#!/usr/bin/env bash

#

set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

PROJECT_DIR="$(dirname "$SCRIPT_DIR")"

APPLY=false

VERIFY=false

TARGET="all"

usage() {

    cat << EOF

Default mode is dry-run. Use --apply to change remote resolvers.

Examples:

  $0

  $0 --apply --verify

  $0 --target as01 --apply

}

log() {

    printf '[INFO] %s\n' "$*"

}

die() {

    printf '[ERROR] %s\n' "$*" >&2

    exit 1

}

while [[ $# -gt 0 ]]; do

    case "$1" in

        --apply) APPLY=true; shift ;;

        --verify) VERIFY=true; shift ;;

        --target) TARGET="${2:-}"; shift 2 ;;

        *) die "Unknown option: $1" ;;

    esac

done

case "$TARGET" in

esac

    jumper|local) ;;

    *) die "Invalid source: $SOURCE" ;;

esac

    log "Target is-vpn-gw is deprecated; use jumper"

    TARGET="jumper"

fi

trap 'rm -rf "$WORK_DIR"' EXIT

CLOAK_ROWS="$WORK_DIR/cloak.rows"

NAMES_FILE="$WORK_DIR/names.txt"

MIKROTIK_RSC="$WORK_DIR/as01.rsc"

VERIFY_ROWS="$WORK_DIR/verify.rows"

quote_ros() {

    printf '%s' "$1" | sed 's/\\/\\\\/g; s/"/\\"/g'

}

    printf '=%s' "$1"

}

    host_name="$(hostname -f 2>/dev/null || hostname 2>/dev/null || true)"

    [[ "$host_name" == "jumper.madagascar.xdev.ro" ]] && return 0

    ip addr show 2>/dev/null | grep -q '192\.168\.2\.100' && return 0

    return 1

}

    else

}

    case "$SOURCE" in

        local)

            perl "$HOST_MANAGER" --print-local-hosts-tsv

            ;;

        jumper)

            if is_local_jumper; then

                perl "$HOST_MANAGER" --print-local-hosts-tsv

            else

                ssh "$JUMPER_HOST" "perl /usr/local/xdev-host-manager/scripts/host_manager.pl --print-local-hosts-tsv"

            fi

            ;;

    esac > "$MANIFEST_FILE"

}

fetch_manifest

    [[ -z "${line//[[:space:]]/}" ]] && continue

    [[ "$line" =~ ^[[:space:]]*# ]] && continue

    IFS=$'\t' read -r col1 col2 col3 _ <<< "$line"

    if [[ "$record_type" == "CNAME" ]]; then

        name="${col2:-}"

        target="${col3:-}"

        [[ -n "$name" && -n "$target" ]] || die "Invalid CNAME row: $line"

        printf '%s\n' "$name" >> "$NAMES_FILE"

            printf '%s %s\n' "$name" "$target" >> "$CNAME_VERIFY_ROWS"

        fi

        ros_name="$(quote_ros "$name")"

        ros_target="$(quote_ros "$target")"

        {

            printf '/ip dns static remove [find name="%s"]\n' "$ros_name"

            printf '/ip dns static add name="%s" type=CNAME cname="%s" comment="xdev-local managed"\n' "$ros_name" "$ros_target"

        } >> "$MIKROTIK_RSC"

        continue

    fi

        ip="$col2"

        names="$col3"

    else

        ip="$col1"

        names="$col2"

    fi

    [[ -n "${ip:-}" && -n "${names:-}" ]] || die "Invalid row: $line"

    for name in $names; do

        printf '%s\n' "$name" >> "$NAMES_FILE"

        ros_name="$(quote_ros "$name")"

            printf '/ip dns static remove [find name="%s"]\n' "$ros_name"

            printf '/ip dns static add name="%s" type=A address=%s comment="xdev-local managed"\n' "$ros_name" "$ros_ip"

        } >> "$MIKROTIK_RSC"

    done

sort -u "$NAMES_FILE" -o "$NAMES_FILE"

printf '/ip dns cache flush\n' >> "$MIKROTIK_RSC"

printf ':put "xdev local dns sync complete"\n' >> "$MIKROTIK_RSC"

        return

    fi

        cp "$HOSTS_ROWS" "$CLOAK_ROWS" "$NAMES_FILE" "$remote_dir/"

    else

        scp "$HOSTS_ROWS" "$CLOAK_ROWS" "$NAMES_FILE" "$JUMPER_HOST:$remote_dir/" >/dev/null

stamp="$(date +%Y%m%d_%H%M%S)"

cp /etc/hosts "/etc/hosts.bak.$stamp"

cp /etc/dnscrypt-proxy/cloaking-rules.txt "/etc/dnscrypt-proxy/cloaking-rules.txt.bak.$stamp"

awk '

