menu

#!/bin/bash
# NESS Hub Menu v2.1 - Podman/Docker Stack Manager
# Checkpoint: 2026-04-07 - Mobile-ready, service tiers, individual controls

SCRIPT_DIR="$(cd "$(dirname "$0")" 2>/dev/null && pwd || echo ".")"
cd "$SCRIPT_DIR" 2>/dev/null || true

VERSION="v2.1"

# Auto-detect container engine
if command -v podman-compose &>/dev/null && podman info &>/dev/null 2>&1; then
    # Prefer podman-compose to avoid podman compose delegating to docker-compose
    ENGINE="podman-compose"
    RUNTIME="podman"
elif command -v podman &>/dev/null && podman info &>/dev/null 2>&1 && podman compose version &>/dev/null 2>&1; then
    ENGINE="podman compose"
    RUNTIME="podman"
elif command -v docker-compose &>/dev/null && docker info &>/dev/null 2>&1; then
    ENGINE="docker-compose"
    RUNTIME="docker"
elif command -v docker &>/dev/null && docker info &>/dev/null 2>&1; then
    ENGINE="docker compose"
    RUNTIME="docker"
else
    echo "Warning: No container engine detected (podman or docker)"
    ENGINE="podman compose"
    RUNTIME="podman"
fi

RESEED_INTERVAL="${RESEED_INTERVAL:-}"
PROFILE="${PROFILE:-pi3}"
SSH_GATEWAY_PORT="${SSH_GATEWAY_PORT:-2222}"
PYUHEPRNG_PORT="${PYUHEPRNG_PORT:-5550}"

# Colors
R=$'\033[0m'
G=$'\033[32m'
Y=$'\033[33m'
C=$'\033[36m'
B=$'\033[1m'

# Service Tiers
TIER0="lbrtynet softether-vpn"                                        # Layer-0: network substrate
TIER1="emercoin-core privateness skywire pyuheprng-privatenesstools ssh-gateway"  # Always run
TIER2="yggdrasil i2p-yggdrasil"                                       # Secondary
TIER3="dns-reverse-proxy"                                             # Third

check_status() {
    if $RUNTIME ps --filter "name=$1" --format '{{.Status}}' 2>/dev/null | grep -q "Up"; then
        echo "${G}●${R}"
    else
        echo "${Y}○${R}"
    fi
}

check_status_simple() {
    local name="$1"
    local status
    status=$($RUNTIME ps --filter "name=^${name}$" --format '{{.Status}}' 2>/dev/null | head -1)
    [ -z "$status" ] && status=$($RUNTIME ps -a --filter "name=^${name}$" --format '{{.Status}}' 2>/dev/null | head -1)

    if echo "$status" | grep -qi "up"; then
        echo "up"
    elif echo "$status" | grep -qi "created"; then
        echo "created"
    elif [ -n "$status" ]; then
        echo "stopped"
    else
        echo "missing"
    fi
}

is_port_in_use() {
    local port="$1"
    if command -v ss >/dev/null 2>&1; then
        ss -tuln 2>/dev/null | grep -q ":${port} "
    elif command -v netstat >/dev/null 2>&1; then
        netstat -tuln 2>/dev/null | grep -q ":${port} "
    else
        (echo > /dev/tcp/127.0.0.1/$port) 2>/dev/null
    fi
}

get_container_using_port() {
    local port="$1"
    $RUNTIME ps --format "{{.Names}}" --filter "publish=${port}" 2>/dev/null | head -1
}

smart_start() {
    local svc="$1"
    local port="${2:-}"

    local status
    status=$(check_status_simple "$svc")
    if [ "$status" = "up" ]; then
        echo "      ${G}✓${R} $svc already running"
        return 0
    fi

