#!/bin/sh /etc/rc.common
# Parahub VPN Tunnel — Creates GRE6 tunnel over Yggdrasil for guest traffic
# Runs after yggdrasil (START=95). OpenWrt 25.x lacks the netifd grev6 protocol
# handler, so we create the tunnel manually with ip6gre.
#
# Tunnel IP is assigned by Django and stored in /etc/parahub/tunnel_ip.
# If the file doesn't exist (first boot), heartbeat is called synchronously to get it.
#
# IMPORTANT: encaplimit must be "none" — Yggdrasil drops IPv6 packets with
# Destination Options extension headers (added by default encaplimit 4).

START=96
STOP=10

VPS_YGG="200:39f1:6a26:328a:d901:fbd2:d30d:faef"
GRE_GATEWAY="172.16.0.1"
TUNNEL_IP_FILE="/etc/parahub/tunnel_ip"

start() {
    # Only for Bumblebee role
    [ "$(cat /etc/parahub/role 2>/dev/null)" = "bumblebee" ] || return 0

    # Wait for Yggdrasil address (up to 60s)
    local ygg_addr="" attempts=0
    while [ $attempts -lt 30 ]; do
        ygg_addr=$(ip -6 addr show dev ygg0 scope global 2>/dev/null | awk '/inet6/{print $2}' | cut -d/ -f1 | head -1)
        [ -n "$ygg_addr" ] && break
        attempts=$((attempts + 1))
        sleep 2
    done

    if [ -z "$ygg_addr" ]; then
        logger -t parahub-vpn "No Yggdrasil address after 60s, skipping GRE6 tunnel"
        return 1
    fi

    # Get tunnel IP — from file, or request via heartbeat on first boot
    local gre_local_ip
    gre_local_ip=$(cat "$TUNNEL_IP_FILE" 2>/dev/null)

    if [ -z "$gre_local_ip" ]; then
        logger -t parahub-vpn "No tunnel IP file, calling heartbeat to get assignment..."
        HEARTBEAT_CURL_TIMEOUT=30 /usr/bin/parahub-heartbeat
        gre_local_ip=$(cat "$TUNNEL_IP_FILE" 2>/dev/null)
    fi

    if [ -z "$gre_local_ip" ]; then
        logger -t parahub-vpn "Failed to get tunnel IP from heartbeat, falling back to 172.16.0.2"
        gre_local_ip="172.16.0.2"
    fi

    # Create GRE6 tunnel (encaplimit none — critical for Yggdrasil compatibility)
    ip -6 tunnel add gre6-vpn mode ip6gre \
        remote "$VPS_YGG" \
        local "$ygg_addr" \
        encaplimit none
    ip addr add ${gre_local_ip}/24 dev gre6-vpn
    ip link set gre6-vpn mtu 1400 up

    # Default route through GRE (table 100 — used by guest policy routing)
    ip route add default via "$GRE_GATEWAY" table 100

    # Guest subnet direct route in table 100 (background — WiFi may not be up yet)
    # Without this, router's own replies (source IP in guest subnet) go through
    # GRE instead of back to the guest client (ip rule matches source-based)
    local guest_subnet
    guest_subnet=$(awk -F= '/GUEST_SUBNET/{print $2}' /etc/parahub/keys 2>/dev/null)
    if [ -n "$guest_subnet" ]; then
        # WiFi interfaces take time to come up at boot — retry in background
        (
            local guest_dev="" ga=0
            while [ $ga -lt 30 ]; do
                guest_dev=$(ip route | grep "^${guest_subnet} " | awk '{print $3}')
                [ -n "$guest_dev" ] && break
                ga=$((ga + 1))
                sleep 2
            done
            if [ -n "$guest_dev" ]; then
                ip route add "$guest_subnet" dev "$guest_dev" table 100 2>/dev/null
                logger -t parahub-vpn "Guest route: $guest_subnet via $guest_dev in table 100"
            else
                logger -t parahub-vpn "Warning: guest device not found for $guest_subnet after 60s"
            fi
        ) &
    fi

    # Reload firewall so vpn_tunnel zone picks up gre6-vpn device
    /etc/init.d/firewall reload 2>/dev/null &

    logger -t parahub-vpn "GRE6 tunnel up: ${gre_local_ip} → ${VPS_YGG} via $ygg_addr (encaplimit none)"
}

stop() {
    ip route flush table 100 2>/dev/null
    ip -6 tunnel del gre6-vpn 2>/dev/null
    logger -t parahub-vpn "GRE6 tunnel down"
}