#!/usr/bin/env bash
# Add dedicated mail IPv6 on koopa eno1 (not Tor SLAAC).
# Addr: 2a02:168:53a8::25/64  (hernani-dns KOOPA_WAN_AAAA)
# Keeps ipv6.method=auto so SLAAC (Tor) stays. Adds one static address.
# Freigabe: human this session. Run on koopa as root / sudo.
# Live: ip -6 addr add; persist: nmcli connection modify +ipv6.addresses
set -euo pipefail

IFACE="${IFACE:-eno1}"
ADDR="${MAIL_V6_ADDR:-2a02:168:53a8::25}"
PREFIX="${MAIL_V6_PREFIX:-64}"
CIDR="${ADDR}/${PREFIX}"
CON="${NM_CON:-}"

if [[ ${EUID:-$(id -u)} -ne 0 ]]; then
  echo "STATUS=need_root HINT='sudo $0'"
  exit 2
fi

echo "STATUS=start HOST=$(hostname -s) IFACE=$IFACE CIDR=$CIDR"

if ! ip link show "$IFACE" >/dev/null 2>&1; then
  echo "STATUS=no_iface IFACE=$IFACE"
  exit 3
fi

# Resolve NM connection for IFACE if not set
if [[ -z "$CON" ]]; then
  CON=$(nmcli -g NAME,DEVICE con show --active 2>/dev/null \
    | awk -F: -v d="$IFACE" '$2==d {print $1; exit}')
  if [[ -z "$CON" ]]; then
    CON=$(nmcli -g NAME,DEVICE con show 2>/dev/null \
      | awk -F: -v d="$IFACE" '$2==d {print $1; exit}')
  fi
fi
if [[ -z "$CON" ]]; then
  CON="$IFACE"
fi
echo "NM_CON=$CON"

# Idempotent live address
if ip -6 addr show dev "$IFACE" | grep -qE "inet6[[:space:]]+${ADDR}/"; then
  echo "LIVE=present ADDR=$ADDR"
  LIVE_ADDED=0
else
  ip -6 addr add "$CIDR" dev "$IFACE"
  echo "LIVE=added ADDR=$CIDR"
  LIVE_ADDED=1
fi

# Persist via NetworkManager (append; do not replace method=auto)
EXISTING=$(nmcli -g ipv6.addresses con show "$CON" 2>/dev/null || true)
if echo "$EXISTING" | grep -qF "$ADDR"; then
  echo "NM=present ADDR=$ADDR"
  NM_ADDED=0
else
  nmcli con mod "$CON" +ipv6.addresses "$CIDR"
  echo "NM=added ADDR=$CIDR"
  NM_ADDED=1
  # Apply without full down/up if possible
  if nmcli con up "$CON" >/dev/null 2>&1; then
    echo "NM=reapplied CON=$CON"
  else
    echo "NM=reapply_warn HINT='nmcli con up $CON' (addr already live)"
  fi
fi

# Verify
if ip -6 addr show dev "$IFACE" | grep -qE "inet6[[:space:]]+${ADDR}/"; then
  echo "VERIFY=ok ADDR=$ADDR"
  echo "STATUS=done LIVE_ADDED=$LIVE_ADDED NM_ADDED=$NM_ADDED CIDR=$CIDR"
  # Show Tor SLAAC still present (informational)
  if ip -6 addr show dev "$IFACE" | grep -q '2a02:168:53a8:0:d584:9e34:13cf:15d6'; then
    echo "TOR_SLAAC=present"
  else
    echo "TOR_SLAAC=absent_or_changed HINT=ok_if_privacy_temp_rotated"
  fi
  exit 0
fi

echo "STATUS=verify_fail ADDR=$ADDR"
ip -6 addr show dev "$IFACE" || true
exit 1