    /^# END XDEV LOCAL DNS MANAGED BLOCK/ { in_managed = 0; next }

    in_managed { next }

    /^[[:space:]]*#/ || /^[[:space:]]*$/ { print; next }

    {

        keep = 1

        for (i = 2; i <= NF; i++) {

            if ($i in names) keep = 0

        }

        if (keep) print

    }

' "$REMOTE_DIR/names.txt" /etc/hosts > "$REMOTE_DIR/hosts.new"

{

    cat "$REMOTE_DIR/hosts.new"

    printf "\n# BEGIN XDEV LOCAL DNS MANAGED BLOCK\n"

    cat "$REMOTE_DIR/hosts.rows"

    printf "# END XDEV LOCAL DNS MANAGED BLOCK\n"

} > /etc/hosts

awk '

    NR == FNR { names[$1] = 1; next }

    /^# BEGIN XDEV LOCAL DNS MANAGED BLOCK/ { in_managed = 1; next }

    /^# END XDEV LOCAL DNS MANAGED BLOCK/ { in_managed = 0; next }

    in_managed { next }

    /^[[:space:]]*#/ || /^[[:space:]]*$/ { print; next }

    {

        if (!($1 in names)) print

    }

' "$REMOTE_DIR/names.txt" /etc/dnscrypt-proxy/cloaking-rules.txt > "$REMOTE_DIR/cloak.new"

{

    cat "$REMOTE_DIR/cloak.new"

    printf "\n# BEGIN XDEV LOCAL DNS MANAGED BLOCK\n"

    cat "$REMOTE_DIR/cloak.rows"

    printf "# END XDEV LOCAL DNS MANAGED BLOCK\n"

} > /etc/dnscrypt-proxy/cloaking-rules.txt

resolved_backup=""

if ! grep -Eq '^ReadEtcHosts=no$' /etc/systemd/resolved.conf; then

    cp /etc/systemd/resolved.conf "/etc/systemd/resolved.conf.bak.$stamp"

    resolved_backup=" /etc/systemd/resolved.conf.bak.$stamp"

    if grep -Eq '^ReadEtcHosts=' /etc/systemd/resolved.conf; then

        sed -i 's/^ReadEtcHosts=.*/ReadEtcHosts=no/' /etc/systemd/resolved.conf

    else

        printf "\nReadEtcHosts=no\n" >> /etc/systemd/resolved.conf

    fi

fi

if grep -Eq '^DNSStubListenerExtra=' /etc/systemd/resolved.conf; then

    if [[ -z "$resolved_backup" ]]; then

        cp /etc/systemd/resolved.conf "/etc/systemd/resolved.conf.bak.$stamp"

        resolved_backup=" /etc/systemd/resolved.conf.bak.$stamp"

    fi

    sed -i 's/^DNSStubListenerExtra=/#DNSStubListenerExtra=/' /etc/systemd/resolved.conf

fi

dnscrypt_resolved_conf="/etc/systemd/resolved.conf.d/20-dnscrypt.conf"

mkdir -p /etc/systemd/resolved.conf.d

if [[ ! -f "$dnscrypt_resolved_conf" ]] || ! grep -Eq '^DNS=127\.0\.0\.1:5300$' "$dnscrypt_resolved_conf"; then

    if [[ -f "$dnscrypt_resolved_conf" ]]; then

        cp "$dnscrypt_resolved_conf" "$dnscrypt_resolved_conf.bak.$stamp"

        resolved_backup="$resolved_backup $dnscrypt_resolved_conf.bak.$stamp"

    fi

    cat > "$dnscrypt_resolved_conf" <<'EOF'

[Resolve]

