#!/usr/bin/env bash
# ============================================================
# BastionGuard Universal Setup Script
# - Configura loopback + DNS cross-distro
# - Aggiorna /etc/hosts (safe, non distruttivo)
# - Installa/abilita Nginx proxy per LocalWarningServer
#
# UPDATE (dnsmasq su 127.0.0.1:53 senza stravolgere nulla):
# - Se systemd-resolved è attivo:
#   * Imposta DNS=127.0.0.1 (upstream verso dnsmasq)
#   * Mantiene lo stub su 127.0.0.53:53 (NON lo disabilita)
#   * Assicura che /etc/resolv.conf punti allo stub (127.0.0.53),
#     così le app continuano ad usare resolved e resolved inoltra a dnsmasq.
# - Se NM/altro: fallback non distruttivo su resolv.conf append.
# ============================================================

set -euo pipefail
export XDG_RUNTIME_DIR="/run/user/0"
export DBUS_SESSION_BUS_ADDRESS="unix:path=/run/dbus/system_bus_socket"
PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH"

echo "🧠 [BastionGuard Setup] Avvio configurazione universale..."
DISTRO_ID=$(grep -E '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"')
DISTRO_LIKE=$(grep -E '^ID_LIKE=' /etc/os-release | cut -d= -f2 | tr -d '"' || true)

detect_netmgr() {
  if systemctl is-active --quiet NetworkManager 2>/dev/null; then
    echo "NetworkManager"
  elif systemctl is-active --quiet systemd-networkd 2>/dev/null; then
    echo "systemd-networkd"
  elif pgrep -x connmand >/dev/null 2>&1; then
    echo "connman"
  elif [ -d /etc/netplan ]; then
    echo "netplan"
  elif [ -f /etc/network/interfaces ]; then
    echo "ifupdown"
  else
    echo "unknown"
  fi
}

NETMGR=$(detect_netmgr)
echo "➡ Gestore rete rilevato: $NETMGR"

# ============================================================
# STEP 1: ensure loopback 127.0.0.1
# ============================================================
echo "🧱 [Step 1] Verifica loopback 127.0.0.1..."
if ! ip addr show dev lo | grep -q "127\.0\.0\.1"; then
  ip addr add 127.0.0.1/8 dev lo || true
  echo "✅ 127.0.0.1 aggiunto a loopback."
else
  echo "ℹ️ 127.0.0.1 già presente."
fi
ip link set lo up

# ============================================================
# STEP 2: DNS 127.0.0.1 (cross-distro, non distruttivo)
# - Obiettivo: far sì che il sistema risolva tramite dnsmasq (127.0.0.1:53)
# - Con systemd-resolved: resolved -> dnsmasq; app -> stub 127.0.0.53
# ============================================================
echo "🌐 [Step 2] Configurazione DNS locale (safe, non distruttiva)..."

dns_report() {
  echo "🔎 [DNS report]"
  echo "- /etc/resolv.conf -> $(readlink -f /etc/resolv.conf 2>/dev/null || echo /etc/resolv.conf)"
  echo "- nameserver attuali:"
  grep -E '^\s*nameserver\s+' /etc/resolv.conf 2>/dev/null || echo "  (nessuno trovato in /etc/resolv.conf)"
  if command -v resolvectl >/dev/null 2>&1; then
    echo "- resolvectl status (estratto):"
    resolvectl status 2>/dev/null | sed -n '1,120p' || true
  fi
  echo "- systemd-resolved: $(systemctl is-active systemd-resolved 2>/dev/null || echo unknown)"
  echo "- NetworkManager:   $(systemctl is-active NetworkManager 2>/dev/null || echo unknown)"
  echo "- connman:          $(pgrep -x connmand >/dev/null 2>&1 && echo active || echo inactive)"
}

append_nameserver_resolvconf() {
  local rc="/etc/resolv.conf"
  [ -e "$rc" ] || touch "$rc"

  if grep -Eq '^\s*nameserver\s+127\.0\.0\.1\s*$' "$rc"; then
    echo "ℹ️ nameserver 127.0.0.1 già presente in $rc"
  else
    echo "nameserver 127.0.0.1" >> "$rc"
    echo "✅ Aggiunto nameserver 127.0.0.1 in $rc"
  fi
}

# systemd-resolved: imposta upstream DNS=127.0.0.1 senza disabilitare lo stub
ensure_resolved_dns() {
  local conf="/etc/systemd/resolved.conf"
  [ -f "$conf" ] || touch "$conf"

  if ! grep -Eq '^\s*\[Resolve\]\s*$' "$conf"; then
    echo -e "\n[Resolve]" >> "$conf"
  fi