    if [ -n "$port" ] && is_port_in_use "$port"; then
        local existing
        existing=$(get_container_using_port "$port")
        if [ -n "$existing" ] && [ "$existing" != "$svc" ]; then
            echo "      ${Y}⚠${R} Port $port already in use by $existing, using existing"
            return 0
        elif [ -z "$existing" ]; then
            echo "      ${Y}⚠${R} Port $port already in use by an existing listener, keeping existing"
            return 0
        fi
    fi

    echo "      → Starting $svc..."
    local output
    output=$($ENGINE up -d --no-deps "$svc" 2>&1)
    local rc=$?
    if [ $rc -eq 0 ]; then
        echo "      ${G}✓${R} $svc started"
        return 0
    fi

    if echo "$output" | grep -qi "address already in use"; then
        local existing
        existing=""
        [ -n "$port" ] && existing=$(get_container_using_port "$port")
        if [ -n "$existing" ]; then
            echo "      ${Y}⚠${R} address already in use on $port by $existing, using existing"
        else
            echo "      ${Y}⚠${R} address already in use, keeping existing listener"
        fi
        return 0
    fi

    echo "$output" | tail -8
    echo "      ${Y}✗${R} $svc failed to start"
    return 1
}

ensure_key_dir() {
    local dir="$1"
    [ -z "$dir" ] && return 0
    mkdir -p "$dir" 2>/dev/null || true
}

generate_ssh_admin_env() {
    local env_file="${SCRIPT_DIR}/.ssh-admin.env"
    if [ -s "$env_file" ]; then
        return 0
    fi

    local password
    if command -v openssl >/dev/null 2>&1; then
        password=$(openssl rand -base64 18 | tr -d '\n')
    else
        password=$(head -c 24 /dev/urandom | base64 | tr -d '\n')
    fi

    cat >"$env_file" <<EOF
PASSWORD=${password}
USER_NAME=root
EOF

    local key_dir linux_key_file win_key_file
    key_dir="${HOME:-/root}/.privateness-keys"
    ensure_key_dir "$key_dir"
    linux_key_file="${key_dir}/ssh-gateway-admin.txt"
    cat >"$linux_key_file" <<EOF
username=root
password=${password}
generated_at=$(date -Iseconds)
port=${SSH_GATEWAY_PORT}
EOF
    chmod 600 "$linux_key_file" 2>/dev/null || true

    if [ -n "${USERPROFILE:-}" ]; then
        local win_dir="${USERPROFILE}\\.privateness-keys"
        ensure_key_dir "$win_dir"
        win_key_file="${win_dir}\\ssh-gateway-admin.txt"
        printf "username=root\npassword=%s\nport=%s\n" "$password" "$SSH_GATEWAY_PORT" > "$win_key_file" 2>/dev/null || true
    fi

    echo "${G}✓ Generated SSH admin credentials (stored in .ssh-admin.env and ~/.privateness-keys)${R}"
}

apply_firewall_rules() {
    if [ "${ENABLE_FIREWALL:-true}" != "true" ]; then
        return 0
    fi
    if ! command -v iptables >/dev/null 2>&1; then
        echo "${Y}Firewall skipped (iptables not available)${R}"
        return 0
    fi

    local chain="NESS_STACK"
    iptables -N "$chain" 2>/dev/null || iptables -F "$chain"
    iptables -A "$chain" -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
    iptables -A "$chain" -i lo -j ACCEPT
    iptables -A "$chain" -p tcp --dport "$SSH_GATEWAY_PORT" -j ACCEPT
    iptables -A "$chain" -p tcp --dport "${SKYWIRE_PORT:-8000}" -j ACCEPT
    iptables -A "$chain" -p tcp --dport 80 -j ACCEPT
    iptables -A "$chain" -p tcp --dport 443 -j ACCEPT
    iptables -A "$chain" -j DROP

    iptables -D INPUT -j "$chain" 2>/dev/null || true
    iptables -I INPUT 1 -j "$chain"
    echo "${G}✓ Firewall applied: only SSH gateway + dashboards open${R}"
}

