#!/bin/bash

# Manages a single wireguard-ui host tunnel directly with wg-quick.
#
# This project deliberately avoids /etc/wireguard entirely so it can never
# collide with an existing WireGuard setup. Host configs live under
# /var/lib/wgui/hosts and the web server brings tunnels up/down through this
# helper instead of systemd. Interfaces follow the project convention
# wgui<host_id> (e.g. wgui0), never stock names like wg0.
#
# Usage: wg-quick-manage.sh <up|down|restart> <interface> <config-path>
#   action        up      bring the tunnel up if it is not already up
#                 down    bring the tunnel down if it is up
#                 restart down (if needed), then up
#   interface     e.g. wgui0 — must match wgui[0-9]+ (project convention)
#   config-path   must be /var/lib/wgui/hosts/<interface>.conf
#
# Designed to run as root only (the web server runs as root).

set -euo pipefail

ACTION="${1:-}"
INTERFACE="${2:-}"
CONFIG_PATH="${3:-}"

if [ -z "$ACTION" ] || [ -z "$INTERFACE" ] || [ -z "$CONFIG_PATH" ]; then
    echo "usage: $0 <up|down|restart> <interface> <config-path>" >&2
    exit 1
fi

if [[ ! "$INTERFACE" =~ ^wgui[0-9]+$ ]]; then
    echo "error: refusing to manage non-project interface '$INTERFACE' (expected wgui[0-9]+)" >&2
    exit 1
fi

case "$ACTION" in
    up | down | restart) ;;
    *)
        echo "error: unknown action '$ACTION' (expected up, down, or restart)" >&2
        exit 1
        ;;
esac

# EXPECTED_CONFIG_PATH="/var/lib/wgui/hosts/${INTERFACE}.conf"
# if [ "$CONFIG_PATH" != "$EXPECTED_CONFIG_PATH" ]; then
#     echo "error: config path must be $EXPECTED_CONFIG_PATH" >&2
#     exit 1
# fi

WG_QUICK_BIN="$(command -v wg-quick)"
if [ -z "$WG_QUICK_BIN" ]; then
    echo "error: wg-quick not found — run setup-wireguard.sh first" >&2
    exit 1
fi

interface_is_up() {
    ip link show dev "$INTERFACE" >/dev/null 2>&1
}

bring_up() {
    if interface_is_up; then
        echo "interface $INTERFACE is already up — nothing to do."
        return 0
    fi
    "$WG_QUICK_BIN" up "$CONFIG_PATH"
}

bring_down() {
    if ! interface_is_up; then
        echo "interface $INTERFACE is not up — nothing to do."
        return 0
    fi
    "$WG_QUICK_BIN" down "$CONFIG_PATH"
}

case "$ACTION" in
    up)
        bring_up
        ;;
    down)
        bring_down
        ;;
    restart)
        bring_down
        bring_up
        ;;
esac