#!/bin/bash
# Privileged helper for Veterochek VPN system-level autostart.
# Invoked via pkexec. Actions: enable <config_src> | disable | update <config_src>
set -e

UNIT_NAME="veterochek-vpn-boot"
UNIT_PATH="/etc/systemd/system/${UNIT_NAME}.service"
CONFIG_DIR="/etc/amnezia/amneziawg"
CONFIG_PATH="${CONFIG_DIR}/veterochek_vpn.conf"
OLD_CONFIG_PATH="${CONFIG_DIR}/vpn_boot.conf"

write_unit() {
  cat > "${UNIT_PATH}" << 'UNIT'
[Unit]
Description=Veterochek VPN pre-login autostart
After=network-online.target
Wants=network-online.target

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/usr/bin/awg-quick up /etc/amnezia/amneziawg/veterochek_vpn.conf
ExecStop=/usr/bin/awg-quick down /etc/amnezia/amneziawg/veterochek_vpn.conf

[Install]
WantedBy=multi-user.target
UNIT
}

case "${1:-}" in
  enable)
    CONFIG_SRC="${2:-}"
    if [ -z "${CONFIG_SRC}" ] || [ ! -f "${CONFIG_SRC}" ]; then
      echo "Usage: $0 enable <config_file>" >&2
      exit 1
    fi
    # Migrate: bring down old vpn_boot interface if still running
    if ip link show vpn_boot &>/dev/null 2>&1; then
      /usr/bin/awg-quick down vpn_boot 2>/dev/null || true
    fi
    rm -f "${OLD_CONFIG_PATH}"
    mkdir -p "${CONFIG_DIR}"
    cp "${CONFIG_SRC}" "${CONFIG_PATH}"
    chmod 600 "${CONFIG_PATH}"
    write_unit
    systemctl daemon-reload
    systemctl enable "${UNIT_NAME}"
    systemctl start "${UNIT_NAME}" || true
    ;;
  update)
    CONFIG_SRC="${2:-}"
    if [ -z "${CONFIG_SRC}" ] || [ ! -f "${CONFIG_SRC}" ]; then
      echo "Usage: $0 update <config_file>" >&2
      exit 1
    fi
    mkdir -p "${CONFIG_DIR}"
    cp "${CONFIG_SRC}" "${CONFIG_PATH}"
    chmod 600 "${CONFIG_PATH}"
    # Restart only if the service is currently active
    if systemctl is-active --quiet "${UNIT_NAME}"; then
      systemctl restart "${UNIT_NAME}" || true
    fi
    ;;
  disable)
    systemctl stop "${UNIT_NAME}" 2>/dev/null || true
    systemctl disable "${UNIT_NAME}" 2>/dev/null || true
    rm -f "${UNIT_PATH}"
    systemctl daemon-reload 2>/dev/null || true
    rm -f "${CONFIG_PATH}"
    rm -f "${OLD_CONFIG_PATH}"  # migration cleanup
    ;;
  *)
    echo "Usage: $0 {enable <config_file>|update <config_file>|disable}" >&2
    exit 1
    ;;
esac