remove_firewall_rules() {
    if ! command -v iptables >/dev/null 2>&1; then
        return 0
    fi
    local chain="NESS_STACK"
    iptables -D INPUT -j "$chain" 2>/dev/null || true
    iptables -F "$chain" 2>/dev/null || true
    iptables -X "$chain" 2>/dev/null || true
}

show_menu() {
    clear
    echo "${B}${C}╔══════════════════════════════════════╗${R}"
    echo "${B}${C}║${R}     ${B}NESS Hub Menu ${VERSION}${R}           ${C}║${R}"
    echo "${B}${C}╠══════════════════════════════════════╣${R}"
    printf "${C}║${R}  Profile: ${B}%-10s${R} Engine: ${B}%-5s${R} ${C}║${R}\n" "$PROFILE" "$RUNTIME"
    
    # Show reseed status
    if [ -n "$RESEED_INTERVAL" ]; then
        printf "${C}║${R}  Reseed: ${B}%-3s${R}s (enabled)         ${C}║${R}\n" "$RESEED_INTERVAL"
    else
        printf "${C}║${R}  Reseed: disabled (opt:11)         ${C}║${R}\n"
    fi
    echo "${B}${C}╚══════════════════════════════════════╝${R}"
    echo
    
    echo "  ${B}Tier 0 (Network substrate):${R}"
    for svc in $TIER0; do
        printf "  %s %-25s\n" "$(check_status $svc)" "$svc"
    done
    echo
    echo "  ${B}Tier 1 (Always):${R}"
    for svc in $TIER1; do
        printf "  %s %-25s\n" "$(check_status $svc)" "$svc"
    done
    echo
    
    if [ "$PROFILE" = "full" ]; then
        echo "${B}Tier 2 (optional overlay routes):${R}"
        for svc in $TIER2; do
            printf "  %s %-25s\n" "$(check_status $svc)" "$svc"
        done
        echo
        echo "${B}Tier 3:${R}"
        for svc in $TIER3; do
            printf "  %s %-25s\n" "$(check_status $svc)" "$svc"
        done
        echo
    fi
    
    echo "  ${B}[1]${R} Start All     [6] ${B}Health Check${R}"
    echo "  ${B}[2]${R} Stop All      [7] ${B}Update Images${R}"
    echo "  ${B}[3]${R} Restart All   [8] ${B}Clean System${R}"
    echo "  ${B}[4]${R} View Status   [9] ${B}Set Profile${R}"
    echo "  ${B}[5]${R} View Logs     [10] ${B}Build Tools${R}"
    echo "  ${B}[11]${R} Set Reseed   [12] ${B}Per-Container${R}"
    echo "  ${B}[0]${R} Exit"
    echo
}

cleanup() {
    for svc in lbrtynet softether-vpn emercoin-core privateness skywire dns-reverse-proxy pyuheprng-privatenesstools ssh-gateway yggdrasil i2p-yggdrasil; do
        $RUNTIME stop $svc &>/dev/null || true
        $RUNTIME rm -f $svc &>/dev/null || true
    done
    $ENGINE down &>/dev/null || true
}

container_menu() {
    while true; do
        clear
        echo "${B}${C}=== Individual Container Control ===${R}"
        echo
        
        local i=1
        for svc in $TIER0 $TIER1 $TIER2 $TIER3; do
            local status="$($RUNTIME ps --filter "name=$svc" --format '{{.Status}}' 2>/dev/null | head -1)"
            [ -z "$status" ] && status="stopped"
            printf "  ${B}[%d]${R} %-25s %s\n" "$i" "$svc" "$status"
            i=$((i+1))
        done
        echo
        echo "  ${B}[s]${R} Start selected  [S] Stop selected"
        echo "  ${B}[r]${R} Restart selected  [c] Cleanup selected"
        echo "  ${B}[l]${R} Logs selected     [0] Back"
        echo
        read -rp "Select: " c
        
