#!/bin/bash
set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
cd "$SCRIPT_DIR"
set -a
[ -f "${SCRIPT_DIR}/env-wireguard" ]    && source "${SCRIPT_DIR}/env-wireguard"
set +a

WG_NAMESPACE="${WG_NAMESPACE:-vpn}"
WG_IMAGE="${WG_IMAGE:-ghcr.io/wg-easy/wg-easy:15}"
WG_NODE="${WG_NODE:-}"
WG_FIP_NAME="${WG_FIP_NAME:-}"
WG_LB_IPAM_IP="${WG_LB_IPAM_IP:-}"
WG_STORAGE_CLASS="${WG_STORAGE_CLASS:-hcloud-volumes}"
WG_STORAGE_SIZE="${WG_STORAGE_SIZE:-1Gi}"
WG_LISTEN_PORT="${WG_LISTEN_PORT:-51820}"
WG_UI_PORT="${WG_UI_PORT:-51821}"
KUBECONFIG="${KUBECONFIG:-/etc/kubernetes/admin.conf}"

export KUBECONFIG WG_NAMESPACE WG_IMAGE WG_NODE WG_FIP_NAME WG_LB_IPAM_IP \
       WG_STORAGE_CLASS WG_STORAGE_SIZE WG_LISTEN_PORT WG_UI_PORT SCRIPT_DIR

source "${SCRIPT_DIR}/wireguard-lib.sh"

CMD_TSK="${CMD_TSK:-${1:-install}}"

_do_install() {
  _require_env WG_LB_IPAM_IP
  bash "${SCRIPT_DIR}/run-init.sh"
  echo "wireguard installed in namespace $WG_NAMESPACE"
  echo "  Server public key: $(just vpn-pubkey 2>/dev/null || _method_pubkey)"
  echo "  VPN endpoint: ${WG_LB_IPAM_IP}:${WG_LISTEN_PORT}/udp"
  echo "  Admin UI: http://10.200.0.1:${WG_UI_PORT} (via VPN only)"
}

_do_update() {
  _method_create-credentials
  bash "${SCRIPT_DIR}/run-update.sh"
  echo "wireguard updated"
}

_do_delete() {
  bash "${SCRIPT_DIR}/run-delete.sh"
  echo "wireguard workload deleted (namespace and pvc retained)"
}

_do_restart() {
  bash "${SCRIPT_DIR}/run-restart.sh"
  echo "wireguard restarted"
}

_do_health() {
  _method_health
}

case "$CMD_TSK" in
  install)           _do_install ;;
  update)            _do_update  ;;
  delete)            _do_delete  ;;
  restart)           _do_restart ;;
  health)            _do_health  ;;
  bootstrap-keypair) _method_bootstrap-keypair ;;
  create-credentials) _method_create-credentials ;;
  protect-volume)    _method_protect-volume ;;
  wait-ready)        _method_wait-ready ;;
  pubkey)            _method_pubkey ;;
  *)
    echo "ERROR: unknown CMD_TSK='$CMD_TSK'" >&2
    echo "Valid: install|update|delete|restart|health|bootstrap-keypair|create-credentials|protect-volume|wait-ready|pubkey" >&2
    exit 1
    ;;
esac