  # aggiunge 127.0.0.1 alla riga DNS=, o la crea in [Resolve]
  if grep -Eq '^\s*DNS=' "$conf"; then
    if grep -Eq '^\s*DNS=.*\b127\.0\.0\.1\b' "$conf"; then
      echo "ℹ️ systemd-resolved: DNS già include 127.0.0.1 in $conf"
    else
      sed -i -E '0,/^\s*DNS=/{s/^\s*DNS=(.*)$/DNS=\1 127.0.0.1/}' "$conf"
      echo "✅ systemd-resolved: aggiunto 127.0.0.1 alla riga DNS= in $conf"
    fi
  else
    sed -i -E '0,/^\s*\[Resolve\]\s*$/{s/^\s*\[Resolve\]\s*$/[Resolve]\nDNS=127.0.0.1/}' "$conf"
    echo "✅ systemd-resolved: aggiunto DNS=127.0.0.1 in $conf"
  fi

  systemctl restart systemd-resolved || true
}

# Assicura che /etc/resolv.conf punti allo stub di systemd-resolved (127.0.0.53)
ensure_resolvconf_stub() {
  local stub="/run/systemd/resolve/stub-resolv.conf"
  if [ -f "$stub" ]; then
    local cur
    cur="$(readlink -f /etc/resolv.conf 2>/dev/null || echo /etc/resolv.conf)"
    if [ "$cur" = "$stub" ]; then
      echo "ℹ️ /etc/resolv.conf già punta a stub-resolv.conf"
      return 0
    fi

    # se è symlink, la rimpiazzo. se è file normale, faccio backup e poi link.
    if [ -L /etc/resolv.conf ]; then
      ln -sf "$stub" /etc/resolv.conf
      echo "✅ /etc/resolv.conf -> $stub (symlink aggiornato)"
    else
      cp -a /etc/resolv.conf "/etc/resolv.conf.bak.$(date +%Y%m%d%H%M%S)" || true
      ln -sf "$stub" /etc/resolv.conf
      echo "✅ /etc/resolv.conf -> $stub (backup creato, symlink impostato)"
    fi
  else
    echo "⚠️ stub-resolv.conf non trovato ($stub). Lascio /etc/resolv.conf invariato."
  fi
}

dns_report

if systemctl is-active --quiet systemd-resolved 2>/dev/null; then
  echo "➡ systemd-resolved attivo: imposto upstream DNS=127.0.0.1 (dnsmasq) e mantengo stub 127.0.0.53."
  ensure_resolved_dns
  ensure_resolvconf_stub
elif systemctl is-active --quiet NetworkManager 2>/dev/null; then
  echo "➡ NetworkManager attivo: imposto dns 127.0.0.1 senza toccare resolv.conf."
  CONN=$(nmcli -t -f NAME,DEVICE connection show --active | head -n1 | cut -d: -f1 || true)
  if [ -n "${CONN:-}" ]; then
    CUR_DNS=$(nmcli -g ipv4.dns connection show "$CONN" 2>/dev/null | tr -d '\n' || true)
    if echo "$CUR_DNS" | grep -qw "127.0.0.1"; then
      echo "ℹ️ NM: 127.0.0.1 già presente per $CONN"
    else
      if [ -n "$CUR_DNS" ]; then
        nmcli connection modify "$CONN" ipv4.dns "$CUR_DNS,127.0.0.1"
      else
        nmcli connection modify "$CONN" ipv4.dns "127.0.0.1"
      fi
      nmcli connection up "$CONN" || true
      echo "✅ NM: aggiunto 127.0.0.1 ai DNS di $CONN"
    fi
  else
    echo "⚠️ Nessuna connessione NM attiva trovata; fallback resolv.conf (append)."
    append_nameserver_resolvconf
  fi
elif pgrep -x connmand >/dev/null 2>&1; then
  echo "➡ ConnMan attivo: fallback prudente su resolv.conf (append)."
  append_nameserver_resolvconf
else
  echo "➡ Nessun gestore DNS riconosciuto: fallback resolv.conf (append)."
  append_nameserver_resolvconf
fi

echo "🔎 [DNS post-check]"
dns_report

# ============================================================
# STEP 2.5: /etc/hosts (non distruttivo)
# Richieste:
#   - 127.0.0.2 localhost
#   - 127.0.0.1 bastionguard.local
#   - 127.0.0.2 warning.BastionGuard.local
# ============================================================
echo "🧾 [Step 2.5] Aggiornamento /etc/hosts (safe, non distruttivo)..."

