#!/bin/sh
# Parahub Mesh Node — Zero-Touch First Boot Configuration
# This script runs once on first boot via uci-defaults mechanism.
# It configures: batman-adv mesh, dual-band WiFi (private+public), firewall zones, SQM shaping.
#
# Roles:
#   bumblebee (L3 Gateway) — full stack: yggdrasil, Mullvad VPN, guest isolation, speed control, DoH
#   bee (L2 Transport)     — minimal: batman-adv mesh relay, heartbeat

# Read firmware role (written by build.sh)
ROLE=$(cat /etc/parahub/role 2>/dev/null || echo "bumblebee")

# ============================================================================
# 1. IDENTITY GENERATION
# ============================================================================

# Get br-lan MAC (fallback to eth0 if br-lan doesn't exist yet)
BASE_MAC=$(cat /sys/class/net/br-lan/address 2>/dev/null || cat /sys/class/net/eth0/address 2>/dev/null || echo "00:00:00:00:00:00")

# Last 4 hex digits of MAC for unique suffix
NODE_SUFFIX=$(echo "$BASE_MAC" | awk -F: '{print toupper($5$6)}')

HOSTNAME="Parahub-${NODE_SUFFIX}"
PRIVATE_SSID="Parahub"
MESH_ID="parahub.io/mesh"
PUBLIC_SSID="parahub.io/free"

# ============================================================================
# 2. SUBNET GENERATION (collision avoidance from MAC octets)
# ============================================================================

# Private: octets 4,5 → 10.P1.P2.0/24
PRIV_O1=$(echo "$BASE_MAC" | awk -F: '{printf "%d", "0x"$4}')
PRIV_O2=$(echo "$BASE_MAC" | awk -F: '{printf "%d", "0x"$5}')

# Guest: octets 2,3 → 10.G1.G2.0/24 (guaranteed different from private since different MAC positions)
GUEST_O1=$(echo "$BASE_MAC" | awk -F: '{printf "%d", "0x"$2}')
GUEST_O2=$(echo "$BASE_MAC" | awk -F: '{printf "%d", "0x"$3}')

# Avoid 0 and 255 in second octet (reserved)
[ "$PRIV_O1" -eq 0 ] && PRIV_O1=1
[ "$PRIV_O1" -eq 255 ] && PRIV_O1=254
[ "$GUEST_O1" -eq 0 ] && GUEST_O1=2
[ "$GUEST_O1" -eq 255 ] && GUEST_O1=253

PRIV_SUBNET="10.${PRIV_O1}.${PRIV_O2}.0"
PRIV_IP="10.${PRIV_O1}.${PRIV_O2}.1"
GUEST_SUBNET="10.${GUEST_O1}.${GUEST_O2}.0"
GUEST_IP="10.${GUEST_O1}.${GUEST_O2}.1"

# ============================================================================
# 3. KEY GENERATION
# ============================================================================

# Shared private WiFi key — same on all nodes for seamless 802.11r roaming
PRIVATE_KEY="parahub.io"
# Shared mesh SAE key — same across all Parahub nodes for auto-peering
MESH_KEY="ndIPclyqSn9LaCki"
# Random root password for SSH + LuCI (unique per node)
ROOT_PASSWORD=$(head -c 128 /dev/urandom | tr -dc 'A-Za-z0-9' | head -c 16)

mkdir -p /etc/parahub
cat > /etc/parahub/keys <<KEYS_EOF
# Parahub Mesh Node Keys — Generated at first boot
# Node: ${HOSTNAME}
# Role: ${ROLE}
# Date: $(date -u +%Y-%m-%dT%H:%M:%SZ)
PRIVATE_WIFI_KEY=${PRIVATE_KEY}
MESH_SAE_KEY=${MESH_KEY}
PRIVATE_SSID=${PRIVATE_SSID}
PRIVATE_SUBNET=${PRIV_SUBNET}/24
GUEST_SUBNET=${GUEST_SUBNET}/24
NODE_MAC=${BASE_MAC}
ROOT_PASSWORD=${ROOT_PASSWORD}
KEYS_EOF
chmod 600 /etc/parahub/keys

# Set root password (secures SSH + LuCI)
echo -e "${ROOT_PASSWORD}\n${ROOT_PASSWORD}" | passwd root >/dev/null 2>&1

# Ensure dropbear directory has strict permissions (required for key auth)
chmod 700 /etc/dropbear

# ============================================================================
# 4. NETWORK CONFIGURATION
# ============================================================================

