#!/usr/bin/env bash
# migrate-watch.sh — surveille une liste de domaines ; dès que le DNS autoritaire pointe vers la passerelle,
# crée la route Caddy (+ redirection apex si l'apex pointe aussi vers la passerelle) et vérifie en HTTPS.
# Usage : migrate-watch.sh <fichier-liste> [passerelle=BHS64] [durée max en s=7200]
#   fichier-liste : une ligne par site  «  <domaine> <alias>:<port> [<alias>:<port>…]  »  (# = commentaire)
# Journal : ~/Desktop/cluster-skill/maclustr-tunnel/migrate.log
set -uo pipefail
LIST=${1:?liste}; GW=${2:-BHS64}; MAX=${3:-7200}
HERE="$(cd "$(dirname "$0")" && pwd)"; MLT="$HERE/../mlt"; LOG="$HERE/migrate.log"
case "$GW" in BHS64) IP=51.161.112.61;; R9128) IP=51.255.75.61;; *) echo "passerelle ?"; exit 1;; esac
DONE_DIR=$(mktemp -d)
log(){ echo "$(date '+%F %T') $*" | tee -a "$LOG"; }
apex_of(){ echo "$1" | sed -E 's/^(www|app|console|node|cloud|git)\.//'; }
t0=$(date +%s)
log "== surveillance de $(grep -c -v -E '^\s*(#|$)' "$LIST") domaines → $GW ($IP)"
while :; do
  left=0
  while read -r dom ups; do
    [[ -z "$dom" || "$dom" =~ ^# ]] && continue
    [ -f "$DONE_DIR/$dom" ] && continue
    left=$((left+1))
    apex=$(apex_of "$dom"); ns=$(dig +short NS "$apex" | head -1)
    a=$(dig +short "$dom" A @"$ns" 2>/dev/null | tail -1)
    [ "$a" = "$IP" ] || continue
    log "→ $dom pointe vers $GW : création de la route ($ups)"
    "$MLT" -g "$GW" add "$dom" $ups 2>&1 | grep -v '^{' | sed 's/^/   /' | tee -a "$LOG"
    if [ "$apex" != "$dom" ]; then
      aa=$(dig +short "$apex" A @"$ns" 2>/dev/null | tail -1)
      if [ "$aa" = "$IP" ]; then "$MLT" -g "$GW" redirect "$apex" "$dom" 2>&1 | grep -v '^{' | sed 's/^/   /' | tee -a "$LOG"; else log "   apex $apex = ${aa:-∅} (pas de redirection posée)"; fi
    fi
    sleep 8
    code=$(/usr/bin/curl -s -m 40 --resolve "$dom:443:$IP" -o /dev/null -w '%{http_code}' "https://$dom/")
    log "   https://$dom via $GW → HTTP $code"
    touch "$DONE_DIR/$dom"
  done < "$LIST"
  [ $left -eq 0 ] && { log "== tous les domaines migrés"; break; }
  [ $(( $(date +%s) - t0 )) -gt "$MAX" ] && { log "== délai dépassé, restent $left domaine(s)"; break; }
  sleep 20
done