ensure_hosts_entry() {
  local ip="$1"
  local name="$2"
  local hosts="/etc/hosts"

  [ -f "$hosts" ] || touch "$hosts"

  # Se il nome è già presente (anche su IP diverso), non duplico
  if grep -Eq "^[[:space:]]*[^#]*\b${name}\b" "$hosts"; then
    echo "ℹ️ /etc/hosts: '${name}' già presente, salto."
    return 0
  fi

  printf "%s\t%s\n" "$ip" "$name" >> "$hosts"
  echo "✅ Aggiunto: ${ip} ${name}"
}

ensure_hosts_entry "127.0.0.2" "localhost"
ensure_hosts_entry "127.0.0.1" "bastionguard.local"
ensure_hosts_entry "127.0.0.2" "warning.BastionGuard.local"

echo "🔎 [hosts check]"
tail -n 25 /etc/hosts || true

# ============================================================
# STEP 3: Install or enable nginx
# ============================================================
echo "🧩 [Step 3] Configurazione NGINX..."

install_nginx() {
  echo "🔍 Verifico Nginx..."
  if command -v nginx >/dev/null 2>&1; then
    echo "✅ Nginx già installato."
  else
    echo "⬇️ Installazione Nginx..."
    if [[ "$DISTRO_ID" == "arch" || "$DISTRO_LIKE" == *"arch"* ]]; then
      pacman -S --noconfirm nginx
    elif [[ "$DISTRO_ID" == "fedora" || "$DISTRO_LIKE" == *"rhel"* ]]; then
      dnf install -y nginx
    elif [[ "$DISTRO_ID" == "debian" || "$DISTRO_LIKE" == *"debian"* || "$DISTRO_LIKE" == *"ubuntu"* ]]; then
      apt update -y && apt install -y nginx
    elif [[ "$DISTRO_ID" == "opensuse"* ]]; then
      zypper install -y nginx
    else
      echo "⚠️ Distribuzione non riconosciuta, installa manualmente nginx."
    fi
  fi
}

install_nginx

if nginx -t; then
  systemctl enable --now nginx
  systemctl reload nginx
  echo "✅ Nginx configurato e attivo."
else
  echo "❌ Errore nella configurazione nginx."
  nginx -t || true
fi

# ============================================================
# STEP 4: Report
# ============================================================
echo
echo "📋 [Report finale]"
echo "Gestore rete: $NETMGR"
echo "Distribuzione: $DISTRO_ID ($DISTRO_LIKE)"
echo
echo "🔹 Loopback:"
ip addr show dev lo | grep 127 || true
echo
echo "🔹 DNS attuale:"
grep -E '^\s*nameserver\s+' /etc/resolv.conf || echo "(nessuno trovato)"
echo
echo "🔹 /etc/hosts (estratto):"
tail -n 25 /etc/hosts || true
echo
echo "🔹 Nginx listener:"
ss -ltnp | grep -E "127\.0\.0\.2:80|127\.0\.0\.2:443" || echo "(nessun listener trovato)"
echo
echo "🔹 Proxy test rapido:"
curl -s -o /dev/null -w "%{http_code}\n" http://127.0.0.1/ || true
echo
echo "✅ Setup completo BastionGuard (rete + dns + hosts + nginx)"

# ============================================================
# STEP 5: Riavvio servizi
# ============================================================
echo "🔄 [Step 5] Riavvio dei servizi di rete e proxy..."

if systemctl is-active --quiet NetworkManager 2>/dev/null; then
  echo "🔁 Riavvio NetworkManager..."
  systemctl restart NetworkManager || true
elif systemctl is-active --quiet systemd-networkd 2>/dev/null; then
  echo "🔁 Riavvio systemd-networkd..."
  systemctl restart systemd-networkd || true
fi

if systemctl is-active --quiet systemd-resolved 2>/dev/null; then
  echo "🔁 Riavvio systemd-resolved..."
  systemctl restart systemd-resolved || true
fi

if systemctl is-active --quiet nginx 2>/dev/null; then
  echo "🔁 Riavvio nginx..."
  systemctl reload nginx || systemctl restart nginx || true
fi

echo "✅ Tutti i servizi rilevanti sono stati riavviati."

# ============================================================
# NOTE OPERATIVE
# - Questo script NON installa/configura dnsmasq: lo fa il wizard.
# - Per usare dnsmasq su 127.0.0.1:53 con systemd-resolved attivo:
#   * le app -> 127.0.0.53 (stub)
#   * resolved -> 127.0.0.1 (dnsmasq)
# - Se dnsmasq non è attivo/porta 53 occupata, la risoluzione può fallire.
# ============================================================