#!/usr/bin/env bash
set -euo pipefail

repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
cd "${repo_root}"

relay_v4="$(just tofu output server_public_ip_v4)"
relay_v6="$(just tofu output server_public_ip_v6)"
wg_peer_v6="$(just tofu output wireguard_peer_ipv6)"
domains="${IPV6_DOMAINS:-home vault fin tracks media docs genie ci pkg registry vcs site}"

echo "alpha: IPv6 address/routes/nft/WireGuard"
ssh alpha bash -s -- "${wg_peer_v6}" <<'REMOTE'
set -euo pipefail
wg_peer_v6="$1"
ip -6 addr show dev eth0
ip -6 route show
sudo nft -nn list ruleset | grep -E "table ip6 nat|dnat to ${wg_peer_v6}|tcp dport \\{ 80, 443 \\}"
sudo wg show wg0 allowed-ips
REMOTE

echo "klops: WireGuard IPv6 address/routes/rules"
ssh klops bash -s -- "${wg_peer_v6}" <<'REMOTE'
set -euo pipefail
wg_peer_v6="$1"
ip -6 addr show dev wg0
ip -6 route show table 51820
ip -6 rule show | grep -F "${wg_peer_v6}"
REMOTE

echo "alpha -> klops over WireGuard IPv6"
ssh alpha bash -s -- "${wg_peer_v6}" <<'REMOTE'
set -euo pipefail
wg_peer_v6="$1"
ping -6 -c 3 "${wg_peer_v6}"
ping -6 -M do -s 1232 -c 3 "${wg_peer_v6}"
curl -6 -kI --connect-timeout 5 --max-time 10 --resolve "home.bugabinga.net:443:[${wg_peer_v6}]" https://home.bugabinga.net
REMOTE

echo "external IPv4 regression"
curl -4 -kI --connect-timeout 5 --max-time 10 --resolve "home.bugabinga.net:443:${relay_v4}" https://home.bugabinga.net

echo "external IPv6 direct relay probes"
for domain in ${domains}; do
  code="$(curl -6 -kI -sS -o /dev/null -w '%{http_code}' --connect-timeout 5 --max-time 10 --resolve "${domain}.bugabinga.net:443:[${relay_v6}]" "https://${domain}.bugabinga.net")"
  if [[ "${code}" == "000" ]]; then
    echo "${domain}.bugabinga.net IPv6 failed"
    exit 1
  fi
  echo "${domain}.bugabinga.net IPv6 HTTP ${code}"
done

echo "external IPv6 HTTP-01 path"
curl -6 -I --connect-timeout 5 --max-time 10 --resolve "home.bugabinga.net:80:[${relay_v6}]" http://home.bugabinga.net

echo "public DNS AAAA IPv6 probes"
for domain in ${domains}; do
  dig +short AAAA "${domain}.bugabinga.net" | grep -F "${relay_v6}"
  code="$(curl -6 -kI -sS -o /dev/null -w '%{http_code}' --connect-timeout 5 --max-time 10 "https://${domain}.bugabinga.net")"
  if [[ "${code}" == "000" ]]; then
    echo "${domain}.bugabinga.net public IPv6 failed"
    exit 1
  fi
  echo "${domain}.bugabinga.net IPv6 HTTP ${code}"
done