#!/bin/bash -eu
# =============================================================================
# rollback.sh — Revert to Go legacy WireGuard
# Run as Linux user (not root).
# =============================================================================
if [ "$EUID" -eq 0 ]; then
    echo "[X] Run as your Linux user, not root: bash rollback.sh"
    exit 1
fi

BACKUP_DIR="$HOME/.wg-migration"
OPERATOR_DIR="$HOME/operator-docker"
LOG="$BACKUP_DIR/migration.log"

RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'; CYAN='\033[0;36m'; RESET='\033[0m'
ok()   { echo -e "${GREEN}[OK]${RESET} $1";  echo "[OK-ROLLBACK] $1" >> "$LOG" 2>/dev/null || true; }
warn() { echo -e "${YELLOW}[!]${RESET} $1"; echo "[!-ROLLBACK] $1"  >> "$LOG" 2>/dev/null || true; }
fail() { echo -e "${RED}[X]${RESET} $1";    echo "[X-ROLLBACK] $1"  >> "$LOG" 2>/dev/null || true; exit 1; }
sep()  { echo -e "\n${CYAN}────────────────────────────────────${RESET}"; }
info() { echo -e "${CYAN}[i]${RESET} $1"; echo "[i-ROLLBACK] $1" >> "$LOG" 2>/dev/null || true; }

[ -f "$BACKUP_DIR/legacy_compose_dir" ] || fail "No backup found at $BACKUP_DIR. Cannot rollback."

LEGACY_COMPOSE_DIR=$(cat "$BACKUP_DIR/legacy_compose_dir")
[ -d "$LEGACY_COMPOSE_DIR" ] || fail "Legacy directory not found: $LEGACY_COMPOSE_DIR"

echo ""
echo "========================================="
echo "  Rollback — Restoring Go legacy"
echo "  $(date '+%Y-%m-%d %H:%M:%S')"
echo "========================================="

sudo -v || fail "sudo required."

# ─── Stop FastAPI stack ───────────────────────────────────────────────────────
sep
warn "Stopping operator-docker..."
if [ -f "$OPERATOR_DIR/docker-compose.yml" ]; then
    cd "$OPERATOR_DIR"
    docker compose down -v --rmi all --remove-orphans &>/dev/null || true
    ok "operator-docker stopped."
else
    warn "operator-docker not found — skipping."
fi

# ─── Remove certbot certs for FastAPI subdomains ──────────────────────────────
sep
warn "Removing FastAPI SSL certificates..."
if [ -f "$OPERATOR_DIR/.env" ]; then
    set -a; source "$OPERATOR_DIR/.env"; set +a
    for subdomain in "${API_SUBDOMAIN:-}" "${MARZBAN_SUBDOMAIN:-}" "${VPN_SUBDOMAIN:-}" "${HYSTERIA_SUBDOMAIN:-}"; do
        [ -z "$subdomain" ] && continue
        CERT="${subdomain}.${BASE_DOMAIN}"
        sudo certbot delete --cert-name "$CERT" --non-interactive &>/dev/null && ok "Deleted: $CERT" || warn "Not found: $CERT"
    done
else
    warn ".env not found — skipping cert deletion"
fi

# ─── Clean nginx ──────────────────────────────────────────────────────────────
sep
warn "Cleaning nginx..."
sudo rm -f /etc/nginx/sites-enabled/operator /etc/nginx/sites-available/operator /etc/nginx/mtls-ca.cert.pem

# Restore backed-up nginx configs
if [ -d "$BACKUP_DIR/nginx/sites-available" ]; then
    sudo find "$BACKUP_DIR/nginx/sites-available" -mindepth 1 -maxdepth 1 -not -type d -exec cp {} /etc/nginx/sites-available/ \;
    sudo find "$BACKUP_DIR/nginx/sites-enabled"   -mindepth 1 -maxdepth 1 -not -type d -exec cp {} /etc/nginx/sites-enabled/   \;
    ok "Nginx configs restored from backup."
fi

sudo nginx -t && sudo systemctl reload nginx 2>/dev/null && ok "Nginx reloaded." || warn "Nginx reload failed."

# ─── Restore SSL certs ────────────────────────────────────────────────────────
sep
warn "Restoring legacy SSL certificates..."
if [ -d "$BACKUP_DIR/letsencrypt" ]; then
    sudo cp -r "$BACKUP_DIR/letsencrypt/." /etc/letsencrypt/ 2>/dev/null || true
    ok "Certificates restored."
else
    warn "No certificate backup found."
fi

# ─── Remove operator-docker directory ─────────────────────────────────────────
sep
warn "Removing operator-docker directory..."
sudo rm -rf "$OPERATOR_DIR"
ok "operator-docker removed."

# ─── Start Go legacy ──────────────────────────────────────────────────────────
sep
info "Starting Go legacy stack..."
sudo modprobe ip6table_filter 2>/dev/null || true
cd "$LEGACY_COMPOSE_DIR"
docker compose up -d 2>/dev/null || true
sleep 5

LEGACY_UP=$(docker ps --format '{{.Names}}' | grep -i wireguard | head -1 || true)
[ -n "$LEGACY_UP" ] && ok "Legacy WireGuard running: $LEGACY_UP" || \
    warn "Legacy may not have started. Check: docker ps"

echo ""
echo "========================================="
echo "  Rollback complete"
echo "  Legacy stack: $LEGACY_COMPOSE_DIR"
echo "  Log: cat $LOG"
echo "========================================="

# ─── Delete migration backup ──────────────────────────────────────────────────
ok "Migration backup deleted."
rm -rf "$BACKUP_DIR"