# --- Port mapping (written by build.sh per device) ---
PORT_MAP=$(cat /etc/parahub/port_map 2>/dev/null || echo "eth0:lan eth1:wan")
if [ "$PORT_MAP" = "dsa" ]; then
    # DSA switch (ax53u) — individual ports
    LAN_PORTS="lan1 lan2 lan3 lan4"
    WAN_DEV="wan"
else
    # Parse port map: "eth0:wan eth1:lan" → extract LAN and WAN
    LAN_PORTS=""
    WAN_DEV=""
    for mapping in $PORT_MAP; do
        port="${mapping%%:*}"
        role="${mapping##*:}"
        if [ "$role" = "lan" ]; then
            LAN_PORTS="$port"
        elif [ "$role" = "wan" ]; then
            WAN_DEV="$port"
        fi
    done
    [ -z "$LAN_PORTS" ] && LAN_PORTS="eth0"
    [ -z "$WAN_DEV" ] && WAN_DEV="eth1"
fi

# Delete default OpenWrt br-lan/lan (conflicts with our br-private)
uci -q delete network.lan 2>/dev/null || true
# Find and delete br-lan device
for i in 0 1 2 3 4; do
    name=$(uci -q get "network.@device[$i].name" 2>/dev/null)
    if [ "$name" = "br-lan" ]; then
        uci delete "network.@device[$i]"
        break
    fi
done

if [ "$ROLE" = "bee" ]; then
    # --- Bee: minimal network (bat0 gw_mode=client, no GRE6, no guest, no policy routing) ---
    uci batch <<-NET_EOF
# --- loopback ---
set network.loopback=interface
set network.loopback.device='lo'
set network.loopback.proto='static'
set network.loopback.ipaddr='127.0.0.1'
set network.loopback.netmask='255.0.0.0'

# --- bat0 (batman-adv, client mode — uses Bumblebee as gateway) ---
set network.bat0=interface
set network.bat0.proto='batadv'
set network.bat0.routing_algo='BATMAN_V'
set network.bat0.aggregated_ogms='1'
set network.bat0.bridge_loop_avoidance='1'
set network.bat0.distributed_arp_table='1'
set network.bat0.gw_mode='client'
set network.bat0.hop_penalty='15'
set network.bat0.orig_interval='1000'

# --- bat0 hardif for mesh0 (2.4GHz mesh) ---
set network.bat0_hardif_mesh0=interface
set network.bat0_hardif_mesh0.proto='batadv_hardif'
set network.bat0_hardif_mesh0.master='bat0'

# --- bat0 hardif for mesh1 (5GHz mesh) ---
set network.bat0_hardif_mesh1=interface
set network.bat0_hardif_mesh1.proto='batadv_hardif'
set network.bat0_hardif_mesh1.master='bat0'

# --- private bridge (bat0 + LAN ethernet) ---
set network.private_dev=device
set network.private_dev.type='bridge'
set network.private_dev.name='br-private'
delete network.private_dev.ports
add_list network.private_dev.ports='bat0'

set network.private=interface
set network.private.device='br-private'
set network.private.proto='static'
set network.private.ipaddr='${PRIV_IP}'
set network.private.netmask='255.255.255.0'

# --- wan (DHCP, create if missing) ---
set network.wan=interface
set network.wan.device='${WAN_DEV}'
set network.wan.proto='dhcp'
NET_EOF

    # Add LAN ports to private bridge (DSA: lan1-4, non-DSA: eth0)
    for port in $LAN_PORTS; do
        uci add_list network.private_dev.ports="$port"
    done

else
    # --- Bumblebee: full network (gw_mode starts as client, promoted to server by gw-check when Mullvad is up) ---
    uci batch <<-NET_EOF
# --- loopback ---
set network.loopback=interface
set network.loopback.device='lo'
set network.loopback.proto='static'
set network.loopback.ipaddr='127.0.0.1'
set network.loopback.netmask='255.0.0.0'

