# Keep relay cloud-init immutable: hcloud treats user_data changes as replacement.
# This measured link MTU applies to every service, independent of legacy bootstrap.
locals {
  wireguard_link_mtu = 1392
}

moved {
  from = terraform_data.wireguard_relay_auto_mtu
  to   = terraform_data.wireguard_relay_mtu
}

moved {
  from = terraform_data.wireguard_klops_auto_mtu
  to   = terraform_data.wireguard_klops_mtu
}

resource "terraform_data" "wireguard_relay_mtu" {
  depends_on = [hcloud_server.this]

  triggers_replace = {
    relay_id           = hcloud_server.this.id
    mtu                = local.wireguard_link_mtu
    local_helper_hash  = filesha256("${path.root}/scripts/local/deploy-wireguard-mtu.sh")
    remote_helper_hash = filesha256("${path.root}/scripts/remote/apply-wireguard-mtu.sh")
    host               = "alpha"
    port               = var.ssh_port
  }

  provisioner "local-exec" {
    interpreter = ["/bin/bash", "-c"]
    command     = "${abspath(path.root)}/scripts/local/deploy-wireguard-mtu.sh alpha ${var.ssh_port} ${local.wireguard_link_mtu}"
  }
}

resource "terraform_data" "wireguard_klops_mtu" {
  triggers_replace = {
    config_path        = module.klops.klops_wg_config_path
    mtu                = local.wireguard_link_mtu
    template_hash      = filesha256("${path.root}/modules/klops/templates/wg0.conf.tftpl")
    local_helper_hash  = filesha256("${path.root}/scripts/local/deploy-wireguard-mtu.sh")
    remote_helper_hash = filesha256("${path.root}/scripts/remote/apply-wireguard-mtu.sh")
    host               = var.klops_ssh_host
    port               = var.klops_ssh_port
  }

  provisioner "local-exec" {
    interpreter = ["/bin/bash", "-c"]
    command     = "${abspath(path.root)}/scripts/local/deploy-wireguard-mtu.sh ${var.klops_ssh_host} ${var.klops_ssh_port} ${local.wireguard_link_mtu}"
  }
}

resource "terraform_data" "wireguard_relay_mss" {
  depends_on = [terraform_data.wireguard_relay_mtu, terraform_data.wireguard_klops_mtu]

  triggers_replace = {
    relay_id           = hcloud_server.this.id
    mtu                = local.wireguard_link_mtu
    remote_helper_hash = filesha256("${path.root}/scripts/remote/apply-wireguard-mss.sh")
    port               = var.ssh_port
  }

  provisioner "local-exec" {
    interpreter = ["/bin/bash", "-c"]
    command     = "ssh -oBatchMode=yes -p ${var.ssh_port} root@alpha 'bash -s -- ${local.wireguard_link_mtu}' < '${abspath(path.root)}/scripts/remote/apply-wireguard-mss.sh'"
  }
}