# Build and install (Linux/macOS/Windows)
go build -o ztap
sudo mv ztap /usr/local/bin/

# Note for Linux: The binary includes pre-compiled eBPF bytecode.
# No clang/llvm dependency is required at runtime.

# 1. Authenticate
# On first run ZTAP creates an admin account.
# The initial password comes from ZTAP_BOOTSTRAP_ADMIN_PASSWORD,
# or is generated and written to ~/.ztap/bootstrap_admin_password.txt.
ztap user login admin
ztap user change-password admin

# 2. Register services
ztap discovery register web-1 10.0.1.1 --labels app=web,tier=frontend
ztap discovery register db-1 10.0.2.1 --labels app=database,tier=backend

# 3. Enforce a policy
# Validate the policy first (CI/CD friendly)
ztap policy validate -f examples/web-to-db.yaml

# macOS (pf)
ztap enforce -f examples/web-to-db.yaml

# Windows (WFP)
# Note: run in an elevated terminal (Administrator).
# Supports IPv4/IPv6 `ipBlock.cidr` (arbitrary CIDRs) and TCP/UDP/ICMP.
# For `protocol: ICMP`, the policy `port` is accepted by validation but ignored during enforcement.
# Optional strict default-deny can be enabled with: ZTAP_WFP_STRICT=1
ztap enforce -f policy.yaml

# Linux (eBPF)
# Note: `ztap enforce` keeps running while enforcement is active.
# Supports IPv4/IPv6 `ipBlock.cidr` (arbitrary CIDRs) and TCP/UDP/ICMP (ICMP ignores `port`).
# Policies that use selector targets (`podSelector` with optional `namespaceSelector`) are enforced by resolving selectors into concrete `ipBlock` rules via discovery:
# - In-cluster: run `ztap agent`
# - Local/CLI: run `ztap enforce` with `discovery.backend: k8s` configured (auto-resolves and refreshes while running)
#   - Control refresh with `--resolve-labels-interval` (default: `5s`; set to `0` to resolve once)
#   - If a selector currently resolves to zero targets, enforcement still starts; the rule becomes active when targets appear and resolution refreshes
# In multi-namespace Kubernetes deployments:
# - `ztap agent --namespaces ns-a,ns-b` or `ztap agent --all-namespaces`
# - Tenant isolation requires Linux eBPF (iptables fallback can't guarantee isolation)
sudo ztap enforce -f policy.yaml

# Dry-run mode (all platforms)
# Simulate enforcement without making system changes
ztap enforce -f policy.yaml --dry-run
ztap agent --dry-run

# 4. Check status
ztap status

ztap [command]

Commands:
  api         Run REST API server (serve)
  grpc        Run gRPC API server (serve)
  aws         AWS Security Group synchronization (sg-sync, inventory)
  azure       Azure NSG synchronization (nsg-sync)
  gcp         GCP firewall rule synchronization (firewall-sync)
  agent       Run node agent (Kubernetes / in-cluster)
  compliance  Compliance mapping exports and reports
  enforce     Enforce zero-trust network policies
  version     Print ZTAP version
  status      Show on-premises and cloud resource status
  cluster     Manage cluster coordination (status, join, leave, list)
  policy      Distributed policy management (sync, list, watch, show, history, rollback)
  flows       Real-time flow event monitoring (--follow, --action, --protocol)
  logs        View ZTAP logs (with --follow, --level, --policy filters)
  metrics     Start Prometheus metrics server
  user        Manage users (create, login, list, change-password)
  discovery   Service discovery (register, resolve, list)
  audit       Audit log management (view, verify, stats, keygen)

docker compose up -d  # Access at http://localhost:3000 (admin/ztap)

# Build
go build

# Run tests
go test ./...

# Comprehensive security audit (tests + vet + govulncheck + gosec)
bash scripts/security_check.sh

# eBPF integration test (Linux + root required)
sudo go test -tags=integration ./pkg/enforcer -run TestEBPFIntegration -v

# Coverage
go test ./... -cover

# Race detection
go test ./... -race

# Lint (CI uses golangci-lint which includes gofmt + go vet)
go fmt ./...

# Optional: repository secret scan
gitleaks detect --source . --redact --no-banner

./demo.sh  # Interactive demo with RBAC, service discovery, and policy enforcement