#!/usr/bin/env bash
# mlt — MacLustr Tunnel depuis le laptop : le « ngrok privé » du cluster (WireGuard + Caddy sur une passerelle OVH).
#
#   mlt [-g BHS64] status                       pairs WireGuard + routes publiques de la passerelle
#   mlt [-g …] peer <alias> [<alias>…]         installe WireGuard sur un Mac (brew wireguard-tools, LaunchDaemon) et l'enregistre sur le hub
#   mlt [-g …] add <domaine> <alias>:<port> [<alias>:<port>…]   expose https://<domaine> → nœud(s) (TLS auto ; DNS A → IP de la passerelle)
#   mlt [-g …] redirect <domaine> <cible>      ex. mlt redirect qc26.ca www.qc26.ca
#   mlt [-g …] rm <domaine> | ls | ssh
#
# Passerelle : BHS64 (Beauharnois, wg1 / 10.67.0.x, IP 51.161.112.61). R9128 (Gravelines, wg0 / 10.66.0.x) retirée le 2026-10-02.
# Équivalent de `ngrok http <port> --url=<domaine>` : mlt add <domaine> <nœud>:<port>  (+ A → IP passerelle chez GoDaddy).
set -euo pipefail
HERE="$(cd "$(dirname "$0")" && pwd)"
TOOLS="$HERE/maclustr-tunnel"
GW=${MLT_GW:-BHS64}
if [ "${1:-}" = "-g" ]; then GW=$2; shift 2; fi
case "$GW" in
  BHS64) GW_IP=51.161.112.61; IFACE=wg1; SUBNET=10.67.0; SERVER_PUB=${MLT_PUB_BHS64:-$(cat "$TOOLS/hub-BHS64.pub" 2>/dev/null || true)} ;;
  *) echo "mlt: passerelle inconnue $GW (BHS64 seulement depuis le 2026-10-02)" >&2; exit 1 ;;
esac
die(){ echo "mlt: $*" >&2; exit 1; }
sudo_pw_for(){ local pw; pw=$(ssh M1M32 "cat ~/dispatch/.sudo-$1 2>/dev/null"); echo "${pw:-492592}"; }   # loués : M1M32:~/dispatch/.sudo-<alias> ; LAN : 492592
cmd=${1:-status}; shift || true
case "$cmd" in
  status|ls) ssh "$GW" "sudo tunnelctl $cmd" ;;
  add|redirect|rm) ssh "$GW" "sudo tunnelctl $cmd $(printf '%q ' "$@")" ;;
  ssh) exec ssh "$GW" ;;
  peer)
    [ $# -ge 1 ] || die "mlt peer <alias>…"
    [ -n "$SERVER_PUB" ] || die "clé publique du hub $GW inconnue (fichier $TOOLS/hub-$GW.pub)"
    for a in "$@"; do
      ip=$(awk -v a="$a" '$1==a{print $2}' "$TOOLS/ipmap" | sed "s/^10\.66\.0\./$SUBNET./"); [ -n "$ip" ] || die "alias $a absent de $TOOLS/ipmap"
      pw=$(sudo_pw_for "$a")
      echo "== $a → $ip ($IFACE → $GW $GW_IP)"
      scp -q "$TOOLS/wg-node-setup.sh" "$a:/tmp/wg-node-setup.sh"
      out=$(ssh "$a" "bash /tmp/wg-node-setup.sh $ip $SERVER_PUB '$pw' $IFACE $GW_IP:51820 2>&1" | tail -3)
      echo "$out" | grep -v PUBKEY | sed 's/^/   /'
      pub=$(echo "$out" | awk '/PUBKEY/{print $NF}'); [ -n "$pub" ] || die "pas de clé publique renvoyée par $a"
      ssh "$GW" "sudo tunnelctl peer add $a $pub" | sed 's/^/   /'
      sleep 3; ssh "$GW" "ping -c 1 -W 3 -q $ip >/dev/null && echo '   ping OK depuis la passerelle' || echo '   ping KO (attendre le handshake, keepalive 25 s)'"
    done ;;
  *) sed -n '2,12p' "$0"; exit 1 ;;
esac