#!/bin/bash
# ==============================================================================
# 04-start-fips.sh
#
# Start a single FIPS node in sys-fips, wait for fips0, and set route.
#
# Usage:
#   sudo bash 04-start-fips.sh
# ==============================================================================
set -euo pipefail

CONFIG_FILE="/etc/fips/fips.yaml"
ENV_FILE="/etc/fips/node.env"

echo "=== Starting FIPS (single node) ==="
echo ""

if [ "$(id -u)" -ne 0 ]; then
    echo "✗ This script must be run as root (sudo)"
    exit 1
fi

if [ ! -f "$CONFIG_FILE" ]; then
    echo "✗ $CONFIG_FILE not found"
    echo "  Run: sudo bash 02-install-fips.sh"
    exit 1
fi

sysctl -w net.ipv6.conf.all.disable_ipv6=0 >/dev/null 2>&1 || true
sysctl -w net.ipv6.conf.all.forwarding=1 >/dev/null 2>&1 || true
echo "✓ IPv6 + forwarding enabled"

systemctl daemon-reload
systemctl restart fips
sleep 1

if ! systemctl is-active --quiet fips; then
    echo "✗ fips service is not active"
    echo "  Check: journalctl -u fips -n 100 --no-pager"
    exit 1
fi

echo "✓ fips service active"

echo "Waiting for fips0..."
for i in $(seq 1 30); do
    if ip link show fips0 >/dev/null 2>&1; then
        break
    fi
    sleep 1
done

if ! ip link show fips0 >/dev/null 2>&1; then
    echo "✗ fips0 did not appear within 30s"
    echo "  Check: journalctl -u fips -n 100 --no-pager"
    exit 1
fi

IPV6=$(ip -6 addr show fips0 scope global 2>/dev/null | awk '/inet6/{print $2}' | cut -d/ -f1 | head -1)
NPUB=""

if [ -f /etc/fips/fips.pub ]; then
    NPUB=$(cat /etc/fips/fips.pub)
elif command -v fipsctl >/dev/null 2>&1; then
    NPUB=$(fipsctl show status 2>/dev/null | python3 -c 'import json,sys; print(json.load(sys.stdin).get("npub",""))' 2>/dev/null || true)
fi

ip -6 route replace fd00::/8 dev fips0 2>/dev/null || true

cat > "$ENV_FILE" << EOF
NPUB=${NPUB}
IPV6=${IPV6}
EOF

echo ""
echo "✓ fips0 is up"
echo "  npub: ${NPUB:-unknown}"
echo "  ipv6: ${IPV6:-unknown}"
echo "  route: fd00::/8 -> fips0"
echo ""
echo "Next: sudo bash 06-configure-dns.sh"