#!/usr/bin/env bash
# Phase 4: Sync NPMplus configuration to secondary (certificates + optional API export)
# Primary config is source of truth; secondary receives certs and can import config if needed.

set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
source "${PROJECT_ROOT}/config/ip-addresses.conf" 2>/dev/null || true

if [ -f "$PROJECT_ROOT/.env" ]; then
    set +euo pipefail
    source "$PROJECT_ROOT/.env" 2>/dev/null || true
    set -euo pipefail
fi

PRIMARY_HOST="${PRIMARY_HOST:-192.168.11.11}"
SECONDARY_HOST="${SECONDARY_HOST:-192.168.11.12}"
PRIMARY_VMID="${PRIMARY_VMID:-10233}"
SECONDARY_VMID="${SECONDARY_VMID:-10234}"

GREEN='\033[0;32m'
BLUE='\033[0;34m'
YELLOW='\033[1;33m'
NC='\033[0m'
log_info() { echo -e "${BLUE}[INFO]${NC} $1"; }
log_success() { echo -e "${GREEN}[✓]${NC} $1"; }
log_warn() { echo -e "${YELLOW}[⚠]${NC} $1"; }

log_info "Phase 4: Syncing configuration to secondary..."

# Cert sync (required for SSL on failover)
log_info "Running certificate sync..."
bash "$SCRIPT_DIR/sync-certificates.sh" || log_warn "Certificate sync had warnings (secondary may already have certs)"

# Optional: sync proxy config via API (requires NPM_PASSWORD in .env)
if [ -n "${NPM_PASSWORD:-}" ]; then
    log_info "Running config export/sync..."
    bash "$SCRIPT_DIR/sync-config.sh" 2>/dev/null || log_warn "Config sync skipped or failed (use import-secondary-config.sh if needed)"
else
    log_warn "NPM_PASSWORD not set; skipping API config sync. Use import-secondary-config.sh to copy config to secondary."
fi

log_success "Phase 4 complete: Configuration sync done"
exit 0