{
    "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "vmName": {
            "defaultValue": "flyingduck-runners-vm",
            "type": "string",
            "metadata": {
                "description": "Name of the virtual machine."
            }
        },
        "location": {
            "defaultValue": "[resourceGroup().location]",
            "type": "string",
            "metadata": {
                "description": "Location for all resources."
            }
        },
        "networkInterfaceName": {
            "type": "string",
            "metadata": {
                "description": "Name of the existing network interface. The network interface should be associated with a public subnet and should have a network security group (NSG) configured to allow inbound traffic on ports 22 (SSH), 443 (HTTPS), and 80 (HTTP)."
            }
        },
        "vmSize": {
            "defaultValue": "Standard_DS2_v2",
            "type": "string",
            "metadata": {
                "description": "Type of storage"
            }
        },
        "authenticationType": {
            "defaultValue": "sshPublicKey",
            "allowedValues": [
                "sshPublicKey",
                "password"
            ],
            "type": "string",
            "metadata": {
                "description": "Type of authentication to use on the Virtual Machine. SSH key is recommended."
            }
        },
        "adminPasswordOrKey": {
            "type": "securestring",
            "metadata": {
                "description": "SSH Key or password for the Virtual Machine. SSH key is recommended."
            }
        },
        "FD_API_KEY": {
            "type": "string",
            "metadata": {
                "description": "The API key for Flyingduck authentication (*Required)"
            }
        },
        "AssumeProvider": {
            "allowedValues": [
                "github",
                "github_onprem",
                "bitbucket",
                "bitbucket_onprem",
                "gitlab",
                "gitlab_onprem",
                "azure_devops",
                "azure_devops_onprem"
            ],
            "type": "string",
            "metadata": {
                "description": "Provider to integrate with Flyingduck (*Required)"
            }
        },
        "AllowInsecureConnection": {
            "defaultValue": "false",
            "type": "bool",
            "metadata": {
                "description": "Enable insecure TLS connection to Flyingduck (*Required)"
            }
        },
        "DDArgs": {
            "defaultValue": "-d",
            "type": "string",
            "metadata": {
                "description": "Additional command line arguments for duckdefender. Example: '-c' (Enable connector mode), '--loglevel=debug' (Enable debug logging). If you need to add multiple arguments, add them one by one separated by spaces."
            }
        }
    },
    "variables": {
        "linuxConfiguration": {
            "disablePasswordAuthentication": true,
            "ssh": {
                "publicKeys": [
                    {
                        "path": "[format('/home/azureuser/.ssh/authorized_keys')]",
                        "keyData": "[parameters('adminPasswordOrKey')]"
                    }
                ]
            }
        },
        "tags": {
            "Name": "Flyingduck-Runner",
            "Created_By": "Flyingduck",
            "Description": "Instance for Flyingduck security code scanning and analysis"
        }
    },
    "functions": [],
    "resources": [
        {
            "type": "Microsoft.Resources/templateSpecs",
            "apiVersion": "2021-05-01",
            "name": "flyingduck-template-spec",
            "location": "[parameters('location')]",
            "tags": "[variables('tags')]",
            "properties": {
                "displayName": "flyingduck-template-spec"
            },
            "resources": [
                {
                    "type": "versions",
                    "apiVersion": "2021-05-01",
                    "name": "latest",
                    "location": "[parameters('location')]",
                    "dependsOn": [
                        "flyingduck-template-spec"
                    ],
                    "tags": "[variables('tags')]",
                    "properties": {
                        "mainTemplate": {
                            "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                            "contentVersion": "1.0.0.0",
                            "parameters": {},
                            "variables": {},
                            "resources": [
                                {
                                    "type": "Microsoft.Compute/virtualMachines",
                                    "apiVersion": "2021-03-01",
