#!/bin/sh
set -e
. /usr/share/debconf/confmodule

# The answer to a question in ANSWER, or "" when the question has not been seen; the
# default debconf holds for an unseen question is not an answer.
answer() {
    ANSWER=""
    db_fget "$1" seen
    if [ "$RET" = "true" ]; then
        db_get "$1"
        ANSWER="$RET"
    fi
}

case "$1" in
    configure)
        # --- Read the installer's answers ---
        answer vpn-router/platform;         VPN_ROUTER_PLATFORM="$ANSWER"
        answer vpn-router/mode;             VPN_ROUTER_MODE="$ANSWER"
        answer vpn-router/int_addr;         VPN_ROUTER_INT_ADDR="$ANSWER"
        answer vpn-router/external_interface; VPN_ROUTER_EXTERNAL_INTERFACE="$ANSWER"
        answer vpn-router/internal_interface; VPN_ROUTER_INTERNAL_INTERFACE="$ANSWER"
        answer vpn-router/local_fqdn;       VPN_ROUTER_LOCAL_FQDN="$ANSWER"
        answer vpn-router/local_id_mode;    VPN_ROUTER_LOCAL_ID_MODE="$ANSWER"
        answer vpn-router/local_cidrs;      VPN_ROUTER_LOCAL_CIDRS="$ANSWER"
        answer vpn-router/int_gateway_ip;   VPN_ROUTER_INT_GATEWAY_IP="$ANSWER"
        answer vpn-router/remote_addrs;     VPN_ROUTER_REMOTE_ADDRS="$ANSWER"
        answer vpn-router/remote_id;        VPN_ROUTER_REMOTE_ID="$ANSWER"
        answer vpn-router/remote_cidrs;     VPN_ROUTER_REMOTE_CIDRS="$ANSWER"
        answer vpn-router/psk;              VPN_ROUTER_PSK="$ANSWER"
        answer vpn-router/p2s_enabled;      VPN_ROUTER_P2S_ENABLED="$ANSWER"
        answer vpn-router/p2s_address_pool; VPN_ROUTER_P2S_ADDRESS_POOL="$ANSWER"
        answer vpn-router/p2s_ca_name;      VPN_ROUTER_P2S_CA_NAME="$ANSWER"
        answer vpn-router/wg_enabled;       VPN_ROUTER_WG_ENABLED="$ANSWER"
        answer vpn-router/wg_address;       VPN_ROUTER_WG_ADDRESS="$ANSWER"
        answer vpn-router/wg_listen_port;   VPN_ROUTER_WG_LISTEN_PORT="$ANSWER"

        export VPN_ROUTER_PLATFORM VPN_ROUTER_MODE VPN_ROUTER_INT_ADDR \
               VPN_ROUTER_EXTERNAL_INTERFACE \
               VPN_ROUTER_INTERNAL_INTERFACE VPN_ROUTER_LOCAL_FQDN \
               VPN_ROUTER_LOCAL_ID_MODE VPN_ROUTER_LOCAL_CIDRS \
               VPN_ROUTER_INT_GATEWAY_IP \
               VPN_ROUTER_REMOTE_ADDRS VPN_ROUTER_REMOTE_ID \
               VPN_ROUTER_REMOTE_CIDRS VPN_ROUTER_PSK \
               VPN_ROUTER_P2S_ENABLED VPN_ROUTER_P2S_ADDRESS_POOL \
               VPN_ROUTER_P2S_CA_NAME VPN_ROUTER_WG_ENABLED \
               VPN_ROUTER_WG_ADDRESS VPN_ROUTER_WG_LISTEN_PORT

        # --- Hand a candidate configuration to ucf ---
        # ucf compares it against the file in /etc and decides what to do about
        # local changes, prompting through debconf only for a real conflict.
        # This is what makes dpkg-reconfigure apply without destroying edits.
        CANDIDATE="$(mktemp)"
        /usr/lib/vpn-router/generate-config "$CANDIDATE"
        ucf --three-way --debconf-ok "$CANDIDATE" /etc/vpn-router/vpn-router.json
        ucfr vpn-router /etc/vpn-router/vpn-router.json
        chmod 0600 /etc/vpn-router/vpn-router.json
        rm -f "$CANDIDATE"

        # The key now lives in the configuration file; do not keep a copy. An
        # empty answer means "leave alone" next time, so clearing it here does
        # not blank the key on the next dpkg-reconfigure.
        db_set vpn-router/psk ""

        # Apply the sysctl drop-in shipped by this package so it takes effect
        # without waiting for a reboot.
        sysctl --system >/dev/null

        # The firewall is not touched here. Enabling it, allowing SSH and
        # setting the forward policy all belong to vpn-router-setup, which does
        # them only once the configuration says this host is a router.

        # The web service waits for libpq in the linker cache, which dpkg
        # refreshes after this script, so it is started without waiting for it.
        if [ -d /run/systemd/system ]; then
            systemctl --no-block restart vpn-router-web.service >/dev/null 2>&1 || true
        fi
        ;;
esac

#DEBHELPER#

db_stop