#!/usr/bin/env bash
# Fix explorer.d-bis.org for mobile (Apple/Samsung) — Cloudflare DNS + NPMplus
# Ensures: (1) Cloudflare DNS A record 76.53.10.36, DNS only (2) NPMplus forwards to ${IP_BLOCKSCOUT:-${IP_DEVICE_14:-${IP_DEVICE_14:-${IP_DEVICE_14:-${IP_DEVICE_14:-${IP_DEVICE_14:-192.168.11.14}}}}}0}:80
# Run from project root; requires .env with CLOUDFLARE_* and NPM_PASSWORD for full fix.

set -euo pipefail

# Load IP configuration
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
PROJECT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
source "${PROJECT_ROOT}/config/ip-addresses.conf" 2>/dev/null || true


SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
PROJECT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
cd "$PROJECT_ROOT"

RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m'

log_info() { echo -e "${BLUE}[INFO]${NC} $1"; }
log_ok() { echo -e "${GREEN}[OK]${NC} $1"; }
log_warn() { echo -e "${YELLOW}[WARN]${NC} $1"; }
log_fail() { echo -e "${RED}[FAIL]${NC} $1"; }

PUBLIC_IP="${PUBLIC_IP:-76.53.10.36}"
EXPLORER_BACKEND="${IP_BLOCKSCOUT:-${IP_DEVICE_14:-${IP_DEVICE_14:-${IP_DEVICE_14:-${IP_DEVICE_14:-${IP_DEVICE_14:-192.168.11.14}}}}}0}:80"

if [ -f .env ]; then
  set +u
  # shellcheck source=/dev/null
  source .env 2>/dev/null || true
  set -u
fi

echo ""
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
echo "  Fix explorer.d-bis.org for mobile (Cloudflare + NPMplus)"
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
echo ""

# --- 1. Cloudflare DNS: explorer.d-bis.org → A 76.53.10.36, DNS only ---
log_info "Step 1: Cloudflare DNS (explorer.d-bis.org → $PUBLIC_IP, DNS only)"
if [ -n "${CLOUDFLARE_API_TOKEN:-}" ] || { [ -n "${CLOUDFLARE_EMAIL:-}" ] && [ -n "${CLOUDFLARE_API_KEY:-}" ]; }; then
  ZONE_D_BIS="${CLOUDFLARE_ZONE_ID_D_BIS_ORG:-${CLOUDFLARE_ZONE_ID:-}}"
  if [ -n "$ZONE_D_BIS" ]; then
    if ./scripts/update-all-dns-to-public-ip.sh 2>&1 | tee /tmp/dns-update.log; then
      log_ok "Cloudflare DNS update completed"
    else
      log_warn "DNS update had warnings (check /tmp/dns-update.log)"
    fi
  else
    log_warn "CLOUDFLARE_ZONE_ID_D_BIS_ORG or CLOUDFLARE_ZONE_ID not set; skipping DNS"
  fi
else
  log_warn "Cloudflare credentials not in .env; skipping DNS. Set CLOUDFLARE_API_TOKEN or CLOUDFLARE_EMAIL+CLOUDFLARE_API_KEY and CLOUDFLARE_ZONE_ID_D_BIS_ORG"
fi
echo ""

# --- 2. NPMplus: explorer.d-bis.org → http://${IP_BLOCKSCOUT}:80 ---
log_info "Step 2: NPMplus proxy host (explorer.d-bis.org → http://$EXPLORER_BACKEND)"
if [ -n "${NPM_PASSWORD:-}" ]; then
  if ./scripts/nginx-proxy-manager/update-npmplus-proxy-hosts-api.sh 2>&1 | tee /tmp/npm-update.log; then
    log_ok "NPMplus proxy hosts updated"
  else
    log_warn "NPM update had failures (check /tmp/npm-update.log)"
  fi
else
  log_warn "NPM_PASSWORD not set; skipping NPM. Add NPM_PASSWORD to .env and re-run, or fix in NPM UI: Hosts → explorer.d-bis.org → Forward to http://${IP_BLOCKSCOUT}:80"
fi
echo ""

# --- 3. Verify ---
log_info "Step 3: Verify DNS resolution"
DIG_IP=$(dig +short explorer.d-bis.org 2>/dev/null | head -1 || echo "")
if [ "$DIG_IP" = "$PUBLIC_IP" ] || [ "$DIG_IP" = "76.53.10.36" ]; then
  log_ok "explorer.d-bis.org resolves to $DIG_IP"
else
  log_warn "explorer.d-bis.org resolved to: $DIG_IP (expected $PUBLIC_IP). Wait for DNS propagation or check Cloudflare."
fi

log_info "Test from your machine: curl -sI https://explorer.d-bis.org/ | head -5"
echo ""
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
echo "  On mobile: try Wi‑Fi first; use Private DNS (dns.google) if on cellular"
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
echo ""