                                    "name": "[parameters('vmName')]",
                                    "location": "[parameters('location')]",
                                    "tags": "[variables('tags')]",
                                    "properties": {
                                        "hardwareProfile": {
                                            "vmSize": "[parameters('vmSize')]"
                                        },
                                        "osProfile": {
                                            "computerName": "[parameters('vmName')]",
                                            "adminUsername": "azureuser",
                                            "adminPassword": "[parameters('adminPasswordOrKey')]",
                                            "linuxConfiguration": "[if(equals(parameters('authenticationType'), 'password'), null(), variables('linuxConfiguration'))]"
                                        },
                                        "userData": "[base64(concat('#!/bin/bash\nDEFAULT_USER=$(ls /home | head -n 1)\napt update -y\napt install -y docker.io jq curl\nusermod -aG docker $DEFAULT_USER\nINSTALL_DIR=\"/home/$DEFAULT_USER/.flyingduck\"\nmkdir -p $INSTALL_DIR\nchown $DEFAULT_USER:$DEFAULT_USER $INSTALL_DIR\ncd $INSTALL_DIR\nexport FD_API_KEY=\"', parameters('FD_API_KEY'), '\"\necho \"export FD_API_KEY=\\\"', parameters('FD_API_KEY'), '\\\"\" >> ~/.bashrc\necho \"export FD_API_KEY=\\\"', parameters('FD_API_KEY'), '\\\"\" >> /home/$DEFAULT_USER/.bashrc\nexport ASSUME_PROVIDER=\"', parameters('AssumeProvider'), '\"\necho \"export ASSUME_PROVIDER=\\\"', parameters('AssumeProvider'), '\\\"\" >> ~/.bashrc\necho \"export ASSUME_PROVIDER=\\\"', parameters('AssumeProvider'), '\\\"\" >> /home/$DEFAULT_USER/.bashrc\nexport ALLOW_INSECURE_CONNECTION=\"', parameters('AllowInsecureConnection'), '\"\necho \"export ALLOW_INSECURE_CONNECTION=\\\"', parameters('AllowInsecureConnection'), '\\\"\" >> ~/.bashrc\necho \"export ALLOW_INSECURE_CONNECTION=\\\"', parameters('AllowInsecureConnection'), '\\\"\" >> /home/$DEFAULT_USER/.bashrc\nexport DD_ARGS=\"', parameters('DDArgs'), '\"\necho \"export DD_ARGS=\\\"', parameters('DDArgs'), '\\\"\" >> ~/.bashrc\necho \"export DD_ARGS=\\\"', parameters('DDArgs'), '\\\"\" >> /home/$DEFAULT_USER/.bashrc\nwget https://assets.in.flyingduck.io/scripts/runners/duckdefender-reload-latest-version.sh\nchmod +x duckdefender-reload-latest-version.sh\nchown $DEFAULT_USER:$DEFAULT_USER duckdefender-reload-latest-version.sh\nwget https://assets.in.flyingduck.io/scripts/runners/duckdefender.sh\nchmod +x duckdefender.sh\nchown $DEFAULT_USER:$DEFAULT_USER duckdefender.sh\nsh duckdefender.sh\nsu - $DEFAULT_USER -c \"(crontab -l 2>/dev/null || true; echo \\\"*/2 * * * * bash -ic \\\\\\\"source ~/.bashrc; $INSTALL_DIR/duckdefender-reload-latest-version.sh >> $INSTALL_DIR/duckdefender-reload-latest-version.log 2>&1\\\\\\\"\\\") | crontab -\"\n'))]",
                                        "storageProfile": {
                                            "imageReference": {
                                                "publisher": "canonical",
                                                "offer": "ubuntu-24_04-lts",
                                                "sku": "server",
                                                "version": "latest"
                                            },
                                            "osDisk": {
                                                "createOption": "FromImage"
                                            }
                                        },
                                        "networkProfile": {
                                            "networkInterfaces": [
                                                {
                                                    "id": "[resourceId('Microsoft.Network/networkInterfaces',parameters('networkInterfaceName'))]"
                                                }
                                            ]
                                        }
                                    }
                                }
                            ],
                            "outputs": {
                                "vmName": {
                                    "type": "string",
                                    "value": "[parameters('vmName')]"
                                },
                                "version": {
                                    "type": "string",
                                    "value": "2.0.0"
                                }
                            }
                        }
                    }
                }
            ]
        }
    ],
    "outputs": {
        "version": {
            "type": "string",
            "value": "2.0.0"
        }
    }
}