        case "$c" in
            0) return ;;
            [1-9])
                local selected=$(echo "$TIER1 $TIER2 $TIER3" | cut -d' ' -f$c)
                [ -z "$selected" ] && continue
                read -rp "Action for $selected [start/stop/restart/logs/cleanup]: " action
                case "$action" in
                    start) smart_start "$selected" ;;
                    stop) $RUNTIME stop $selected 2>/dev/null && $RUNTIME rm -f $selected ;;
                    restart) $RUNTIME restart $selected 2>/dev/null || { $RUNTIME stop $selected; $RUNTIME start $selected; } ;;
                    logs) $RUNTIME logs -f --tail=50 $selected ;;
                    cleanup) $RUNTIME stop $selected; $RUNTIME rm -f $selected ;;
                esac
                ;;
        esac
        read -rp "Press Enter..."
    done
}

do_start() {
    echo "${C}Starting NESS stack (Tier 0 first)...${R}"

    generate_ssh_admin_env
    
    # Ensure persistent volumes exist
    $RUNTIME volume create emercoin-data 2>/dev/null || true
    $RUNTIME volume create skywire-data 2>/dev/null || true
    $RUNTIME volume create lbrtynet-conf 2>/dev/null || true
    $RUNTIME volume create lbrtynet-cache 2>/dev/null || true
    
    # Tier 0: Network substrate — must come up before anything else
    echo "  → Tier 0: LBRTYnet + VPN tunnel..."
    smart_start lbrtynet
    smart_start softether-vpn "${SOFTETHER_VPN_PORT:-443}"
    sleep 2
    
    # Tier 1: Core services always first
    echo "  → Tier 1: Core services..."
    smart_start emercoin-core "6661"
    sleep 3
    
    # Start remaining Tier 1 with port-aware smart_start
    # Service:Port mappings for conflict detection
    if [ -n "$RESEED_INTERVAL" ]; then
        echo "    Starting pyuheprng-privatenesstools with ${RESEED_INTERVAL}s reseeding..."
        RESEED_INTERVAL="$RESEED_INTERVAL" smart_start pyuheprng-privatenesstools "${PYUHEPRNG_PORT}"
    else
        smart_start pyuheprng-privatenesstools "${PYUHEPRNG_PORT}"
    fi
    
    smart_start privateness "6660"
    smart_start skywire "8000"
    smart_start ssh-gateway "${SSH_GATEWAY_PORT}"
    
    # Tier 2 & 3 only for full profile (overlay routes are optional)
    if [ "$PROFILE" = "full" ]; then
        echo "  → Tier 2: Overlay routes (Yggdrasil IPv6 + I2P garlic)..."
        COMPOSE_PROFILES=overlay $ENGINE up -d --no-deps yggdrasil 2>&1 | grep -v "^#" || true
        sleep 2
        COMPOSE_PROFILES=overlay $ENGINE up -d --no-deps i2p-yggdrasil 2>&1 | grep -v "^#" || true
        echo "  → Tier 3: DNS..."
        smart_start dns-reverse-proxy "8053"
    fi
    
    echo "${G}✓ Started${R}"
    echo "  ${C}Emercoin blockchain: persistent volume${R}"
    apply_firewall_rules
    sleep 1
}

do_stop() {
    echo "${C}Stopping stack...${R}"
    remove_firewall_rules
    cleanup
    echo "${G}✓ Stopped${R}"
    sleep 1
}

do_restart() { do_stop; sleep 2; do_start; }

do_status() {
    echo "${C}Container Status:${R}"
    $ENGINE ps 2>/dev/null || echo "No running containers"
}

do_logs() {
    echo "${C}Logs (Ctrl+C to exit):${R}"
    $ENGINE logs -f --tail=50 2>/dev/null || echo "No logs"
}

