import { zoneIp } from './types';

/**
 * Single source of truth for the IPs of e2e simulator containers on
 * the `internet-external` Docker network.
 *
 * Renumbering one of these used to mean tracking down the value in
 * eight-ish places (compose files, generator, zone files, resolver
 * configs, routing scripts). This module is the canonical record for
 * code; non-code files (Knot zones, shell scripts) still hard-code the
 * values, but `scripts/check-simulator-ips.sh` flags any drift in CI.
 *
 * To renumber a simulator:
 *   1. Update the constant here.
 *   2. Run `bash packages/e2e/scripts/check-simulator-ips.sh` — it
 *      lists every non-code file that still has the old value.
 *   3. Edit those files. Re-run the check until it passes.
 *   4. `cele2e build-infra` to rebake the images.
 */

export const SIMULATOR_IPS = {
  /** Authoritative root DNS (`.` zone). */
  ROOT_DNS: '100.64.0.53',
  /** Authoritative TLD DNS for `com.`, `org.`, `net.`. */
  TLD_DNS: '100.64.0.54',
  /** Authoritative DNS for the customer domains; also serves the DDNS update endpoint at https://dynamicdns.park-your-domain.com. */
  NAMECHEAP_DNS: '100.64.0.55',
  /** Internal e2e module registry (replaces production celilo.computer in tests). */
  REGISTRY: '100.64.0.56',
  /** External-website prober simulator (mimics isitup.org). */
  ISITUP: '100.64.0.57',
  /** celilo.computer static site simulator — serves install.sh and the docs. */
  WEBSITE: '100.64.0.58',
  /** npm-compat registry simulator — serves @celilo/* tarballs to install.sh. */
  NPM_REGISTRY: '100.64.0.59',
  /** apt-repo simulator — serves the celilo + celilo-bootstrap .debs (mirrors apt.celilo.computer). */
  APT_REPO: '100.64.0.60',
  /** MinIO S3-compatible object storage — backup/restore target (replaces AWS S3 in tests). Reachable at http://minio.lab. */
  MINIO: '100.64.0.61',
  /**
   * OFF-FLEET cPanel/SSH web host simulator (`tangohost.com`) — a third-party
   * host celilo publishes to via `external_web` but does NOT govern. A public
   * peer of namecheap-dns/pebble, NOT behind the customer firewall, so public
   * DNS pointing the domain here is a genuine public endpoint.
   */
  CPANEL_HOST: '100.64.0.63',
  /** signal-cli release host — serves the tarball the signal module downloads at deploy time. */
  SIGNAL_RELEASE: '100.64.0.62',
  /**
   * OFF-FLEET recursive resolver — the rig's stand-in for 1.1.1.1, and a peer
   * of comcast-resolver rather than a replacement for it.
   *
   * The distinction is the whole point of celilo's `public_dns` check: the
   * fleet's own resolver (its ISP's, or its internal split-horizon one)
   * answers with whatever is correct for a client INSIDE, which is not
   * evidence about what the internet sees. celilo REFUSES to use a resolver it
   * is itself configured to use, so verifying public reachability requires a
   * second, independent public resolver — and until this existed the topology
   * had exactly one.
   */
  PUBLIC_RESOLVER: '100.64.0.64',
  /**
   * IP echo service — the rig's stand-in for api.ipify.org. Reports the source
   * address a request appears to come from, which for the customer fleet is
   * the firewall's external address after SNAT. The `public_dns` check's
   * expectation comes from here rather than from the registrar's own response,
   * which is self-agreement (and, for a Namecheap `www` update, false).
   */
  IP_ECHO: '100.64.0.65',
  /** Pebble ACME server (replaces production Let's Encrypt). */
  PEBBLE: '100.64.0.100',
} as const;

export type SimulatorIpName = keyof typeof SIMULATOR_IPS;

/**
 * Proxmox API simulator — the one simulator NOT on `internet-external`, and so
 * deliberately not a member of `SIMULATOR_IPS` above.
 *
 * It lives on `secure-mgmt` with celilo-mgr (D6): Proxmox *creates* the fleet
 * rather than being consumed by it, which makes it control-plane, not a public
 * internet service. Putting it in the map would also hand it to
 * `check-simulator-ips.sh`, which scans for the internet-external address
 * space and would be checking the wrong thing.
 *
 * Derived from `zoneIp` rather than written out, so it cannot drift from the
 * zone plan. `.1` is the gateway and `.100` is celilo-mgr; `90` follows the
 * convention the other zone-resident simulators use.
 */
export const PROXMOX_SIM_IP = zoneIp('secure-mgmt', 90);

/**
 * Iterable list of `[name, ip]` pairs — useful for the sanity check
 * script and any future consumer that wants to enumerate the set.
 */
export const SIMULATOR_IP_ENTRIES: ReadonlyArray<readonly [SimulatorIpName, string]> = (
  Object.entries(SIMULATOR_IPS) as Array<[SimulatorIpName, string]>
).map(([k, v]) => [k, v] as const);