# --- bat0 (batman-adv, starts as client — gw-check promotes to server when Mullvad is active) ---
set network.bat0=interface
set network.bat0.proto='batadv'
set network.bat0.routing_algo='BATMAN_V'
set network.bat0.aggregated_ogms='1'
set network.bat0.bridge_loop_avoidance='1'
set network.bat0.distributed_arp_table='1'
set network.bat0.gw_mode='client'
set network.bat0.hop_penalty='15'
set network.bat0.orig_interval='1000'

# --- bat0 hardif for mesh0 (2.4GHz mesh) ---
set network.bat0_hardif_mesh0=interface
set network.bat0_hardif_mesh0.proto='batadv_hardif'
set network.bat0_hardif_mesh0.master='bat0'

# --- bat0 hardif for mesh1 (5GHz mesh) ---
set network.bat0_hardif_mesh1=interface
set network.bat0_hardif_mesh1.proto='batadv_hardif'
set network.bat0_hardif_mesh1.master='bat0'

# --- private bridge (bat0 + LAN ethernet) ---
set network.private_dev=device
set network.private_dev.type='bridge'
set network.private_dev.name='br-private'
delete network.private_dev.ports
add_list network.private_dev.ports='bat0'

set network.private=interface
set network.private.device='br-private'
set network.private.proto='static'
set network.private.ipaddr='${PRIV_IP}'
set network.private.netmask='255.255.255.0'

# --- guest (standalone, no bridge to mesh) ---
set network.guest=interface
set network.guest.proto='static'
set network.guest.ipaddr='${GUEST_IP}'
set network.guest.netmask='255.255.255.0'

# --- wan (DHCP, create if missing) ---
set network.wan=interface
set network.wan.device='${WAN_DEV}'
set network.wan.proto='dhcp'

# --- Policy routing: guest traffic → Mullvad table 100 ---
add network rule
set network.@rule[-1].src='${GUEST_SUBNET}/24'
set network.@rule[-1].lookup='100'
set network.@rule[-1].priority='100'
NET_EOF

    # Add LAN ports to private bridge (DSA: lan1-4, non-DSA: eth0)
    for port in $LAN_PORTS; do
        uci add_list network.private_dev.ports="$port"
    done
fi

uci commit network

# ============================================================================
# 5. WIRELESS CONFIGURATION
# ============================================================================

# Detect radios dynamically
RADIOS=$(uci show wireless | grep '=wifi-device' | cut -d'=' -f1 | cut -d'.' -f2)

# Determine which radio is 2.4GHz and which is 5GHz
RADIO_2G=""
RADIO_5G=""

for radio in $RADIOS; do
    band=$(uci -q get "wireless.${radio}.band" 2>/dev/null || echo "")
    htmode=$(uci -q get "wireless.${radio}.htmode" 2>/dev/null || echo "")

    if [ "$band" = "2g" ]; then
        RADIO_2G="$radio"
    elif [ "$band" = "5g" ]; then
        RADIO_5G="$radio"
    else
        # Fallback: detect from htmode or channel
        channel=$(uci -q get "wireless.${radio}.channel" 2>/dev/null || echo "0")
        if [ "$channel" -le 14 ] 2>/dev/null; then
            RADIO_2G="$radio"
        else
            RADIO_5G="$radio"
        fi
    fi
done

# Fallback: if only one radio detected, use it for both
if [ -z "$RADIO_2G" ] && [ -n "$RADIO_5G" ]; then
    RADIO_2G="$RADIO_5G"
fi
if [ -z "$RADIO_5G" ] && [ -n "$RADIO_2G" ]; then
    RADIO_5G="$RADIO_2G"
fi

# Remove all existing wifi-iface sections
while uci -q delete wireless.@wifi-iface[0]; do :; done

# Enable radios and set fixed channels (all nodes must share same channel for mesh peering)
for radio in $RADIOS; do
    uci -q delete "wireless.${radio}.disabled" 2>/dev/null || true
done

# Fixed channels — all mesh nodes must be on the same channel per band
# 2.4GHz: channel 1 (DFS-free, least congested of 1/6/11)
# 5GHz: channel 36 (DFS-free, universal chipset support)
if [ -n "$RADIO_2G" ]; then
    uci set "wireless.${RADIO_2G}.channel=1"
fi
if [ -n "$RADIO_5G" ]; then
    uci set "wireless.${RADIO_5G}.channel=36"
fi

