#!/bin/bash
# Link production CMS -> MAIN DB (vlan only).
#
#   bash /home/link-cms-main.sh

set -euo pipefail

# shellcheck source=/home/env/load-env.sh
source /home/env/load-env.sh "${XTREAM_ENV:-production}"
if [ "${XTREAM_ENV:-production}" = "development" ]; then
  require_cluster_deploy
else
  require_production_deploy
fi

MAIN_VLAN="${MAIN_VLAN:-$MAIN_HOST}"
CMS_ROOT="${CMS_ROOT:-/home/xtreamcodes/iptv_xtream_codes}"
MAIN_ROOT="${MAIN_ROOT:-/home/xtreamcodes/iptv_xtream_codes}"
SSH_OPTS="-o StrictHostKeyChecking=no -o ConnectTimeout=15"
XOR_KEY="5709650b0d7806074842c6de575025b1"

echo "[*] Link CMS vlan $CMS_VLAN -> MAIN DB $MAIN_VLAN:7999"

echo "[*] MAIN: CMS firewall (.cms_panel_host = vlan only)"
sshpass -p "$MAIN_SSH_PASS" ssh $SSH_OPTS "root@$MAIN_SSH_HOST" \
  "echo '$CMS_VLAN' > $MAIN_ROOT/.cms_panel_host
   python3 -c \"
import json, subprocess
allow=['127.0.0.1','::1','$CMS_VLAN']
open('/tmp/fw.json','w').write(json.dumps({'enabled':1,'port':7999,'allow':allow}))
\"
   python3 $MAIN_ROOT/pytools/sync_main_db_firewall.py /tmp/fw.json"

echo "[*] CMS: config from MAIN (host -> vlan)"
python3 - "$MAIN_SSH_HOST" "$MAIN_SSH_PASS" "$CMS_HOST" "$CMS_PASS" "$MAIN_VLAN" "$CMS_ROOT/config" <<'PY'
import sys, json, base64, subprocess, tempfile, os
from itertools import cycle

main_ssh, main_pass, cms_host, cms_pass, main_vlan, remote_path = sys.argv[1:7]
XOR_KEY = "5709650b0d7806074842c6de575025b1"

def xor_crypt(data, key):
    return "".join(chr(ord(c) ^ ord(k)) for c, k in zip(data, cycle(key)))

raw = subprocess.check_output([
    "sshpass", "-p", main_pass, "ssh", "-o", "StrictHostKeyChecking=no",
    "root@%s" % main_ssh, "cat /home/xtreamcodes/iptv_xtream_codes/config",
]).decode("ascii")
plain = json.loads(xor_crypt(base64.b64decode(raw).decode("latin-1"), XOR_KEY))
plain["host"] = main_vlan
plain["server_ip"] = main_vlan
out = base64.b64encode(xor_crypt(json.dumps(plain), XOR_KEY).encode("latin-1")).decode("ascii")
fd, tmp = tempfile.mkstemp()
os.write(fd, out.encode("ascii"))
os.close(fd)
subprocess.check_call([
    "sshpass", "-p", cms_pass, "scp", "-o", "StrictHostKeyChecking=no",
    tmp, "root@%s:%s" % (cms_host, remote_path),
])
os.unlink(tmp)
print("    config host=%s user=%s" % (main_vlan, plain.get("db_user")))
PY

sshpass -p "$CMS_PASS" ssh $SSH_OPTS "root@$CMS_HOST" \
  "python3 -c \"
import json
p='$CMS_ROOT/redis.json'
try: d=json.load(open(p))
except: d={}
d['host']='$MAIN_VLAN'
json.dump(d, open(p,'w'), indent=2)
\"
chmod 600 $CMS_ROOT/config
$CMS_ROOT/php/sbin/restart-fpm-pools.sh 2>/dev/null || true
systemctl restart nginx 2>/dev/null || true
export LD_LIBRARY_PATH=$CMS_ROOT/lib/legacy:$CMS_ROOT/lib/curl/lib:$CMS_ROOT/lib
$CMS_ROOT/php/bin/php -r \"
chdir('$CMS_ROOT/admin');
define('MAIN_DIR','$CMS_ROOT/');
define('CONFIG_CRYPT_KEY','$XOR_KEY');
function x(\\\$d,\\\$k){\\\$o='';for(\\\$i=0;\\\$i<strlen(\\\$d);\\\$i++)\\\$o.=chr(ord(\\\$d[\\\$i])^ord(\\\$k[\\\$i%strlen(\\\$k)]));return \\\$o;}
\\\$i=json_decode(x(base64_decode(file_get_contents('$CMS_ROOT/config')),CONFIG_CRYPT_KEY),true);
\\\$db=new mysqli(\\\$i['host'],\\\$i['db_user'],\\\$i['db_pass'],\\\$i['db_name'],intval(\\\$i['db_port']));
echo \\\$db->connect_error ? 'DB_FAIL '.\\\$db->connect_error : 'DB_OK';
\""

echo "[ok] CMS panel -> MAIN DB via vlan ($CMS_VLAN -> $MAIN_VLAN:7999)"