firewalld_enabled = node['firewalld']['enabled']
install_snort = node['snort']['enabled']
install_ossec = node['ossec']['enabled']

# Configure YUM Repositories and run a yum update
include_recipe 'img-basic::yum-repos'
include_recipe 'img-basic::yum-update'

include_recipe 'img-basic::certs'

# Configure /etc/resolv.conf
include_recipe 'img-basic::resolver'
include_recipe 'img-basic::sysctl-ipv6'

if firewalld_enabled
  include_recipe 'firewalld::default'
  include_recipe 'img-basic::firewalld-ports'
  include_recipe 'img-basic::firewalld-blacklist-ips'
  include_recipe 'img-basic::firewalld-ssh-rate'
else
  include_recipe 'img-basic::iptables'
  include_recipe 'img-basic::iptables-config'
end

# Essential stuff
include_recipe 'img-basic::essentials'
include_recipe 'img-basic::swap'

# Hosts configuration
include_recipe 'img-basic::hosts'

# OSSEC installation and configuration
include_recipe 'img-basic::ossec' if install_ossec

# Collectd installation/configuration
# TODO: this is deprecated, as it's not used
# include_recipe 'img-basic::collectd-install'

include_recipe 'img-basic::datadog'

# Basic user/group configuration
include_recipe 'img-basic::users'

# Basic packages/services
include_recipe 'img-basic::installed-packages'
include_recipe 'openssh::default'
include_recipe 'openssl::default'
include_recipe 'img-basic::chrony' # NTP client

# Ohai installation and configuration
# TODO: Currently disabled, as it's not used
# include_recipe 'img-basic::ohai'

# Snort installation/configuration
include_recipe 'img-basic::snort' if install_snort
include_recipe 'img-basic::snort-config' if install_snort

include_recipe 'img-basic::suricata' unless install_snort

include_recipe 'img-basic::rkhunter'

# Salt installation

include_recipe 'img-basic::salt-config' if node['salt']['enabled']

# Disabling services
include_recipe 'img-basic::disabled-services'

# Rsyslog installation/configuration
if node['rsyslog']['enabled']
  include_recipe 'img-basic::rsyslog-install'
  include_recipe 'img-basic::rsyslog-config'
end

include_recipe 'img-basic::log-forwarder'

# Add root alias at last step, to avoid emails being sent out during provisioning
include_recipe 'img-basic::root-alias'

include_recipe 'img-basic::logrotate'

include_recipe 'img-basic::osquery' if node['osquery']['enabled']

include_recipe 'img-basic::cloudwatch-logs-agent' if node['cwlogs']['enabled']
