#!/bin/sh
set -e

case "$1" in
    remove|deconfigure)
        # Stop offering the tunnels, but leave strongSwan itself enabled: it is
        # a shared service and may be in use by something other than this
        # package. The connection files are removed on purge.
        # The site-to-site connections are the names of site_to_site in vpn-router.json.
        if [ -d /run/systemd/system ]; then
            connections="$(python3 -c 'import json, sys; print(" ".join(json.load(open(sys.argv[1])).get("site_to_site", {})))' \
                /etc/vpn-router/vpn-router.json 2>/dev/null || true)"
            for connection in $connections; do
                swanctl --terminate --ike "$connection" >/dev/null 2>&1 || true
            done
            swanctl --terminate --ike road-warrior >/dev/null 2>&1 || true
        fi

        # vpn-router-setup enabled wg-quick@wg0, openvpn-server@vpn-router,
        # caddy and vpn-router-metrics, so the package takes them down again.
        # Use the debhelper wrappers rather than systemctl, so the script
        # behaves on a machine without systemd.
        for unit in wg-quick@wg0.service openvpn-server@vpn-router.service caddy.service vpn-router-metrics.service; do
            if command -v deb-systemd-invoke >/dev/null 2>&1; then
                deb-systemd-invoke stop "$unit" >/dev/null 2>&1 || true
            fi
            if command -v deb-systemd-helper >/dev/null 2>&1; then
                deb-systemd-helper disable "$unit" >/dev/null 2>&1 || true
            fi
        done
        ;;
esac

#DEBHELPER#