# Logrotate settings
node.default['logrotate']['global']['/var/log/suricata/*.log'] = {
  'create' => '0600 root root',
  'weekly' => false,
  'daily' => true,
  'rotate' => 5,
  'delaycompress' => true,
  'copytruncate' => true,
  'minsize' => '500k'
}

node.default['logrotate']['global']['/var/log/suricata/eve.json'] = {
  'create' => '0600 root root',
  'weekly' => false,
  'daily' => true,
  'rotate' => 5,
  'delaycompress' => true,
  'copytruncate' => true,
  'minsize' => '500k',
  'postrotate' => ['systemctl restart suricata']
}

package 'suricata' do
  version node['suricata']['version']
end

service 'suricata' do
  action :nothing
end

template '/etc/suricata/suricata.yaml' do
  source 'suricata/suricata.yaml.erb'
  owner 'suricata'
  group 'root'
  variables(
    'home_nets' => node['suricata']['home_net'],
    'xff_enabled' => node['suricata']['xff']['enabled'],
    'xff_header' => node['suricata']['xff']['header']
  )
end

template '/usr/local/bin/suricata.sh' do
  source 'suricata/suricata.sh.erb'
  owner 'root'
  group 'root'
  mode '0755'
  variables(
    'rules_url' => node['suricata']['rules_url']
  )
  not_if { ::File.exist?('/usr/local/bin/suricata.sh') }
end

cookbook_file '/etc/cron.d/suricata.cron' do
  source 'suricata/suricata.cron'
  owner 'root'
  group 'root'
  mode '0755'
  action :create_if_missing
  notifies :start, 'service[suricata]'
end
