#!/bin/sh
# SPDX-License-Identifier: Apache-2.0

CONFIG_FILE="/etc/config/isecurity"
BIN_CONFIG_FILE="/etc/config/isecurity_bin"
DEFAULTS_TEMPLATE="/usr/share/isecurityvpn-luci/defaults/isecurity.uci"
TAG="isecurityvpn-luci"

MISSING_FILLED=0

if [ ! -f "$CONFIG_FILE" ]; then
	cp "$DEFAULTS_TEMPLATE" "$CONFIG_FILE"
	logger -t "$TAG" "installed default configuration from $DEFAULTS_TEMPLATE"
fi

_set_if_missing() {
	field="$1"
	default="$2"
	if ! uci -q get "isecurity.settings.$field" > /dev/null 2>&1; then
		if uci -q set "isecurity.settings.$field=$default"; then
			MISSING_FILLED=1
		else
			logger -t "$TAG" "failed to set isecurity.settings.$field"
		fi
	fi
}

_runtime_set_if_missing() {
	if ! uci -q get "isecurity.runtime.$1" > /dev/null 2>&1; then
		MISSING_FILLED=1
		uci -q set "isecurity.runtime.$1=" || true
	fi
}

if ! uci -q get isecurity.settings > /dev/null 2>&1; then
	if uci -q set isecurity.settings=isecurity; then
		MISSING_FILLED=1
	else
		logger -t "$TAG" "failed to create isecurity.settings section"
	fi
fi

_set_if_missing service_enabled 1
_set_if_missing wireguard_port 51820
_set_if_missing interface_name wt0
_set_if_missing hostname ''
_set_if_missing management_url ''
_set_if_missing enable_firewall 1
_set_if_missing block_inbound 0
_set_if_missing allow_ssh 0
_set_if_missing ssh_root 0
_set_if_missing ssh_sftp 0
_set_if_missing ssh_remote_fwd 0
_set_if_missing ssh_local_fwd 0
_set_if_missing enable_ssh_auth 1
_set_if_missing enable_dns 0
_set_if_missing access_lan 1
_set_if_missing accept_client_routes 1
_set_if_missing accept_server_routes 1
_set_if_missing enable_ipv6 1
_set_if_missing rosenpass_enabled 0
_set_if_missing rosenpass_permissive 0
_set_if_missing log_level info
_set_if_missing preshared_key ''
_set_if_missing setup_key_hint ''
_set_if_missing exit_node ''

if ! uci -q get isecurity.runtime > /dev/null 2>&1; then
	MISSING_FILLED=1
	uci -q add isecurity state > /dev/null 2>&1 || true
	uci -q rename isecurity.@state[-1]=runtime 2>/dev/null || \
		uci -q set isecurity.runtime=state 2>/dev/null || true
	uci -q set isecurity.runtime.last_connect_ts='' || true
	uci -q set isecurity.runtime.last_error='' || true
	uci -q set isecurity.runtime.desired_connected='' || true
else
	_runtime_set_if_missing last_connect_ts
	_runtime_set_if_missing last_error
	_runtime_set_if_missing desired_connected
fi

if [ "$MISSING_FILLED" = "1" ]; then
	uci -q commit isecurity || logger -t "$TAG" "uci commit isecurity failed"
fi

if [ "$(uci -q get firewall.isecurity 2>/dev/null)" = "zone" ]; then
	uci -q set firewall.isecurity.name=isecurity 2>/dev/null
	uci -q commit firewall 2>/dev/null
	/etc/init.d/firewall reload >/dev/null 2>&1
fi

grep -qxF '/etc/config/isecurity' /etc/sysupgrade.conf 2>/dev/null || \
	echo '/etc/config/isecurity' >> /etc/sysupgrade.conf
grep -qxF '/etc/config/isecurity_bin' /etc/sysupgrade.conf 2>/dev/null || \
	echo '/etc/config/isecurity_bin' >> /etc/sysupgrade.conf
grep -qxF '/etc/isecurity/' /etc/sysupgrade.conf 2>/dev/null || \
	echo '/etc/isecurity/' >> /etc/sysupgrade.conf
grep -qxF '/var/lib/isecurity/' /etc/sysupgrade.conf 2>/dev/null || \
	echo '/var/lib/isecurity/' >> /etc/sysupgrade.conf
grep -qxF '/usr/share/isecurity/' /etc/sysupgrade.conf 2>/dev/null || \
	echo '/usr/share/isecurity/' >> /etc/sysupgrade.conf

chmod 0600 "$CONFIG_FILE"