# --- 2.4GHz radio: mesh backhaul + parahub.io/free AP ---
if [ -n "$RADIO_2G" ]; then
    # Mesh interface on 2.4GHz
    uci batch <<-WIFI_2G_MESH
set wireless.mesh_2g=wifi-iface
set wireless.mesh_2g.device='${RADIO_2G}'
set wireless.mesh_2g.mode='mesh'
set wireless.mesh_2g.mesh_id='${MESH_ID}'
set wireless.mesh_2g.mesh_fwding='0'
set wireless.mesh_2g.encryption='sae'
set wireless.mesh_2g.key='${MESH_KEY}'
set wireless.mesh_2g.network='bat0_hardif_mesh0'
WIFI_2G_MESH

    if [ "$ROLE" = "bee" ]; then
        # Bee: parahub.io/free on private bridge (no guest isolation)
        uci batch <<-WIFI_2G_PUB
set wireless.public_2g=wifi-iface
set wireless.public_2g.device='${RADIO_2G}'
set wireless.public_2g.mode='ap'
set wireless.public_2g.ssid='${PUBLIC_SSID}'
set wireless.public_2g.encryption='none'
set wireless.public_2g.network='private'
WIFI_2G_PUB
    else
        # Bumblebee: parahub.io/free on guest network (isolated)
        uci batch <<-WIFI_2G_PUB
set wireless.public_2g=wifi-iface
set wireless.public_2g.device='${RADIO_2G}'
set wireless.public_2g.mode='ap'
set wireless.public_2g.ssid='${PUBLIC_SSID}'
set wireless.public_2g.encryption='none'
set wireless.public_2g.isolate='1'
set wireless.public_2g.network='guest'
WIFI_2G_PUB
    fi
fi

# --- 5GHz radio: mesh backhaul + Private AP ---
if [ -n "$RADIO_5G" ]; then
    # Mesh interface on 5GHz
    uci batch <<-WIFI_5G_MESH
set wireless.mesh_5g=wifi-iface
set wireless.mesh_5g.device='${RADIO_5G}'
set wireless.mesh_5g.mode='mesh'
set wireless.mesh_5g.mesh_id='${MESH_ID}'
set wireless.mesh_5g.mesh_fwding='0'
set wireless.mesh_5g.encryption='sae'
set wireless.mesh_5g.key='${MESH_KEY}'
set wireless.mesh_5g.network='bat0_hardif_mesh1'
WIFI_5G_MESH

    # Private AP on 5GHz (better throughput, 802.11r/k/v for seamless roaming)
    uci batch <<-WIFI_5G_PRIV
set wireless.private_5g=wifi-iface
set wireless.private_5g.device='${RADIO_5G}'
set wireless.private_5g.mode='ap'
set wireless.private_5g.ssid='${PRIVATE_SSID}'
set wireless.private_5g.encryption='sae-mixed'
set wireless.private_5g.key='${PRIVATE_KEY}'
set wireless.private_5g.network='private'
set wireless.private_5g.ieee80211r='1'
set wireless.private_5g.ft_over_ds='0'
set wireless.private_5g.ft_psk_generate_local='1'
set wireless.private_5g.mobility_domain='0a01'
set wireless.private_5g.ieee80211k='1'
set wireless.private_5g.ieee80211v='1'
WIFI_5G_PRIV

    # Private AP on 2.4GHz (range: outdoor, through walls)
    uci batch <<-WIFI_2G_PRIV
set wireless.private_2g=wifi-iface
set wireless.private_2g.device='${RADIO_2G}'
set wireless.private_2g.mode='ap'
set wireless.private_2g.ssid='${PRIVATE_SSID}'
set wireless.private_2g.encryption='sae-mixed'
set wireless.private_2g.key='${PRIVATE_KEY}'
set wireless.private_2g.network='private'
set wireless.private_2g.ieee80211r='1'
set wireless.private_2g.ft_over_ds='0'
set wireless.private_2g.ft_psk_generate_local='1'
set wireless.private_2g.mobility_domain='0a01'
set wireless.private_2g.ieee80211k='1'
set wireless.private_2g.ieee80211v='1'
WIFI_2G_PRIV
fi

uci commit wireless

# ============================================================================
# 6. FIREWALL CONFIGURATION
# ============================================================================

