#!/usr/bin/env bash
# Patch existing bench wg0.conf for L2/gretap (Table=off, no /32 Address).
# Idempotent. Run on each Pi after keys are installed:
#   sudo bash fix_wg_l2_conf.sh

set -euo pipefail

CONF="${1:-/etc/wireguard/wg0.conf}"

if [[ "${EUID}" -ne 0 ]]; then
  echo "Run with sudo" >&2
  exit 1
fi

if [[ ! -f "${CONF}" ]]; then
  echo "FATAL: missing ${CONF}" >&2
  exit 1
fi

priv="$(awk -F' = ' '/^PrivateKey/ {print $2}' "${CONF}")"
listen="$(awk -F' = ' '/^ListenPort/ {print $2}' "${CONF}")"
peer_pub="$(awk -F' = ' '/^PublicKey/ {print $2}' "${CONF}")"
endpoint="$(awk -F' = ' '/^Endpoint/ {print $2}' "${CONF}")"

listen="${listen:-51820}"

cat > "${CONF}" <<EOF
# POG-EDGE L2/gretap — patched $(date -u +%Y-%m-%dT%H:%MZ)
[Interface]
PrivateKey = ${priv}
ListenPort = ${listen}
Table = off

[Peer]
PublicKey = ${peer_pub}
AllowedIPs = 0.0.0.0/0
Endpoint = ${endpoint}
PersistentKeepalive = ${EDGE_WG_KEEPALIVE_S:-5}
EOF
chmod 600 "${CONF}"
echo "Patched ${CONF} (Table=off, AllowedIPs=0.0.0.0/0, no Address)"