#!/usr/bin/env bash
# Generate a matched WireGuard key pair + wg0.conf for office (peer A) and pos4 (peer B).
# Lab/bench only — output goes to pog-edge/keys/bench-office-pos4/ (gitignored).
#
#   ./gen_bench_wg_bundle.sh
#   ./gen_bench_wg_bundle.sh --out-dir /path/to/keys
#
# Copy each Pi's wg0.conf to /etc/wireguard/wg0.conf (chmod 600) or set POG_EDGE_WG_DIR.

set -euo pipefail

ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
OUT_DIR="${ROOT}/keys/bench-office-pos4"
WG_PORT=51820
OVERLAY_A=10.99.0.1
OVERLAY_B=10.99.0.2
LAN_OFFICE=10.1.10.141
LAN_POS4=10.1.10.40

while [[ $# -gt 0 ]]; do
  case "$1" in
    --out-dir) OUT_DIR="$2"; shift 2 ;;
    --lan-office) LAN_OFFICE="$2"; shift 2 ;;
    --lan-pos4) LAN_POS4="$2"; shift 2 ;;
    -h|--help)
      sed -n '2,12p' "$0"
      exit 0
      ;;
    *) echo "Unknown arg: $1" >&2; exit 1 ;;
  esac
done

if ! command -v wg >/dev/null 2>&1; then
  echo "FATAL: wireguard-tools (wg) not installed" >&2
  exit 1
fi

mkdir -p "${OUT_DIR}"
chmod 700 "${OUT_DIR}"

OFFICE_PRIV="$(wg genkey)"
OFFICE_PUB="$(printf '%s' "${OFFICE_PRIV}" | wg pubkey)"
POS4_PRIV="$(wg genkey)"
POS4_PUB="$(printf '%s' "${POS4_PRIV}" | wg pubkey)"

write_conf() {
  local path="$1"
  local priv="$2"
  local peer_pub="$3"
  local local_overlay="$4"
  local peer_overlay="$5"
  local endpoint="$6"
  local listen="$7"

  cat > "${path}" <<EOF
# POG-EDGE bench pair — lab only. Generated $(date -u +%Y-%m-%dT%H:%MZ).
# L2/gretap: no Address on wg0; Table=off avoids wg-quick /32 route errors.
[Interface]
PrivateKey = ${priv}
ListenPort = ${listen}
Table = off

[Peer]
PublicKey = ${peer_pub}
AllowedIPs = 0.0.0.0/0
Endpoint = ${endpoint}:${WG_PORT}
PersistentKeepalive = ${EDGE_WG_KEEPALIVE_S:-5}
EOF
  chmod 600 "${path}"
}

write_conf "${OUT_DIR}/wg0.conf.office" "${OFFICE_PRIV}" "${POS4_PUB}" \
  "${OVERLAY_A}" "${OVERLAY_B}" "${LAN_POS4}" "${WG_PORT}"
write_conf "${OUT_DIR}/wg0.conf.pos4" "${POS4_PRIV}" "${OFFICE_PUB}" \
  "${OVERLAY_B}" "${OVERLAY_A}" "${LAN_OFFICE}" "${WG_PORT}"

cat > "${OUT_DIR}/README.txt" <<EOF
POG-EDGE bench keys — lab only
Generated: $(date -u)

Office Pi (Master):
  sudo install -m 600 wg0.conf.office /etc/wireguard/wg0.conf

Pos 4 Pi (Slave):
  sudo install -m 600 wg0.conf.pos4 /etc/wireguard/wg0.conf

Public keys (support / verify):
  office: ${OFFICE_PUB}
  pos4:   ${POS4_PUB}

Endpoints: ${LAN_OFFICE} <-> ${LAN_POS4} UDP ${WG_PORT}
Overlay:   ${OVERLAY_A} <-> ${OVERLAY_B}
EOF

echo "Wrote ${OUT_DIR}/"
echo "  wg0.conf.office  -> install on office Pi"
echo "  wg0.conf.pos4    -> install on pos4 Pi"
echo "  README.txt"