# Reset firewall to clean state
while uci -q delete firewall.@zone[0]; do :; done
while uci -q delete firewall.@forwarding[0]; do :; done
while uci -q delete firewall.@rule[0]; do :; done
while uci -q delete firewall.@redirect[0]; do :; done

if [ "$ROLE" = "bee" ]; then
    # --- Bee: minimal firewall (lan + wan only) ---
    uci batch <<-FW_EOF
# --- Zone: lan (private network) ---
add firewall zone
set firewall.@zone[-1].name='lan'
set firewall.@zone[-1].input='ACCEPT'
set firewall.@zone[-1].output='ACCEPT'
set firewall.@zone[-1].forward='ACCEPT'
add_list firewall.@zone[-1].network='private'

# --- Zone: wan ---
add firewall zone
set firewall.@zone[-1].name='wan'
set firewall.@zone[-1].input='REJECT'
set firewall.@zone[-1].output='ACCEPT'
set firewall.@zone[-1].forward='REJECT'
set firewall.@zone[-1].masq='1'
set firewall.@zone[-1].mtu_fix='1'
add_list firewall.@zone[-1].network='wan'

# --- Forwarding: lan → wan ---
add firewall forwarding
set firewall.@forwarding[-1].src='lan'
set firewall.@forwarding[-1].dest='wan'

# --- Standard WAN input rules ---
add firewall rule
set firewall.@rule[-1].name='Allow-DHCP-Renew'
set firewall.@rule[-1].src='wan'
set firewall.@rule[-1].proto='udp'
set firewall.@rule[-1].dest_port='68'
set firewall.@rule[-1].target='ACCEPT'
set firewall.@rule[-1].family='ipv4'

add firewall rule
set firewall.@rule[-1].name='Allow-Ping'
set firewall.@rule[-1].src='wan'
set firewall.@rule[-1].proto='icmp'
set firewall.@rule[-1].icmp_type='echo-request'
set firewall.@rule[-1].target='ACCEPT'
FW_EOF

else
    # --- Bumblebee: full firewall (3 zones + mullvad_local added by parahub-mullvad, guest kill switch) ---
    uci batch <<-FW_EOF
# --- Zone: lan (private network) ---
add firewall zone
set firewall.@zone[-1].name='lan'
set firewall.@zone[-1].input='ACCEPT'
set firewall.@zone[-1].output='ACCEPT'
set firewall.@zone[-1].forward='ACCEPT'
add_list firewall.@zone[-1].network='private'

# --- Zone: guest (dual-stack — IPv6 for Yggdrasil services) ---
add firewall zone
set firewall.@zone[-1].name='guest'
set firewall.@zone[-1].input='REJECT'
set firewall.@zone[-1].output='ACCEPT'
set firewall.@zone[-1].forward='REJECT'
add_list firewall.@zone[-1].network='guest'

# --- Zone: wan ---
add firewall zone
set firewall.@zone[-1].name='wan'
set firewall.@zone[-1].input='REJECT'
set firewall.@zone[-1].output='ACCEPT'
set firewall.@zone[-1].forward='REJECT'
set firewall.@zone[-1].masq='1'
set firewall.@zone[-1].mtu_fix='1'
add_list firewall.@zone[-1].network='wan'

# --- Forwarding: lan → wan (internet for owner) ---
add firewall forwarding
set firewall.@forwarding[-1].src='lan'
set firewall.@forwarding[-1].dest='wan'

# NOTE: guest → mullvad_local forwarding is added by parahub-mullvad setup.
# Without Mullvad configured, guests have NO internet (kill switch by design).
# parahub-gw-check monitors Mullvad and sets gw_mode accordingly.

# --- Rule: guest DHCP (allow guests to get IP) ---
add firewall rule
set firewall.@rule[-1].name='Guest DHCP'
set firewall.@rule[-1].src='guest'
set firewall.@rule[-1].proto='udp'
set firewall.@rule[-1].dest_port='67'
set firewall.@rule[-1].target='ACCEPT'
set firewall.@rule[-1].family='ipv4'

# --- Rule: guest DNS to router (hijacked to DoH, dual-stack) ---
add firewall rule
set firewall.@rule[-1].name='Guest DNS'
set firewall.@rule[-1].src='guest'
set firewall.@rule[-1].proto='tcpudp'
set firewall.@rule[-1].dest_port='53'
set firewall.@rule[-1].target='ACCEPT'