# Send LAN DNS traffic through dnscrypt-proxy so cloaking-rules are authoritative locally.

DNS=127.0.0.1:5300

FallbackDNS=

EOF

fi

dnscrypt_conf="/etc/dnscrypt-proxy/dnscrypt-proxy.toml"

expected_listen="listen_addresses = ['127.0.0.1:5300', '192.168.2.100:53']"

dnscrypt_backup=""

if ! grep -Fqx "$expected_listen" "$dnscrypt_conf"; then

    cp "$dnscrypt_conf" "$dnscrypt_conf.bak.$stamp"

    dnscrypt_backup=" $dnscrypt_conf.bak.$stamp"

    sed -i "s|^listen_addresses = .*|$expected_listen|" "$dnscrypt_conf"

fi

allowed_names_file="/etc/dnscrypt-proxy/allowed-names.txt"

if ! grep -Eq "^allowed_names_file = '/etc/dnscrypt-proxy/allowed-names.txt'$" "$dnscrypt_conf"; then

    if [[ -z "$dnscrypt_backup" ]]; then

        cp "$dnscrypt_conf" "$dnscrypt_conf.bak.$stamp"

        dnscrypt_backup=" $dnscrypt_conf.bak.$stamp"

    fi

    if grep -Eq '^[#[:space:]]*allowed_names_file =' "$dnscrypt_conf"; then

        sed -i "s|^[#[:space:]]*allowed_names_file = .*|allowed_names_file = '/etc/dnscrypt-proxy/allowed-names.txt'|" "$dnscrypt_conf"

    else

        sed -i "/^\\[allowed_names\\]/a allowed_names_file = '/etc/dnscrypt-proxy/allowed-names.txt'" "$dnscrypt_conf"

    fi

fi

for allowed_name in google.com www.google.com; do

    grep -Fxq "$allowed_name" "$allowed_names_file" || printf "%s\n" "$allowed_name" >> "$allowed_names_file"

done

resolvectl flush-caches || true

systemctl restart systemd-resolved

systemctl restart dnscrypt-proxy

rm -rf "$REMOTE_DIR"

printf "backups: /etc/hosts.bak.%s /etc/dnscrypt-proxy/cloaking-rules.txt.bak.%s%s%s\n" "$stamp" "$stamp" "$resolved_backup" "$dnscrypt_backup"

REMOTE

}

sync_as01() {

    if ! $APPLY; then

        log "Dry-run for as01: generated RouterOS commands"

        sed -n '1,160p' "$MIKROTIK_RSC"

        return

    fi

    log "Syncing as01"

    ssh "$AS01" "/ip dns static remove [find comment=\"xdev-local managed\"]"$'\n'"$(cat "$MIKROTIK_RSC")"

}

verify_resolver() {

    local resolver="$1"

    local failures=0

    log "Verifying resolver $resolver"

    while read -r name expected_ip; do

        answers="$(dig @"$resolver" "$name" +short || true)"

        if ! grep -Fxq "$expected_ip" <<< "$answers"; then

            compact_answers="$(paste -s -d ',' - <<< "$answers")"

            printf '[FAIL] %s %s expected %s got %s\n' "$resolver" "$name" "$expected_ip" "${compact_answers:-<empty>}" >&2

            failures=$((failures + 1))

        fi

    done < "$VERIFY_ROWS"

        answers="$(dig @"$resolver" "$name" +short || true)"

        target_answers="$(dig @"$resolver" "$expected_target" +short || true)"

        expected_target_dot="${expected_target%.}."

        if ! grep -Fxq "$expected_target" <<< "$answers" \

            && ! grep -Fxq "$expected_target_dot" <<< "$answers" \

            && ! grep -Fxf <(printf '%s\n' "$target_answers") <<< "$answers" >/dev/null; then

            compact_answers="$(paste -s -d ',' - <<< "$answers")"

            compact_target_answers="$(paste -s -d ',' - <<< "$target_answers")"

            printf '[FAIL] %s %s expected CNAME %s or flattened %s got %s\n' "$resolver" "$name" "$expected_target" "${compact_target_answers:-<empty>}" "${compact_answers:-<empty>}" >&2

            failures=$((failures + 1))

        fi

    done < "$CNAME_VERIFY_ROWS"

    if [[ "$dns_status" != "NXDOMAIN" ]]; then

        printf '[FAIL] %s %s expected NXDOMAIN got %s\n' "$resolver" "$NEGATIVE_NAME" "${dns_status:-<empty>}" >&2

        failures=$((failures + 1))

    fi

    [[ "$failures" -eq 0 ]]

}

if $APPLY || ! $VERIFY; then

    case "$TARGET" in

        all)

            ;;

    esac

fi

if $VERIFY; then

    case "$TARGET" in

        all)

            verify_resolver 192.168.2.100

            verify_resolver 192.168.2.2

            ;;

    esac

fi