#!/bin/sh
set -e
# Alpine (ADR-0116) equivalent of rsyslog-postinst.sh. No ldconfig (musl has
# none), no AppArmor (not run by default on Alpine — accepted gap, see
# openrc/rsyslog.initd), no thrt_ingest cleanup (this target never shipped
# that retired unit, so there's nothing to clean up on a fresh install).

# Allow wake user to deploy rsyslog configs.
mkdir -p /etc/rsyslog.d
chgrp wake /etc/rsyslog.d 2>/dev/null || true
chmod 775 /etc/rsyslog.d

# This package ships /etc/sudoers.d/wake (the grant that lets the
# unprivileged wake user reload/restart rsyslog after a CTI/rulebase
# deploy). Alpine's sudo package should honor /etc/sudoers.d/ by default
# like Debian/Ubuntu's does, but defensively ensure the includedir
# directive is actually present rather than assume it — an un-included
# sudoers.d/wake would silently grant nothing.
if [ -f /etc/sudoers ] && ! grep -qE '^[#@]includedir[[:space:]]+/etc/sudoers\.d' /etc/sudoers; then
    echo '@includedir /etc/sudoers.d' >> /etc/sudoers
fi

# ADR-0075: the base /etc/rsyslog.conf must NOT load the WAKE mm modules.
# Strip any stale base-config load line so a reinstall/upgrade doesn't
# double-load or fail on "module already in this config".
if [ -f /etc/rsyslog.conf ]; then
    sed -i -E '/^[[:space:]]*module\(load="mm(threat|enrich|wake)"\)/d' /etc/rsyslog.conf 2>/dev/null || true
fi

# Restart only if currently running — the OpenRC equivalent of systemd's
# try-restart (a fresh install naturally no-ops here since nothing is
# running yet).
rc-service rsyslog status >/dev/null 2>&1 && rc-service rsyslog restart >/dev/null 2>&1 || true
