#!/usr/bin/env bash
# infra-tunnel.sh {up|down|status|restart}
# Lee la configuracion de ./local-dev.env (o la ruta en $TUNNEL_CONF). No se edita el script.
# Requiere VPN activa: el nodo solo es alcanzable por la red interna.
# Documentacion: ../../03-simappe-stack/flujos/FLUJO_PRUEBA_LOCAL_TUNEL_SSH.md
set -euo pipefail

CONF="${TUNNEL_CONF:-$(dirname "$0")/local-dev.env}"
[ -f "$CONF" ] || { echo "No existe la config: $CONF"; exit 1; }
set -a; . "$CONF"; set +a

: "${SSH_HOST:?Falta SSH_HOST en $CONF}"
: "${TUNNEL_PORTS:?Falta TUNNEL_PORTS en $CONF}"
SOCKET="${HOME}/.ssh/cm-infra-tunnel-${SSH_HOST}.sock"
read -ra PORTS <<< "$TUNNEL_PORTS"

is_up() { ssh -S "$SOCKET" -O check "$SSH_HOST" 2>/dev/null; }
up() {
  is_up && { echo "Tunel ya activo hacia $SSH_HOST."; status; return 0; }
  local fwd=()
  for s in "${PORTS[@]}"; do fwd+=( -L "127.0.0.1:${s#*:}:127.0.0.1:${s#*:}" ); done
  ssh -fN -M -S "$SOCKET" \
      -o ServerAliveInterval=30 -o ServerAliveCountMax=3 -o ExitOnForwardFailure=yes \
      "${fwd[@]}" "$SSH_HOST"
  echo "Tunel ARRIBA hacia $SSH_HOST. Modulos nebula/client -> gateway."
}
down()   { is_up && { ssh -S "$SOCKET" -O exit "$SSH_HOST" 2>/dev/null || true; echo "Tunel CERRADO."; } || echo "Sin tunel activo."; }
status() { is_up || { echo "Tunel INACTIVO."; return; }; for s in "${PORTS[@]}"; do (exec 3<>"/dev/tcp/127.0.0.1/${s#*:}") 2>/dev/null && echo "  OK    ${s%%:*} (:${s#*:})" || echo "  FALLA ${s%%:*} (:${s#*:})"; done; }

case "${1:-}" in
  up) up ;; down) down ;; restart) down; sleep 1; up ;; status) status ;;
  *) echo "Uso: $0 {up|down|restart|status}"; exit 1 ;;
esac