#!/usr/bin/env bash
# Tear down gretap + WireGuard.
#
#   sudo bash tunnel_down.sh

set -euo pipefail

if [[ "${EUID}" -ne 0 ]]; then
  echo "Run with sudo" >&2
  exit 1
fi

# shellcheck disable=SC1091
source "$(dirname "$0")/pog_edge_env.sh"

GRETAP="${GRETAP_IF:-gretap0}"
WG="${WG_IF:-wg0}"
CONF="${POG_EDGE_WG_CONF:-/etc/wireguard/wg0.conf}"
ACTIVE_GRETAP_FILE="${POG_EDGE_ROOT}/.active_gretap"
ACTIVE_SPOKE_FILE="${POG_EDGE_ROOT}/.active_spoke_gretaps"

if pgrep -f 'pog422_fixture_bridge' >/dev/null 2>&1; then
  echo "FATAL: stop fixture bridge before tunnel_down" >&2
  exit 1
fi

if [[ -f "${ACTIVE_GRETAP_FILE}" ]]; then
  GRETAP="$(tr -d '\r\n' < "${ACTIVE_GRETAP_FILE}")"
fi

# Tear down listed spoke gretaps first (hub), without touching unrelated interfaces.
if [[ -f "${ACTIVE_SPOKE_FILE}" ]]; then
  while IFS= read -r g; do
    g="$(echo "${g}" | tr -d '\r\n')"
    [[ -z "${g}" ]] && continue
    if ip link show "${g}" >/dev/null 2>&1; then
      ip link set "${g}" down 2>/dev/null || true
      ip link del "${g}" 2>/dev/null || true
    fi
  done < "${ACTIVE_SPOKE_FILE}"
  rm -f "${ACTIVE_SPOKE_FILE}"
fi

if ip link show "${GRETAP}" >/dev/null 2>&1; then
  ip link set "${GRETAP}" down 2>/dev/null || true
  ip link del "${GRETAP}" 2>/dev/null || true
fi
rm -f "${ACTIVE_GRETAP_FILE}"

LOCAL_OVERLAY="${POG_EDGE_OVERLAY_A}"
if [[ "${POG_EDGE_ROLE}" == "pos4" || "${POG_EDGE_ROLE}" == "spoke" ]]; then
  if [[ "${POG_EDGE_ROLE}" == "spoke" && -n "${EDGE_SPOKE_ID:-}" ]]; then
    LOCAL_OVERLAY="10.99.${EDGE_BANK}.${EDGE_SPOKE_ID}"
  else
    LOCAL_OVERLAY="${POG_EDGE_OVERLAY_B}"
  fi
fi
if [[ "${POG_EDGE_ROLE}" == "hub" ]]; then
  LOCAL_OVERLAY="10.99.${EDGE_BANK}.1"
fi
ip addr del "${LOCAL_OVERLAY}/32" dev "${WG}" 2>/dev/null || true

if ip link show "${WG}" >/dev/null 2>&1; then
  if [[ -f "${CONF}" ]] && command -v wg-quick >/dev/null 2>&1; then
    wg-quick down "${CONF}" 2>/dev/null || ip link del "${WG}" 2>/dev/null || true
  else
    ip link del "${WG}" 2>/dev/null || true
  fi
fi

echo "Tunnel down."