#!/bin/bash
set -e

# The OFF-FLEET public resolver — the rig's stand-in for 1.1.1.1.
#
# It exists because the fleet's own resolver cannot answer the question the
# `public_dns` check asks. `system init` points celilo at comcast-resolver
# (the ISP's), and a deployed fleet at the internal split-horizon resolver;
# both answer with whatever is right for a client INSIDE. celilo refuses to use
# either as evidence about the public internet, so the simulation has to
# contain a second, genuinely independent public resolver — exactly the
# real-world distinction between your ISP's resolver and 1.1.1.1.
#
# Unlike comcast-resolver this sits ON internet-external (the public internet
# network) alongside the authoritative servers, so its stub-zones reach
# namecheap-dns on the same wire with no route needed.
#
# Replying to the CUSTOMER is a different matter, and getting this wrong is why
# the first run of the public_dns e2e stage saw nothing: a query from the
# fleet arrives with the customer's public source address, and the answer goes
# out via Docker's bridge gateway, which has no path across networks. The reply
# is dropped and the query times out — which celilo correctly records as
# *undetermined* rather than a pass, so the check went quiet instead of firing.
# Every host on internet-external exits by the ISP edge; this is that route.
# See config/routing/public-sim-entrypoint.sh, and the recurrence gate in
# src/public-sim-routes.test.ts that catches a simulator shipped without it.
ip route del default 2>/dev/null || true
ip route add default via 100.64.0.1 2>/dev/null || true

/usr/sbin/unbound -d &

echo "public-resolver ready on 100.64.0.64 - the rig's 1.1.1.1 (SIMULATOR_IPS.PUBLIC_RESOLVER)"
sleep infinity