ENV_FILE=/etc/isecurity.env
[ -f "$ENV_FILE" ] || : > "$ENV_FILE"
grep -qxF 'ISEC_LOG_FILE=syslog' "$ENV_FILE" || echo 'ISEC_LOG_FILE=syslog' >> "$ENV_FILE"
chmod 0644 "$ENV_FILE"

if [ -f /etc/init.d/isecurity-settings ]; then
	chmod 0755 /etc/init.d/isecurity-settings
	/etc/init.d/isecurity-settings enable 2>/dev/null || \
		logger -t "$TAG" "isecurity-settings enable failed"
fi

if [ -f /etc/init.d/luci-isecurity-watchdog ]; then
	chmod 0755 /etc/init.d/luci-isecurity-watchdog
	[ -f /usr/share/isecurity/isecurity-autoreconnect.sh ] && \
		chmod 0755 /usr/share/isecurity/isecurity-autoreconnect.sh
	/etc/init.d/luci-isecurity-watchdog enable 2>/dev/null || \
		logger -t "$TAG" "luci-isecurity-watchdog enable failed"
	/etc/init.d/luci-isecurity-watchdog start 2>/dev/null || \
		logger -t "$TAG" "luci-isecurity-watchdog start failed"
fi

REL_DIR=/usr/share/isecurity/bin
REL_BIN="$REL_DIR/isecurity-release"
OPKG_BIN=/usr/bin/isecurity
OPKG_BAK="$REL_DIR/isecurity-opkg"
mkdir -p "$REL_DIR"

if [ ! -L "$OPKG_BIN" ] && [ -x "$OPKG_BIN" ]; then
	CUR_VER=$("$OPKG_BIN" version 2>/dev/null | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -1)
	if [ -x /usr/bin/apk ]; then
		PM_VER=$(apk list -I isecurity 2>/dev/null | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -1)
	else
		PM_VER=$(opkg list-installed isecurity 2>/dev/null | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -1)
	fi
	if [ -n "$CUR_VER" ] && [ -n "$PM_VER" ] && [ "$CUR_VER" = "$PM_VER" ]; then
		if [ ! -e "$OPKG_BAK" ]; then
			cat "$OPKG_BIN" > "$OPKG_BAK" 2>/dev/null && chmod 0755 "$OPKG_BAK"
			logger -t "$TAG" "preserved feed binary $CUR_VER as isecurity-opkg"
		fi
		uci -q set isecurity_bin.binary=isecurity_bin 2>/dev/null
		uci -q set isecurity_bin.binary.binary_source=opkg 2>/dev/null
		uci -q commit isecurity_bin 2>/dev/null
	elif [ -n "$CUR_VER" ] && [ -n "$PM_VER" ] && [ "$CUR_VER" != "$PM_VER" ] && [ ! -e "$REL_BIN" ]; then
		if cat "$OPKG_BIN" > "$REL_BIN" 2>/dev/null && chmod 0755 "$REL_BIN"; then
			ln -sf "$REL_BIN" "$OPKG_BIN.tmp" && mv -f "$OPKG_BIN.tmp" "$OPKG_BIN"
			uci -q set isecurity_bin.binary=isecurity_bin 2>/dev/null
			uci -q set isecurity_bin.binary.binary_source=release 2>/dev/null
			uci -q commit isecurity_bin 2>/dev/null
			logger -t "$TAG" "adopted /usr/bin/isecurity $CUR_VER as release source"
		fi
	fi
fi

exit 0
