From 3d076221e2f8a25d34cafa2480dc83f2d8a84290 Mon Sep 17 00:00:00 2001
From: admin <admin@sechpoint.com>
Date: Sun, 2 Aug 2026 09:12:27 +0000
Subject: [PATCH] =?UTF-8?q?feat:=20block/monitoring=20mode=20=E2=80=94=20a?=
 =?UTF-8?q?sk=20during=20deploy,=20configurable=20in=20.env?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 cmd/deploy/main.go        | 19 ++++++++++++++++++-
 internal/native/native.go | 10 +++++-----
 2 files changed, 23 insertions(+), 6 deletions(-)

diff --git a/cmd/deploy/main.go b/cmd/deploy/main.go
index e329f24..af9a514 100644
--- a/cmd/deploy/main.go
+++ b/cmd/deploy/main.go
@@ -98,6 +98,7 @@ type nodeConfig struct {
 	UpstreamIP   string
 	UpstreamPort string
 	Labels       string
+	BlockMode    bool
 }
 
 func loadNodes() []nodeConfig {
@@ -122,6 +123,7 @@ func loadNodes() []nodeConfig {
 			UpstreamIP:   env["WALLARM_UPSTREAM_IP_"+n],
 			UpstreamPort: env["WALLARM_UPSTREAM_PORT_"+n],
 			Labels:       env["WALLARM_LABELS_"+n],
+			BlockMode:    env["WALLARM_BLOCK_"+n] == "true",
 		})
 	}
 	if len(nodes) == 0 {
@@ -135,6 +137,7 @@ func loadNodes() []nodeConfig {
 				UpstreamIP:   env["WALLARM_UPSTREAM_IP"],
 				UpstreamPort: env["WALLARM_UPSTREAM_PORT"],
 				Labels:       env["WALLARM_LABELS"],
+				BlockMode:    env["WALLARM_BLOCK"] == "true",
 			})
 		}
 	}
@@ -215,6 +218,20 @@ func deployOne(nc nodeConfig) {
 	if nc.Cloud == "" { nc.Cloud = "EU" }
 	if nc.Labels == "" { nc.Labels = "group=" + nc.Name }
 
+	// Ask for block mode
+	reader := bufio.NewReader(os.Stdin)
+	mode := "monitoring"
+	if nc.BlockMode {
+		fmt.Print("Block mode? [Y/n]: ")
+	} else {
+		fmt.Print("Block mode? [y/N]: ")
+	}
+	ans, _ := reader.ReadString('\n')
+	ans = strings.TrimSpace(strings.ToLower(ans))
+	if ans == "y" || ans == "yes" || (nc.BlockMode && ans == "") {
+		mode = "block"
+	}
+
 	apiHost := "api.wallarm.com"
 	if nc.Cloud == "US" { apiHost = "us1.api.wallarm.com" }
 
@@ -236,7 +253,7 @@ func deployOne(nc nodeConfig) {
 	state.Save(s)
 
 	fmt.Println("Starting deployment...")
-	if err := native.InstallNode(node, nc.Token, apiHost, nc.Labels); err != nil {
+	if err := native.InstallNode(node, nc.Token, apiHost, nc.Labels, mode); err != nil {
 		fmt.Fprintf(os.Stderr, "Deployment failed: %v\n", err)
 		return
 	}
diff --git a/internal/native/native.go b/internal/native/native.go
index a631892..4ac5617 100644
--- a/internal/native/native.go
+++ b/internal/native/native.go
@@ -23,7 +23,7 @@ func installerURL() string {
 	return "https://storage.googleapis.com/meganode_storage/6.12/wallarm-6.12.5.x86_64-glibc.sh"
 }
 
-func InstallNode(node state.Node, apiToken, apiHost, labels string) error {
+func InstallNode(node state.Node, apiToken, apiHost, labels, mode string) error {
 	if apiToken == "" {
 		return fmt.Errorf("API token required")
 	}
@@ -62,7 +62,7 @@ func InstallNode(node state.Node, apiToken, apiHost, labels string) error {
 	}
 
 	// 5. Start NGINX (modules now available after extraction)
-	startNginx(DeployTo, node, port)
+	startNginx(DeployTo, node, port, mode)
 
 	// 6. Load Wallarm NGINX module + register node
 	fmt.Printf("[%s] Configuring NGINX module...\n", node.Name)
@@ -192,7 +192,7 @@ func Status(name string) (string, error) {
 	return string(out), nil
 }
 
-func startNginx(dir string, node state.Node, port string) {
+func startNginx(dir string, node state.Node, port, mode string) {
 	nginxDir := filepath.Join(dir, "nginx")
 	confDir := filepath.Join(nginxDir, "conf")
 	os.MkdirAll(confDir, 0755)
@@ -210,7 +210,7 @@ error_log %s/error.log;
 events { worker_connections 10240; }
 http {
     access_log %s/access.log;
-    wallarm_mode monitoring;
+    wallarm_mode %s;
 
     server {
         listen %s;
@@ -229,7 +229,7 @@ http {
         }
     }
 }
-`, dir, nginxDir, nginxDir, nginxDir, port, upstream)), 0644)
+`, dir, nginxDir, nginxDir, nginxDir, mode, port, upstream)), 0644)
 
 	bin := filepath.Join(nginxDir, "sbin", "nginx")
 	cmd := exec.Command(bin, "-c", confPath, "-p", nginxDir)