#!/usr/bin/env bash
set -euo pipefail
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
SKILL_ROOT="$(dirname "$SCRIPT_DIR")"
source "$SCRIPT_DIR/_common.sh"

: "${TUNNEL_NAME:=}"
: "${HOSTNAME:=}"
: "${LOCAL_SERVICE:=}"
: "${SERVICE_NAME:=cloudflared-tunnel}"
: "${CONFIG_DIR:=$SKILL_ROOT/outputs/config}"

main() {
  confirm_gate
  need systemctl

  [[ -n "$TUNNEL_NAME" ]] || die "TUNNEL_NAME is required."
  [[ -n "$HOSTNAME" ]] || die "HOSTNAME is required."
  [[ -n "$LOCAL_SERVICE" ]] || die "LOCAL_SERVICE is required."
  [[ -f "$CONFIG_DIR/tunnel.json" ]] || die "Missing tunnel snapshot: $CONFIG_DIR/tunnel.json"

  local tunnel_id; tunnel_id="$(jq -r '.id' "$CONFIG_DIR/tunnel.json")"
  [[ -n "$tunnel_id" && "$tunnel_id" != "null" ]] || die "Invalid tunnel id in tunnel.json"

  mkdir -p "$CONFIG_DIR"

  # Generate cloudflared config
  cat > "$CONFIG_DIR/config.yml" <<EOF
tunnel: $tunnel_id
credentials-file: $HOME/.cloudflared/$tunnel_id.json

ingress:
  - hostname: $HOSTNAME
    service: $LOCAL_SERVICE
  - service: http_status:404
EOF

  log_info "Wrote config: $CONFIG_DIR/config.yml"
  log_warn "NOTE: credentials-file expects: $HOME/.cloudflared/$tunnel_id.json"
  log_warn "If you created the tunnel on a different machine, copy that credentials file."

  # Create systemd unit
  local unit="/etc/systemd/system/$SERVICE_NAME.service"
  sudo cp -a "$unit" "$unit.bak.$(date -Iseconds | tr ':' '-')" 2>/dev/null || true

  sudo tee "$unit" >/dev/null <<EOF
[Unit]
Description=Cloudflare Tunnel ($TUNNEL_NAME)
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
Environment=HOME=$HOME
ExecStart=$(command -v cloudflared) tunnel --config $CONFIG_DIR/config.yml run
Restart=on-failure
RestartSec=3s

[Install]
WantedBy=multi-user.target
EOF

  sudo systemctl daemon-reload
  sudo systemctl enable "$SERVICE_NAME"
  sudo systemctl restart "$SERVICE_NAME"
  sudo systemctl --no-pager status "$SERVICE_NAME" | head -n 30 || true

  log_info "Service applied: $SERVICE_NAME"
  log_info "Next: ./scripts/90_verify.sh"
}

main "$@"