#!/bin/bash
# =============================================================================
# set_network.sh — sensor node wired static IP setup (for on-site console after hardening)
#
# Background: after harden_pi.sh runs, SSH and console auto-login are disabled. So this
#   script assumes you run it "after logging in as pi at the on-site physical console
#   (monitor + keyboard)".
#   The default network manager on Raspberry Pi OS Bookworm is NetworkManager (nmcli).
#
# Relationship to the hardening firewall: nftables drops inbound only; outbound is accept +
#   established/related allowed. Even after switching to a static IP, the server POST
#   (outbound) still goes out and no inbound rule needs to be added. This script does not
#   touch the firewall.
#
# Air-gapped: no network use. Performs local nmcli configuration only.
#
# Usage:
#   Interactive:    sudo bash set_network.sh
#   Non-interactive: sudo bash set_network.sh --ip 192.168.0.50/24 --gw 192.168.0.1 \
#                    --dns "8.8.8.8 1.1.1.1" --yes
#   Show current:   sudo bash set_network.sh --show
#   Revert to DHCP: sudo bash set_network.sh --dhcp --yes
#
# Options:
#   --ip A.B.C.D/PREFIX   static IP + subnet (CIDR). e.g. 192.168.0.50/24 (=255.255.255.0)
#   --gw A.B.C.D          gateway
#   --dns "A.B.C.D ..."   DNS (space-separated, multiple allowed). Required if the server is a domain.
#   --iface NAME          interface (default: auto-detect, usually eth0)
#   --con NAME            NM connection name (default: auto-detect wired connection)
#   --dhcp                release manual IP -> revert to automatic (DHCP)
#   --show                print current settings only and exit
#   --yes | -y            skip the confirmation prompt (non-interactive)
#
# Subnet = CIDR suffix:  /24=255.255.255.0  /16=255.255.0.0  /25=255.255.255.128
# =============================================================================
set -euo pipefail

die(){ echo "[ERROR] $*" >&2; exit 1; }

[ "$(id -u)" -eq 0 ] || die "Run with sudo: sudo bash set_network.sh"
# Move cwd to the script folder so it can find test_connection.py etc.
cd "$(dirname "$0")" 2>/dev/null || true

command -v nmcli >/dev/null 2>&1 || die \
  "nmcli(NetworkManager) not found. If this is not the Bookworm default, check your network manager (dhcpcd/systemd-networkd)."

# ---- argument parsing ------------------------------------------------------
IPCIDR="" GW="" DNS="" IFACE="" CON="" ASSUME_YES=0 MODE="static"
while [ $# -gt 0 ]; do
  case "$1" in
    --ip)    IPCIDR="${2:-}"; shift 2;;
    --gw)    GW="${2:-}";     shift 2;;
    --dns)   DNS="${2:-}";    shift 2;;
    --iface) IFACE="${2:-}";  shift 2;;
    --con)   CON="${2:-}";    shift 2;;
    --dhcp)  MODE="dhcp";     shift;;
    --show)  MODE="show";     shift;;
    --yes|-y) ASSUME_YES=1;   shift;;
    -h|--help) sed -n '2,40p' "$0"; exit 0;;
    *) die "Unknown option: $1  (help: --help)";;
  esac
done

# ---- validation helpers ----------------------------------------------------
valid_ipv4(){
  local ip="$1" o
  [[ "$ip" =~ ^([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})$ ]] || return 1
  for o in "${BASH_REMATCH[@]:1:4}"; do [ "$o" -le 255 ] || return 1; done
  return 0
}
valid_cidr(){
  [[ "$1" == */* ]] || return 1
  local ip="${1%/*}" pfx="${1#*/}"
  valid_ipv4 "$ip" || return 1
  [[ "$pfx" =~ ^[0-9]+$ ]] && [ "$pfx" -ge 0 ] && [ "$pfx" -le 32 ]
}
ip2int(){ local a b c d; IFS=. read -r a b c d <<<"$1"; echo $(( (a<<24)|(b<<16)|(c<<8)|d )); }
same_subnet(){  # $1=ip $2=gw $3=prefix — whether the gateway is on the same subnet as the IP
  local m=$(( (0xFFFFFFFF << (32-$3)) & 0xFFFFFFFF ))
  [ $(( $(ip2int "$1") & m )) -eq $(( $(ip2int "$2") & m )) ]
}

# ---- auto-detect wired connection/interface --------------------------------
if [ -z "$IFACE" ]; then
  IFACE="$(nmcli -t -f DEVICE,TYPE dev status 2>/dev/null | awk -F: '$2=="ethernet"{print $1; exit}')"
  IFACE="${IFACE:-eth0}"
fi
if [ -z "$CON" ]; then
  # Prefer the active connection bound to this interface -> else the first wired connection -> finally the default name.
  CON="$(nmcli -t -f NAME,DEVICE con show --active 2>/dev/null | awk -F: -v d="$IFACE" '$2==d{print $1; exit}')"
  [ -n "$CON" ] || CON="$(nmcli -t -f NAME,TYPE con show 2>/dev/null | awk -F: '$2=="802-3-ethernet"{print $1; exit}')"
  [ -n "$CON" ] || CON="Wired connection 1"
fi

show_current(){
  echo "== Interface: $IFACE / Connection: $CON =="
  nmcli -f ipv4.method,ipv4.addresses,ipv4.gateway,ipv4.dns con show "$CON" 2>/dev/null \
    || echo "  (connection '$CON' not found)"
  echo "-- Actual IP:"; ip -4 addr show "$IFACE" 2>/dev/null | awk '/inet /{print "  "$2}' || true
  echo "-- Routing:";  ip route 2>/dev/null | sed 's/^/  /' || true
}