# --- Rule: block guest → lan (isolation) ---
add firewall rule
set firewall.@rule[-1].name='Block guest to LAN'
set firewall.@rule[-1].src='guest'
set firewall.@rule[-1].dest='lan'
set firewall.@rule[-1].proto='all'
set firewall.@rule[-1].target='REJECT'

# --- Rule: allow guest DHCPv6/RA (IPv6 address assignment) ---
add firewall rule
set firewall.@rule[-1].name='Guest RA'
set firewall.@rule[-1].src='guest'
set firewall.@rule[-1].proto='icmp'
set firewall.@rule[-1].family='ipv6'
set firewall.@rule[-1].icmp_type='router-solicitation'
set firewall.@rule[-1].target='ACCEPT'

# --- Rule: block guest IPv6 to WAN (only Yggdrasil allowed via forwarding) ---
add firewall rule
set firewall.@rule[-1].name='Block guest IPv6 WAN'
set firewall.@rule[-1].src='guest'
set firewall.@rule[-1].dest='wan'
set firewall.@rule[-1].proto='all'
set firewall.@rule[-1].family='ipv6'
set firewall.@rule[-1].target='REJECT'

# --- DNS hijack: redirect guest DNS to local DoH resolver ---
add firewall redirect
set firewall.@redirect[-1].name='Guest DNS hijack'
set firewall.@redirect[-1].src='guest'
set firewall.@redirect[-1].src_dport='53'
set firewall.@redirect[-1].proto='tcpudp'
set firewall.@redirect[-1].target='DNAT'
set firewall.@redirect[-1].dest='lan'
set firewall.@redirect[-1].dest_port='53'
set firewall.@redirect[-1].family='ipv4'

# --- Standard WAN input rules ---
add firewall rule
set firewall.@rule[-1].name='Allow-DHCP-Renew'
set firewall.@rule[-1].src='wan'
set firewall.@rule[-1].proto='udp'
set firewall.@rule[-1].dest_port='68'
set firewall.@rule[-1].target='ACCEPT'
set firewall.@rule[-1].family='ipv4'

add firewall rule
set firewall.@rule[-1].name='Allow-Ping'
set firewall.@rule[-1].src='wan'
set firewall.@rule[-1].proto='icmp'
set firewall.@rule[-1].icmp_type='echo-request'
set firewall.@rule[-1].target='ACCEPT'
FW_EOF
fi

uci commit firewall

# ============================================================================
# 7. DHCP CONFIGURATION
# ============================================================================

# Remove existing DHCP pools that may conflict
uci -q delete dhcp.lan 2>/dev/null || true
uci -q delete dhcp.guest 2>/dev/null || true

if [ "$ROLE" = "bee" ]; then
    # Bee: private DHCP only (no guest pool)
    uci batch <<-DHCP_EOF
set dhcp.private=dhcp
set dhcp.private.interface='private'
set dhcp.private.start='100'
set dhcp.private.limit='150'
set dhcp.private.leasetime='12h'
DHCP_EOF
else
    # Bumblebee: private + guest DHCP
    uci batch <<-DHCP_EOF
# --- Private DHCP ---
set dhcp.private=dhcp
set dhcp.private.interface='private'
set dhcp.private.start='100'
set dhcp.private.limit='150'
set dhcp.private.leasetime='12h'

# --- Guest DHCP ---
set dhcp.guest=dhcp
set dhcp.guest.interface='guest'
set dhcp.guest.start='100'
set dhcp.guest.limit='50'
set dhcp.guest.leasetime='1h'
DHCP_EOF
fi

uci commit dhcp

# ============================================================================
# 8. SPEED CONTROL (Bumblebee only — per-client shaping, paid Lightning upgrade)
# ============================================================================

if [ "$ROLE" != "bee" ]; then
    chmod +x /usr/bin/parahub-speed-control

    # Create init.d service for speed control
    cat > /etc/init.d/parahub-speed <<'INITEOF'
#!/bin/sh /etc/rc.common
START=99
start() { /usr/bin/parahub-speed-control init; }
stop() {
    tc qdisc del dev br-guest root 2>/dev/null
    tc qdisc del dev br-guest ingress 2>/dev/null
    ip link del ifb-guest 2>/dev/null
    nft delete table inet parahub 2>/dev/null
}
INITEOF
    chmod +x /etc/init.d/parahub-speed
    /etc/init.d/parahub-speed enable
fi

