#!/bin/bash
set -euo pipefail
ZARYA_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
source "${ZARYA_DIR}/lib/common.sh"

TARGET_IP=""
ALIAS=""
PORT="${SRV_DEFAULT_PORT:-1488}"
USER_NAME="${SRV_DEFAULT_USER:-atlas}"
TCP_PORTS="${SRV_DEFAULT_TCP_PORTS:-1488 80 443}"
UDP_PORTS="${SRV_DEFAULT_UDP_PORTS:-51820}"
UFW_IN="${SRV_UFW_INCOMING:-deny}"
UFW_OUT="${SRV_UFW_OUTGOING:-allow}"
UFW_FWD="${SRV_UFW_FORWARD:-deny}"
UFW_APP="${SRV_UFW_APPLICATION:-skip}"
ENABLE_BBR="${SRV_ENABLE_BBR:-true}"
DISABLE_IPV6="${SRV_DISABLE_IPV6:-true}"
DISABLE_ICMP="${SRV_DISABLE_ICMP:-false}"
VERIFY_GATE="false"

PUBKEY="ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGY8TEByHoDFNsy18VG6BJALc8HUYeoKZz2PeKMyKMND atlas@core"

while [[ $# -gt 0 ]]; do
    case "$1" in
        --verify|--test|-v)
            VERIFY_GATE="true"
            shift
            ;;
        --port)
            PORT="$2"
            shift 2
            ;;
        --user)
            USER_NAME="$2"
            shift 2
            ;;
        --tcp)
            TCP_PORTS="$2"
            shift 2
            ;;
        --udp)
            UDP_PORTS="$2"
            shift 2
            ;;
        --disable-icmp)
            DISABLE_ICMP="true"
            shift
            ;;
        --enable-icmp)
            DISABLE_ICMP="false"
            shift
            ;;
        --disable-ipv6)
            DISABLE_IPV6="true"
            shift
            ;;
        --enable-ipv6)
            DISABLE_IPV6="false"
            shift
            ;;
        --no-bbr)
            ENABLE_BBR="false"
            shift
            ;;
        --help|-h)
            echo "Использование: z init vps <IP> [ALIAS] [--verify] [--port N] [--user NAME] [--tcp 'PORTS'] [--udp 'PORTS'] [--disable-icmp] [--disable-ipv6] [--no-bbr]"
            exit 0
            ;;
        *)
            if [[ -z "${TARGET_IP}" ]]; then
                TARGET_IP="$1"
            elif [[ -z "${ALIAS}" ]]; then
                ALIAS="$1"
            fi
            shift
            ;;
    esac
done

if [[ -z "${TARGET_IP}" ]]; then
    log_err "IP-адрес целевого сервера обязателен. Введите 'z init vps --help'."
    exit 1
fi

if [[ -z "${ALIAS}" ]]; then
    LAST_OCTET="${TARGET_IP##*.}"
    ALIAS="n${LAST_OCTET}.srv"
fi

log_info "Инициализация ноды ${ALIAS} (${TARGET_IP}:${PORT})..."

ssh -o StrictHostKeyChecking=accept-new -p 22 "root@${TARGET_IP}" \
    "env BOOTSTRAP_USER='${USER_NAME}' \
         BOOTSTRAP_PORT='${PORT}' \
         BOOTSTRAP_PUBKEY='${PUBKEY}' \
         BOOTSTRAP_TCP_PORTS='${TCP_PORTS}' \
         BOOTSTRAP_UDP_PORTS='${UDP_PORTS}' \
         BOOTSTRAP_UFW_IN='${UFW_IN}' \
         BOOTSTRAP_UFW_OUT='${UFW_OUT}' \
         BOOTSTRAP_UFW_FWD='${UFW_FWD}' \
         BOOTSTRAP_UFW_APP='${UFW_APP}' \
         BOOTSTRAP_ENABLE_BBR='${ENABLE_BBR}' \
         BOOTSTRAP_DISABLE_IPV6='${DISABLE_IPV6}' \
         BOOTSTRAP_DISABLE_ICMP='${DISABLE_ICMP}' \
         bash -s" < "${ZARYA_DIR}/templates/vps-bootstrap.sh"

ssh_register_node "${ALIAS}" "${TARGET_IP}"

if [[ "${VERIFY_GATE}" == "true" ]]; then
    log_warn "Включен режим ручного подтверждения."
    echo "Откройте соседний терминал и выполните: ssh ${ALIAS}"
    read -r -p "Подключение успешно? [y/N]: " CONFIRM
    if [[ "${CONFIRM}" != "y" && "${CONFIRM}" != "Y" ]]; then
        log_err "Подтверждение отклонено оператором. Откат конфигурации..."
        ssh -o ConnectTimeout=10 -p "${PORT}" -i "${RAM_KEY}" "${USER_NAME}@${TARGET_IP}" "sudo ufw disable && sudo sed -i -E 's/^Port .*/Port 22/' /etc/ssh/sshd_config && sudo systemctl restart ssh.service" || true
        log_warn "Откат завершен: порт 22 возвращен, UFW выключен."
        exit 1
    fi
fi

log_info "Автоматическая валидация ноды ${ALIAS}..."
ssh -o ConnectTimeout=5 "${ALIAS}" "hostname"
log_ok "Сервер ${ALIAS} успешно инициализирован и верифицирован."