#!/bin/sh
set -e
. /usr/share/debconf/confmodule

case "$1" in
    configure)
        # --- Read the installer's answers ---
        db_get vpn-router/platform;         VPN_ROUTER_PLATFORM="$RET"
        db_get vpn-router/mode;             VPN_ROUTER_MODE="$RET"
        db_get vpn-router/int_addr;         VPN_ROUTER_INT_ADDR="$RET"
        db_get vpn-router/external_interface; VPN_ROUTER_EXTERNAL_INTERFACE="$RET"
        db_get vpn-router/internal_interface; VPN_ROUTER_INTERNAL_INTERFACE="$RET"
        db_get vpn-router/local_fqdn;       VPN_ROUTER_LOCAL_FQDN="$RET"
        db_get vpn-router/local_id_mode;    VPN_ROUTER_LOCAL_ID_MODE="$RET"
        db_get vpn-router/local_cidrs;      VPN_ROUTER_LOCAL_CIDRS="$RET"
        db_get vpn-router/int_gateway_ip;   VPN_ROUTER_INT_GATEWAY_IP="$RET"
        db_get vpn-router/remote_addrs;     VPN_ROUTER_REMOTE_ADDRS="$RET"
        db_get vpn-router/remote_id;        VPN_ROUTER_REMOTE_ID="$RET"
        db_get vpn-router/remote_cidrs;     VPN_ROUTER_REMOTE_CIDRS="$RET"
        db_get vpn-router/psk;              VPN_ROUTER_PSK="$RET"
        db_get vpn-router/p2s_enabled;      VPN_ROUTER_P2S_ENABLED="$RET"
        db_get vpn-router/p2s_address_pool; VPN_ROUTER_P2S_ADDRESS_POOL="$RET"
        db_get vpn-router/p2s_ca_name;      VPN_ROUTER_P2S_CA_NAME="$RET"
        db_get vpn-router/wg_enabled;       VPN_ROUTER_WG_ENABLED="$RET"
        db_get vpn-router/wg_address;       VPN_ROUTER_WG_ADDRESS="$RET"
        db_get vpn-router/wg_listen_port;   VPN_ROUTER_WG_LISTEN_PORT="$RET"

        export VPN_ROUTER_PLATFORM VPN_ROUTER_MODE VPN_ROUTER_INT_ADDR \
               VPN_ROUTER_EXTERNAL_INTERFACE \
               VPN_ROUTER_INTERNAL_INTERFACE VPN_ROUTER_LOCAL_FQDN \
               VPN_ROUTER_LOCAL_ID_MODE VPN_ROUTER_LOCAL_CIDRS \
               VPN_ROUTER_INT_GATEWAY_IP \
               VPN_ROUTER_REMOTE_ADDRS VPN_ROUTER_REMOTE_ID \
               VPN_ROUTER_REMOTE_CIDRS VPN_ROUTER_PSK \
               VPN_ROUTER_P2S_ENABLED VPN_ROUTER_P2S_ADDRESS_POOL \
               VPN_ROUTER_P2S_CA_NAME VPN_ROUTER_WG_ENABLED \
               VPN_ROUTER_WG_ADDRESS VPN_ROUTER_WG_LISTEN_PORT

        # --- Hand a candidate configuration to ucf ---
        # ucf compares it against the file in /etc and decides what to do about
        # local changes, prompting through debconf only for a real conflict.
        # This is what makes dpkg-reconfigure apply without destroying edits.
        CANDIDATE="$(mktemp)"
        /usr/lib/vpn-router/generate-config "$CANDIDATE"
        ucf --three-way --debconf-ok "$CANDIDATE" /etc/vpn-router/vpn-router.conf
        ucfr vpn-router /etc/vpn-router/vpn-router.conf
        chmod 0600 /etc/vpn-router/vpn-router.conf
        rm -f "$CANDIDATE"

        # The key now lives in the configuration file; do not keep a copy. An
        # empty answer means "leave alone" next time, so clearing it here does
        # not blank the key on the next dpkg-reconfigure.
        db_set vpn-router/psk ""

        # Apply the sysctl drop-in shipped by this package so it takes effect
        # without waiting for a reboot.
        sysctl --system >/dev/null

        # The firewall is not touched here. Enabling it, allowing SSH and
        # setting the forward policy all belong to vpn-router-setup, which does
        # them only once the configuration says this host is a router.
        ;;
esac

#DEBHELPER#

db_stop