# ============================================================================
# 9. DNS-OVER-HTTPS (Bumblebee only — guest DNS privacy)
# ============================================================================

if [ "$ROLE" != "bee" ]; then
    uci batch <<-DOH_EOF
set https-dns-proxy.main=main
set https-dns-proxy.main.doh_paramters='-4'
set https-dns-proxy.main.listen_addr='0.0.0.0'
set https-dns-proxy.main.listen_port='5053'

set https-dns-proxy.cloudflare=https-dns-proxy
set https-dns-proxy.cloudflare.resolver_url='https://1.1.1.1/dns-query'
set https-dns-proxy.cloudflare.listen_addr='127.0.0.1'
set https-dns-proxy.cloudflare.listen_port='5053'
DOH_EOF
    uci commit https-dns-proxy

    # Configure dnsmasq to use DoH for upstream
    uci -q delete dhcp.@dnsmasq[0].server 2>/dev/null || true
    uci add_list dhcp.@dnsmasq[0].server='127.0.0.1#5053'
    uci set dhcp.@dnsmasq[0].noresolv='1'
    uci commit dhcp

    # Enable https-dns-proxy service
    /etc/init.d/https-dns-proxy enable 2>/dev/null || true
fi

# ============================================================================
# 10. SYSTEM SETTINGS
# ============================================================================

uci batch <<-SYS_EOF
set system.@system[0].hostname='${HOSTNAME}'
set system.@system[0].timezone='UTC0'
set system.@system[0].zonename='UTC'
set system.@system[0].log_proto='udp'
set system.@system[0].conloglevel='7'
set system.@system[0].cronloglevel='9'
SYS_EOF
uci commit system

# ============================================================================
# 11. YGGDRASIL OVERLAY NETWORK (Bumblebee only)
# ============================================================================

if [ "$ROLE" != "bee" ]; then
    # Generate unique keys for this node
    yggdrasil -genconf | sed 's/IfName: .*/IfName: ygg0/' > /etc/yggdrasil.conf

    # Add VPS as static Yggdrasil peer (management plane: remote access, heartbeat)
    sed -i 's|Peers: \[\]|Peers: ["tls://91.98.123.238:443"]|' /etc/yggdrasil.conf

    # UCI network interface for yggdrasil TUN
    uci batch <<-YGG_EOF
set network.yggdrasil=interface
set network.yggdrasil.device='ygg0'
set network.yggdrasil.proto='none'
YGG_EOF
    uci commit network

    # Yggdrasil firewall zone (separate from LAN — allows guest→yggdrasil forwarding)
    uci batch <<-YGG_FW_EOF
add firewall zone
set firewall.@zone[-1].name='yggdrasil'
set firewall.@zone[-1].input='REJECT'
set firewall.@zone[-1].output='ACCEPT'
set firewall.@zone[-1].forward='REJECT'
add_list firewall.@zone[-1].network='yggdrasil'

# Allow SSH on Yggdrasil (remote management)
add firewall rule
set firewall.@rule[-1].name='Allow SSH Ygg'
set firewall.@rule[-1].src='yggdrasil'
set firewall.@rule[-1].proto='tcp'
set firewall.@rule[-1].dest_port='22'
set firewall.@rule[-1].target='ACCEPT'

# Allow HTTP on Yggdrasil (LuCI)
add firewall rule
set firewall.@rule[-1].name='Allow HTTP Ygg'
set firewall.@rule[-1].src='yggdrasil'
set firewall.@rule[-1].proto='tcp'
set firewall.@rule[-1].dest_port='80'
set firewall.@rule[-1].target='ACCEPT'

# Allow ICMPv6 on Yggdrasil
add firewall rule
set firewall.@rule[-1].name='Allow ICMPv6 Ygg'
set firewall.@rule[-1].src='yggdrasil'
set firewall.@rule[-1].proto='icmp'
set firewall.@rule[-1].family='ipv6'
set firewall.@rule[-1].target='ACCEPT'

# Forwardings: LAN ↔ Yggdrasil (owner full access)
add firewall forwarding
set firewall.@forwarding[-1].src='lan'
set firewall.@forwarding[-1].dest='yggdrasil'

add firewall forwarding
set firewall.@forwarding[-1].src='yggdrasil'
set firewall.@forwarding[-1].dest='lan'

