#!/usr/bin/env bash
set -Eeuo pipefail

IMAGE=mike-ai/wireguard-gateway:local

proxy_names=(
  mike-ai-emergency-openwebui
  mike-ai-emergency-mcp-web
  mike-ai-emergency-mcp-homeassistant
  mike-ai-emergency-mcp-arr
  mike-ai-emergency-mcp-unraid
)

remove_proxies() {
  docker rm -f "${proxy_names[@]}" >/dev/null 2>&1 || true
}

start_proxy() {
  local name=$1 network=$2 host_port=$3 target=$4
  docker container inspect "$target" >/dev/null 2>&1 || {
    printf 'Übersprungen (Ziel fehlt): %s\n' "$target" >&2
    return 0
  }
  docker start "$target" >/dev/null 2>&1 || true
  [ "$(docker inspect -f '{{.State.Running}}' "$target" 2>/dev/null || true)" = true ] || {
    printf 'Übersprungen (Ziel startet nicht): %s\n' "$target" >&2
    return 0
  }
  docker run --detach --rm --pull never \
    --name "$name" \
    --network mike-ai_frontend \
    --publish "127.0.0.1:${host_port}:${host_port}" \
    --read-only --cap-drop ALL --pids-limit 64 --memory 64m \
    --security-opt no-new-privileges:true \
    --entrypoint socat "$IMAGE" \
    "TCP-LISTEN:${host_port},bind=0.0.0.0,reuseaddr,fork" \
    "TCP:${target}:8000" >/dev/null
  # Docker deliberately discards published ports on an internal-only network.
  # The proxy therefore publishes through frontend and receives the tools
  # network as a second, non-egress attachment for target discovery.
  docker network connect "$network" "$name"
}

case "${1:-}" in
  start)
    remove_proxies
    docker image inspect "$IMAGE" >/dev/null

    docker start mike-ai-router mike-ai-open-webui >/dev/null 2>&1 || true
    docker run --detach --rm --pull never \
      --name mike-ai-emergency-openwebui \
      --network mike-ai_frontend \
      --publish 127.0.0.1:18080:18080 \
      --read-only --cap-drop ALL --pids-limit 64 --memory 64m \
      --security-opt no-new-privileges:true \
      --entrypoint socat "$IMAGE" \
      TCP-LISTEN:18080,bind=0.0.0.0,reuseaddr,fork \
      TCP:mike-ai-open-webui:8080 >/dev/null

    start_proxy mike-ai-emergency-mcp-web mike-ai-tools 18090 mike-ai-mcp-web
    start_proxy mike-ai-emergency-mcp-homeassistant mike-ai-tools 18091 mike-ai-mcp-homeassistant
    start_proxy mike-ai-emergency-mcp-arr mike-ai-tools 18092 mike-ai-mcp-arr
    start_proxy mike-ai-emergency-mcp-unraid mike-ai-tools 18093 mike-ai-mcp-unraid-official

    echo 'Notfall-Proxys laufen ausschließlich auf 127.0.0.1.'
    echo 'Jetzt vom Client einen SSH-Tunnel auf die Ports 18080 und 18090-18093 öffnen.'
    ;;
  stop)
    remove_proxies
    echo 'Notfall-Proxys entfernt.'
    ;;
  status)
    docker ps --filter 'name=mike-ai-emergency-' \
      --format 'table {{.Names}}\t{{.Ports}}\t{{.Status}}'
    ;;
  *)
    echo "Aufruf: $0 start|stop|status" >&2
    exit 2
    ;;
esac