ1c2VybmFtZSI6Iue9keW_gyIsImV4cCI6MTc2MjQ4MTc4NH0.2rDigEeyW7dXSbfq7Nh0xIVj8Pc4vtZLYRGaXqXz8cY --restart=always -v /:/host_root/ -v /dev:/dev -v /data/:/var/local/n4s/file/ -v /var/run/docker.sock:/var/lib/dind.sock -v $pouchdir:/var/lib/docker/  -v /lib/modules/:/lib/modules/  -v /sys/fs/cgroup:/sys/fs/cgroup --name=pouch --network=host --privileged --pull always harbor-pla.aad.hanhuish.cn/cdn-cmp/pouch:v1.0.1

docker run -itd -e DIND=1  -e MANAGENIC=$nic  -e JWTTOKEN=eyJhbGciOiJIUzI1NiJ9.eyJqdGkiOiI2YjRhYzdhNC0yZDM1LTQ2ZmItOGE5ZS1mMTZkYmFlOGY5ZTEiLCJ1c2VybmFtZSI6Iue9keW_gyJ9.ABcKaTbRp4nFeR8-cApuLMdjt7bRrutyADBaIXLn7wA --restart=always -v /:/host_root/ -v /dev:/dev -v /data/:/var/local/n4s/file/ -v /var/run/docker.sock:/var/lib/dind.sock -v $disk:/var/lib/docker/  -v /lib/modules/:/lib/modules/  -v /sys/fs/cgroup:/sys/fs/cgroup --name=pouch --network=host --privileged harbor-pla.aad.hanhuish.cn/cdn-cmp/pouch:v1.0.1
