#!/usr/bin/env bash
set -euo pipefail

client_home=/var/lib/n2usenet/nym
client_bin=/opt/n2usenet/bin/nym-socks5-client
check_bin=/opt/n2usenet/bin/n2u-check
gateway_db="$client_home/.nym/socks5-clients/n2usenet/data/gateways_registrations.sqlite"
backup_root=/var/lib/n2usenet-gateway-watch/backups
renew_before_seconds=86400
lock_file=/run/n2usenet-gateway-watch/lock

exec 9>"$lock_file"
if ! flock -n 9; then
	exit 0
fi

for required in "$client_bin" "$check_bin" "$gateway_db" /etc/n2usenet/smtp-password; do
	if [[ ! -e "$required" ]]; then
		logger -t n2usenet-gateway-watch "required path is missing: $required"
		exit 1
	fi
done

expiry=$(sqlite3 "$gateway_db" "select d.expiration_timestamp from active_gateway a join remote_gateway_details d on d.gateway_id_bs58=a.active_gateway_id_bs58;")
if [[ -n "$expiry" ]]; then
	expiry_epoch=$(date -u -d "$expiry" +%s)
	now_epoch=$(date -u +%s)
	if (( expiry_epoch - now_epoch > renew_before_seconds )); then
		exit 0
	fi
fi

stamp=$(date -u +%Y%m%dT%H%M%SZ)
backup_dir="$backup_root/$stamp"
install -d -m 0700 "$backup_dir"

restart_services() {
	systemctl start n2usenet-socks.service || true
	systemctl start n2usenet.service || true
}
trap restart_services EXIT

systemctl stop n2usenet.service n2usenet-socks.service
cp -a "$gateway_db" "$backup_dir/gateways_registrations.sqlite.before"

if ! runuser -u n2usenet -- "$client_bin" add-gateway --id n2usenet --set-active -o json; then
	cp -a "$backup_dir/gateways_registrations.sqlite.before" "$gateway_db"
	chown n2usenet:n2usenet "$gateway_db"
	logger -t n2usenet-gateway-watch "gateway registration failed; previous state restored"
	exit 1
fi

chown -R n2usenet:n2usenet "$client_home/.nym"
systemctl start n2usenet-socks.service
sleep 5

if ! "$check_bin" \
	-socks 127.0.0.1:11080 \
	-smtp 51.178.55.22:587 \
	-tls-name mail.virebent.art \
	-helo n2usenet.virebent.art \
	-auth-user n2usenet@virebent.art \
	-auth-password-file /etc/n2usenet/smtp-password \
	-timeout 180s; then
	systemctl stop n2usenet-socks.service
	cp -a "$backup_dir/gateways_registrations.sqlite.before" "$gateway_db"
	chown n2usenet:n2usenet "$gateway_db"
	logger -t n2usenet-gateway-watch "new gateway failed transport verification; previous state restored"
	exit 1
fi

systemctl start n2usenet.service
trap - EXIT
logger -t n2usenet-gateway-watch "gateway renewed and transport verification passed"