#!/bin/bash
set -e

# CADDY_IP: IP of the caddy container in the DMZ (default 10.226.10.10).
# All test-domain queries resolve to this IP so management can reach
# caddy directly without hairpin NAT through the external interface.
CADDY_IP="${CADDY_IP:-10.226.10.10}"

# DOMAINS: comma-separated list of e2e test domains that should be
# split-horizon redirected to caddy. Default covers the canonical
# (iamtheinternet.org) plus the cross-domain test's second domain
# (example.net). Tests can override via DEFAULT_GATEWAY/DOMAINS env
# vars in docker-compose.
DOMAINS="${DOMAINS:-iamtheinternet.org,example.net}"

# Routing — reach comcast-resolver (203.0.113.1) via fw-main or fw-isp.
# DEFAULT_GATEWAY is set by docker-compose from the topology config.
GATEWAY="${DEFAULT_GATEWAY:-10.226.1.254}"
ip route del default 2>/dev/null || true
ip route add default via "$GATEWAY"

# Build per-domain split-horizon blocks.
# local-zone "redirect" returns the single A record for ALL names under
# the zone (including subdomains), so every hostname in the test domain
# reaches caddy which then reverse-proxies to the correct backend.
SPLIT_HORIZON_BLOCK=""
IFS=',' read -ra DOMAIN_LIST <<< "${DOMAINS}"
for d in "${DOMAIN_LIST[@]}"; do
    SPLIT_HORIZON_BLOCK="${SPLIT_HORIZON_BLOCK}    local-zone: \"${d}.\" redirect\n    local-data: \"${d}. IN A ${CADDY_IP}\"\n"
done

# Generate unbound config with split-horizon for each test domain plus
# the standard simulator overrides (Pebble, registry).
cat > /etc/unbound/unbound.conf << EOF
server:
    interface: 0.0.0.0
    access-control: 0.0.0.0/0 allow
    cache-min-ttl: 0
    cache-max-ttl: 60
    verbosity: 1
    do-daemonize: no
    do-not-query-localhost: no

$(printf "${SPLIT_HORIZON_BLOCK}")
    # Mirror the public resolver's simulated endpoint overrides so that
    # management uses Pebble for ACME and the e2e registry for modules.
    local-data: "acme-v02.api.letsencrypt.org. IN A 100.64.0.100"
    local-data: "acme-staging-v02.api.letsencrypt.org. IN A 100.64.0.100"
    local-data: "e2e-registry.lab. IN A 100.64.0.56"
    # npm-compat registry simulator — serves @celilo/* tarballs to the
    # bun add -g step inside install.sh. See SIMULATOR_IPS.NPM_REGISTRY.
    local-data: "npm-registry.lab. IN A 100.64.0.59"
    # apt-repo simulator — serves the celilo + celilo-bootstrap .debs to the
    # apt install step in the bootstrap-apt test. See SIMULATOR_IPS.APT_REPO.
    # (No backticks in this heredoc — it is unquoted, so backticks execute.)
    local-data: "apt.celilo.lab. IN A 100.64.0.60"
    # MinIO S3 simulator — backup/restore target for the migration e2e.
    # See SIMULATOR_IPS.MINIO.
    local-data: "minio.lab. IN A 100.64.0.61"
    # IP echo simulator — the rig's api.ipify.org. celilo's public_dns check
    # asks it the one thing the fleet cannot ask itself: what address it is
    # currently reachable at. See SIMULATOR_IPS.IP_ECHO.
    # (Backtick-free on purpose — see the note above; this heredoc is unquoted.)
    local-data: "ip-echo.lab. IN A 100.64.0.65"
    # signal-cli daemon (real, unlinked) and its simulator counterpart. Both
    # sit on the `internal` network — celilo-mgr reaches a notification
    # transport locally; a transport needing public ingress could not tell
    # you the ingress was broken.
    local-data: "signal-cli.lab. IN A 10.226.1.90"
    local-data: "signal-sim.lab. IN A 10.226.1.91"
    # signal-cli release host — the sim internet's stand-in for GitHub
    # releases, so the signal module's deploy-time download resolves inside
    # the sealed network. See SIMULATOR_IPS.SIGNAL_RELEASE.
    local-data: "signal-release.lab. IN A 100.64.0.62"

forward-zone:
    name: "."
    forward-addr: 203.0.113.1
EOF

/usr/sbin/unbound -d &

echo "internal resolver ready (split-horizon: ${DOMAINS} -> ${CADDY_IP})"
sleep infinity