# ---- --show : print current state only -------------------------------------
if [ "$MODE" = show ]; then show_current; exit 0; fi

# ---- --dhcp : revert to automatic ------------------------------------------
if [ "$MODE" = dhcp ]; then
  echo "Connection '$CON' -> revert to automatic (DHCP)."
  [ "$ASSUME_YES" = 1 ] || { read -r -p "Proceed? [y/N] " a; [[ "$a" =~ ^[Yy]$ ]] || die "Cancelled"; }
  nmcli con mod "$CON" ipv4.method auto ipv4.addresses "" ipv4.gateway "" ipv4.dns "" ipv4.ignore-auto-dns no
  nmcli con down "$CON" >/dev/null 2>&1 || true
  nmcli con up "$CON" || die "Activation failed — check physical link/switch."
  echo "── Result ──"; show_current
  exit 0
fi

# ---- static : interactive prompts (only when values are missing and on a TTY) ---
if [ -t 0 ]; then
  [ -n "$IPCIDR" ] || read -r -p "Static IP/subnet (e.g. 192.168.0.50/24): " IPCIDR
  [ -n "$GW" ]     || read -r -p "Gateway (e.g. 192.168.0.1): " GW
  [ -n "$DNS" ]    || read -r -p "DNS (space-separated, e.g. '8.8.8.8 1.1.1.1', press Enter for none): " DNS
fi

# ---- value validation ------------------------------------------------------
valid_cidr "$IPCIDR" || die "Invalid IP/subnet format: '$IPCIDR' (e.g. 192.168.0.50/24)"
valid_ipv4 "$GW"     || die "Invalid gateway format: '$GW'"
IPADDR="${IPCIDR%/*}"; PREFIX="${IPCIDR#*/}"
same_subnet "$IPADDR" "$GW" "$PREFIX" \
  || die "Gateway $GW is outside the $IPCIDR subnet. Check the IP/subnet/gateway values."
for d in $DNS; do valid_ipv4 "$d" || die "Invalid DNS format: '$d'"; done
[ -n "$DNS" ] || echo "[WARN] No DNS specified — name resolution will fail if the server address is a domain. Fine if the server is an IP."

# ---- summary + confirmation ------------------------------------------------
echo "───────────── To be applied ─────────────"
echo "  Interface  : $IFACE"
echo "  Connection : $CON"
echo "  IP/subnet  : $IPCIDR"
echo "  Gateway    : $GW"
echo "  DNS        : ${DNS:-(none)}"
echo "─────────────────────────────────────"
[ "$ASSUME_YES" = 1 ] || { read -r -p "Apply? [y/N] " a; [[ "$a" =~ ^[Yy]$ ]] || die "Cancelled"; }

# ---- back up previous settings (for recovery) ------------------------------
BK="/root/net_backup_$(date +%Y%m%d_%H%M%S).txt"
{ echo "# '$CON' previous settings (recovery reference — $(date))"; nmcli con show "$CON" 2>/dev/null | grep -E '^ipv4\.'; } \
  > "$BK" 2>/dev/null || true
echo "[INFO] Previous settings backed up: $BK"

# ---- apply -----------------------------------------------------------------
echo "[APPLY] Setting static IP via nmcli..."
nmcli con mod "$CON" \
  ipv4.method manual \
  ipv4.addresses "$IPCIDR" \
  ipv4.gateway "$GW" \
  ipv4.dns "$DNS" \
  ipv4.ignore-auto-dns yes
# Re-apply (ignore down failure — may be before the first activation)
nmcli con down "$CON" >/dev/null 2>&1 || true
nmcli con up "$CON" \
  || die "Activation failed. Recovery: 'sudo bash set_network.sh --dhcp --yes' or see backup ($BK)."

# ---- verification ----------------------------------------------------------
echo ""
echo "───────────── Verification ─────────────"
echo "-- IP:";       ip -4 addr show "$IFACE" 2>/dev/null | awk '/inet /{print "  "$2}' || true
echo "-- Routing:";   ip route 2>/dev/null | sed 's/^/  /' || true
echo "-- Gateway ping:"
if ping -c2 -W2 "$GW" >/dev/null 2>&1; then echo "  OK ($GW reachable)"; else \
  echo "  [WARN] $GW not responding — check wiring/switch/gateway value"; fi

# Final server connectivity check (run test_connection.py if present)
for t in ./test_connection.py "$HOME/raspberry_pi4/test_connection.py" "$HOME/raspberry_pi4_sht30/test_connection.py"; do
  if [ -f "$t" ]; then
    echo "-- Server connectivity test: $t"
    ( cd "$(dirname "$t")" && python3 "$(basename "$t")" ) \
      || echo "  [WARN] Server test failed — check DNS/gateway/server address"
    break
  fi
done

echo ""
echo "Done. If there are problems, recover: see backup ($BK) or run  sudo bash set_network.sh --dhcp --yes  (revert to DHCP)."
echo "Check settings:  sudo bash set_network.sh --show"