File: uninstall.sh

#!/usr/bin/env bash
#=============================================================================
# Sentinela ? Intelligent Linux Security Framework
# uninstall.sh ? Desinstalador del sistema
#=============================================================================
#
# Uso: ./uninstall.sh [--force]
#
# --force: Desinstalación sin preguntas
#
# NOTA: Este script RESTAURA las reglas de iptables al estado anterior
#       (snapshot previo a la instalación de Sentinela) si existe,
#       o elimina solo las cadenas SENTINELA_* para no afectar otras reglas.
#=============================================================================

set -Eeuo pipefail

#=============================================================================
# Configuración
#=============================================================================
INSTALL_DIR="/usr/local/sentinela"
BIN_LINK="/usr/local/bin/sentinela"
CONFIG_DIR="/etc/sentinela"
LOG_DIR_INSTALL="/var/log/sentinela"
BACKUP_DIR_INSTALL="/var/backups/sentinela"
DASHBOARD_DIR_INSTALL="/var/www/sentinela"

FORCE=false

for arg in "$@"; do
    case "${arg}" in
        --force) FORCE=true ;;
    esac
done

RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
CYAN='\033[0;36m'
NC='\033[0m'

info()  { echo -e "${CYAN}[INFO]${NC}  $*"; }
ok()    { echo -e "${GREEN}[OK]${NC}    $*"; }
warn()  { echo -e "${YELLOW}[WARN]${NC}  $*"; }
error() { echo -e "${RED}[ERROR]${NC} $*"; }

#=============================================================================
# Confirmar desinstalación
#=============================================================================
confirm_uninstall() {
    if [[ "${FORCE}" == "true" ]]; then
        return 0
    fi

    echo "???????????????????????????????????????????????"
    echo "  ??  ESTO ELIMINARÁ SENTINELA COMPLETAMENTE"
    echo "???????????????????????????????????????????????"
    echo
    echo "Se eliminarán:"
    echo "  - ${INSTALL_DIR}"
    echo "  - ${CONFIG_DIR}"
    echo "  - ${LOG_DIR_INSTALL}"
    echo "  - ${BACKUP_DIR_INSTALL}"
    echo "  - ${DASHBOARD_DIR_INSTALL}"
    echo "  - /etc/systemd/system/sentinela.service"
    echo "  - /etc/cron.d/sentinela"
    echo "  - /etc/apache2/sites-available/sentinela.conf"
    echo "  - Ipsets: SENTINELA_TRUSTED, BLACKLIST, DDOS, REPUTATION, HONEY"
    echo "  - Cadenas iptables: SENTINELA_INPUT, SENTINELA_NEW"
    echo
    read -r -p "¿Está seguro de continuar? (escriba 'YES' para confirmar): " confirm
    if [[ "${confirm}" != "YES" ]]; then
        echo "Desinstalación cancelada."
        exit 0
    fi
}

#=============================================================================
# Detener servicios
#=============================================================================
stop_services() {
    info "Deteniendo servicios..."

    systemctl stop sentinela.service 2>/dev/null || true
    systemctl disable sentinela.service 2>/dev/null || true

    # Remover reglas de Sentinela de iptables (NO hacer flush general)
    if iptables -L SENTINELA_INPUT &>/dev/null; then
        # Remover enganche de INPUT
        iptables -D INPUT -j SENTINELA_INPUT 2>/dev/null || true
        # Flush y borrar cadenas
        iptables -F SENTINELA_NEW 2>/dev/null || true
        iptables -F SENTINELA_INPUT 2>/dev/null || true
        iptables -X SENTINELA_NEW 2>/dev/null || true
        iptables -X SENTINELA_INPUT 2>/dev/null || true
        info "Cadenas SENTINELA_* removidas de iptables"
    fi

    ok "Servicios detenidos"
}

#=============================================================================
# Eliminar ipsets
#=============================================================================
remove_ipsets() {
    info "Eliminando ipsets..."

    for set_name in SENTINELA_TRUSTED SENTINELA_BLACKLIST SENTINELA_DDOS SENTINELA_REPUTATION SENTINELA_HONEY; do
        ipset destroy "${set_name}" 2>/dev/null || true
    done

    ok "Ipsets eliminados"
}

#=============================================================================
# Eliminar archivos
#=============================================================================
remove_files() {
    info "Eliminando archivos..."

    rm -rf "${INSTALL_DIR}" 2>/dev/null || true
    rm -f "${BIN_LINK}" 2>/dev/null || true
    rm -rf "${CONFIG_DIR}" 2>/dev/null || true
    rm -f /etc/systemd/system/sentinela.service 2>/dev/null || true
    rm -f /etc/cron.d/sentinela 2>/dev/null || true
    rm -f /etc/apache2/sites-available/sentinela.conf 2>/dev/null || true

    systemctl daemon-reload 2>/dev/null || true

    ok "Archivos eliminados"
}

#=============================================================================
# Preguntar por datos (logs, backups, dashboard)
#=============================================================================
remove_data() {
    if [[ "${FORCE}" != "true" ]]; then
        echo
        read -r -p "¿Eliminar logs, backups y dashboard? (s/N): " confirm
        if [[ "${confirm,,}" != "s" ]]; then
            info "Conservando: ${LOG_DIR_INSTALL}, ${BACKUP_DIR_INSTALL}, ${DASHBOARD_DIR_INSTALL}"
            return 0
        fi
    fi

    info "Eliminando datos..."

    rm -rf "${LOG_DIR_INSTALL}" 2>/dev/null || true
    rm -rf "${BACKUP_DIR_INSTALL}" 2>/dev/null || true
    rm -rf "${DASHBOARD_DIR_INSTALL}" 2>/dev/null || true

    ok "Datos eliminados"
}

#=============================================================================
# Main
#=============================================================================
main() {
    echo "??? Sentinela ? Desinstalación ???"
    echo

    if [[ $EUID -ne 0 ]]; then
        error "Debe ejecutarse como root"
        exit 1
    fi

    confirm_uninstall
    echo
    stop_services
    echo
    remove_ipsets
    echo
    remove_files
    echo
    remove_data
    echo
    ok "Sentinela desinstalado exitosamente"
    echo
    echo "Nota: Si había reglas de iptables antes de Sentinela,"
    echo "puede restaurarlas con: iptables-restore < /var/backups/sentinela/snapshot.last"
    echo
}

main "$@"