# Forwarding: guest → yggdrasil (IPv6 Parahub services at full speed)
add firewall forwarding
set firewall.@forwarding[-1].src='guest'
set firewall.@forwarding[-1].dest='yggdrasil'
YGG_FW_EOF
    uci commit firewall

    # Enable yggdrasil service
    /etc/init.d/yggdrasil enable 2>/dev/null || true

    # Save yggdrasil address to node keys file
    YGG_ADDR=$(yggdrasil -address -useconffile /etc/yggdrasil.conf 2>/dev/null || echo "unknown")
    echo "YGGDRASIL_ADDRESS=${YGG_ADDR}" >> /etc/parahub/keys
else
    YGG_ADDR="none"
fi

# ============================================================================
# 12. GUEST IPv6 VIA YGGDRASIL (Bumblebee only — full-speed Parahub access)
# ============================================================================

if [ "$ROLE" != "bee" ]; then
    # Extract Yggdrasil 300::/64 subnet for guest SLAAC
    YGG_SUBNET=$(yggdrasil -subnet -useconffile /etc/yggdrasil.conf 2>/dev/null)
    # YGG_SUBNET format: 300:xxxx:xxxx:xxxx::/64
    YGG_SUBNET_PREFIX="${YGG_SUBNET%%::*}"  # 300:xxxx:xxxx:xxxx

    if [ -n "$YGG_SUBNET_PREFIX" ]; then
        # Assign IPv6 from Yggdrasil subnet to guest interface
        uci set network.guest.ip6addr="${YGG_SUBNET_PREFIX}::1/64"
        uci commit network

        # Configure RA/SLAAC for guest (odhcpd)
        uci batch <<-GUEST6_EOF
set dhcp.guest.ra='server'
set dhcp.guest.dhcpv6='disabled'
set dhcp.guest.ra_management='0'
set dhcp.guest.ra_default='1'
set dhcp.guest.ra_slaac='1'
GUEST6_EOF
        uci commit dhcp

        logger -t parahub-mesh "Guest IPv6: ${YGG_SUBNET_PREFIX}::1/64 (SLAAC)"
    else
        logger -t parahub-mesh "Warning: Could not extract Yggdrasil subnet, guest IPv6 disabled"
    fi
fi

# ============================================================================
# 13. HEARTBEAT (phone-home to Parahub cloud)
# ============================================================================

chmod +x /usr/bin/parahub-heartbeat
chmod +x /usr/bin/parahub-autoupdate
chmod +x /usr/bin/parahub-gw-check

# Cron: heartbeat every 5 min, gateway health check every 2 min, OTA nightly
echo "*/5 * * * * /usr/bin/parahub-heartbeat" >> /etc/crontabs/root
echo "*/2 * * * * /usr/bin/parahub-gw-check" >> /etc/crontabs/root
echo "0 3 * * * /usr/bin/parahub-autoupdate" >> /etc/crontabs/root
/etc/init.d/cron enable

# ============================================================================
# 14. FINAL
# ============================================================================

# Log completion
logger -t parahub-mesh "First boot configuration complete (role: ${ROLE})"
logger -t parahub-mesh "Hostname: ${HOSTNAME}"
logger -t parahub-mesh "Role: ${ROLE}"
logger -t parahub-mesh "Private: ${PRIVATE_SSID} @ ${PRIV_IP}/24"

if [ "$ROLE" = "bee" ]; then
    logger -t parahub-mesh "parahub.io/free: bridged to private (no guest isolation)"
    logger -t parahub-mesh "bat0 gw_mode: client (uses Bumblebee as gateway)"
else
    logger -t parahub-mesh "Guest: ${PUBLIC_SSID} @ ${GUEST_IP}/24"
    logger -t parahub-mesh "Mesh ID: ${MESH_ID}"
    logger -t parahub-mesh "Yggdrasil: ${YGG_ADDR}"
    logger -t parahub-mesh "Guest internet: via local Mullvad (parahub-mullvad setup required)"
    logger -t parahub-mesh "Kill switch: guest blocked without Mullvad (by design)"
    logger -t parahub-mesh "Guest IPv6: Yggdrasil SLAAC (full speed, firewall restricted)"
    logger -t parahub-mesh "bat0 gw_mode: client (promoted to server by gw-check when Mullvad active)"
fi

exit 0