do_health() {
    echo "${C}Health Check:${R}"
    for port in ${SOFTETHER_VPN_PORT:-443} 6661 6662 6660 ${PYUHEPRNG_PORT} 8888 8053 8000 ${SSH_GATEWAY_PORT}; do
        if nc -z 127.0.0.1 $port 2>/dev/null; then
            printf "  ${G}✓${R} Port %s: open\n" "$port"
        else
            printf "  ${Y}○${R} Port %s: closed\n" "$port"
        fi
    done
}

do_pull() {
    echo "${C}Pulling latest images...${R}"
    $ENGINE pull 2>/dev/null || echo "Done"
}

do_cleanup() {
    echo "${C}Cleaning up system...${R}"
    $RUNTIME container prune -f 2>/dev/null || true
    $RUNTIME image prune -f 2>/dev/null || true
    $RUNTIME volume prune -f 2>/dev/null || true
    echo "${G}✓ Cleaned${R}"
}

do_profile() {
    echo "  ${B}Profiles:${R}"
    echo "    pi3      - Tier 0+1 only (lightweight)"
    echo "    skyminer - Tier 0+1 without Skywire"
    echo "    full     - All tiers + overlay routes (Yggdrasil/I2P)"
    echo
    read -rp "Select [pi3/skyminer/full]: " p
    case "$p" in pi3|skyminer|full) PROFILE="$p"; echo "Set to: $PROFILE" ;; *) echo "Invalid" ;; esac
    sleep 1
}

do_set_reseed() {
    echo "${C}PyUHEPRNG Reseeding:${R}"
    echo "  Reseeding regenerates entropy periodically"
    echo "  Default: disabled (manual reseed only)"
    echo
    if [ -n "$RESEED_INTERVAL" ]; then
        echo "  Currently: ${B}${RESEED_INTERVAL}s${R}"
        read -rp "Disable? [y/N]: " disable
        if [[ "$disable" =~ ^[Yy]$ ]]; then
            RESEED_INTERVAL=""
            echo "${Y}✓ Disabled${R}"
        fi
    else
        echo "  Currently: ${B}disabled${R}"
        read -rp "Enable? Enter seconds (10-300, or N to cancel): " seconds
        if [[ "$seconds" =~ ^[0-9]+$ ]] && [ "$seconds" -ge 10 ] && [ "$seconds" -le 300 ]; then
            RESEED_INTERVAL="$seconds"
            export RESEED_INTERVAL
            echo "${G}✓ Enabled: ${RESEED_INTERVAL}s${R}"
            echo "  ${C}Takes effect on next Start/Restart${R}"
        else
            echo "${Y}Cancelled or invalid${R}"
        fi
    fi
    sleep 2
}

do_build_tools() {
    echo "${C}Building from github.com/ness-network/privatenesstools...${R}"
    if [ -d "privatenesstools-src/.git" ]; then
        cd privatenesstools-src && git pull && cd ..
    else
        git clone https://github.com/ness-network/privatenesstools.git privatenesstools-src || {
            echo "${Y}Clone failed${R}"; return 1
        }
    fi
    $RUNTIME build -t nessnetwork/pyuheprng-privatenesstools:latest privatenesstools-src/ 2>/dev/null || \
    $RUNTIME build -t nessnetwork/pyuheprng-privatenesstools:latest pyuheprng-privatenesstools/
    echo "${G}✓ Built${R}"
    sleep 1
}

# Main
trap 'echo; exit 130' INT

while true; do
    show_menu
    read -rp "Select: " c
    case "$c" in
        1) do_start ;; 2) do_stop ;; 3) do_restart ;; 4) do_status ;;
        5) do_logs ;; 6) do_health ;; 7) do_pull ;; 8) do_cleanup ;;
        9) do_profile ;; 10) do_build_tools ;; 11) do_set_reseed ;;
        12) container_menu ;; 0|q) exit 0 ;; *) echo "Invalid"; sleep 1 ;;
    esac
    [ "$c" != "0" ] && [ "$c" != "q" ] && read -rp "Press Enter..."
done