#!/usr/bin/env bash
set -e

if [ -z "$GS_SECRET" ]; then
  echo "[!] ERROR: GS_SECRET environment variable is missing."
  echo "    Please start the container with -e GS_SECRET=\"your_secret_key\""
  exit 1
fi

# Ensure TUN device node exists in container namespace
if [ ! -c /dev/net/tun ]; then
  mkdir -p /dev/net
  mknod /dev/net/tun c 10 200
  chmod 600 /dev/net/tun
fi

# Force public DNS resolvers inside container for GSocket relay lookup
echo "nameserver 1.1.1.1" > /etc/resolv.conf
echo "nameserver 8.8.8.8" >> /etc/resolv.conf

# 1. Generate Certificates & OpenVPN Configs (OpenSSL 3.x compliant)
if [ ! -f /vpn/server.conf ]; then
  echo "[+] Generating OpenSSL 3.x compliant SSL/TLS Certificates..."

  # A. Generate CA
  openssl req -x509 -newkey rsa:2048 -nodes \
    -keyout /vpn/ca.key -out /vpn/ca.crt -days 3650 \
    -subj "/CN=GSocket-CA" \
    -addext "basicConstraints=critical,CA:TRUE" \
    -addext "keyUsage=critical,keyCertSign,cRLSign" >/dev/null 2>&1

  # B. Generate Server Cert
  cat <<EOF > /vpn/server_ext.cnf
basicConstraints = CA:FALSE
keyUsage = digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth
subjectAltName = DNS:gsocket, IP:127.0.0.1
EOF

  openssl req -newkey rsa:2048 -nodes -keyout /vpn/server.key -out /vpn/server.csr -subj "/CN=GSocket-Server" >/dev/null 2>&1
  openssl x509 -req -in /vpn/server.csr -CA /vpn/ca.crt -CAkey /vpn/ca.key -CAcreateserial \
    -out /vpn/server.crt -days 3650 -extfile /vpn/server_ext.cnf >/dev/null 2>&1

  # C. Generate Client Cert
  cat <<EOF > /vpn/client_ext.cnf
basicConstraints = CA:FALSE
keyUsage = digitalSignature
extendedKeyUsage = clientAuth
EOF

  openssl req -newkey rsa:2048 -nodes -keyout /vpn/client.key -out /vpn/client.csr -subj "/CN=GSocket-Client" >/dev/null 2>&1
  openssl x509 -req -in /vpn/client.csr -CA /vpn/ca.crt -CAkey /vpn/ca.key -CAcreateserial \
    -out /vpn/client.crt -days 3650 -extfile /vpn/client_ext.cnf >/dev/null 2>&1

  # D. Generate TLS-Crypt Key
  openvpn --genkey secret /vpn/tls-crypt.key

  # E. OpenVPN Server Config (uses 'topology subnet' & 'redirect-gateway local')
  cat <<EOF > /vpn/server.conf
dev tun
topology subnet
ca /vpn/ca.crt
cert /vpn/server.crt
key /vpn/server.key
dh none
ecdh-curve prime256v1
tls-crypt /vpn/tls-crypt.key
server 10.8.0.0 255.255.255.0
push "redirect-gateway def1 local bypass-dhcp"
push "dhcp-option DNS 1.1.1.1"
push "dhcp-option DNS 8.8.8.8"
keepalive 10 60
cipher AES-256-GCM
data-ciphers AES-256-GCM:AES-128-GCM
persist-key
persist-tun
tun-mtu 1300
mssfix 1200
EOF

  # F. Unified Client Config (Embedded relay routes via net_gateway)
  cat <<EOF > /vpn/client.ovpn
client
dev tun
proto tcp-client
remote 127.0.0.1 1194
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
cipher AES-256-GCM
tun-mtu 1300
mssfix 1200

# Native OpenVPN routes to bypass GSocket relay nodes via physical default gateway
route j.gs.thc.org 255.255.255.255 net_gateway
route a.gs.thc.org 255.255.255.255 net_gateway
route b.gs.thc.org 255.255.255.255 net_gateway
route c.gs.thc.org 255.255.255.255 net_gateway
route g.gs.thc.org 255.255.255.255 net_gateway

<ca>
$(cat /vpn/ca.crt)
</ca>
<cert>
$(cat /vpn/client.crt)
</cert>
<key>
$(cat /vpn/client.key)
</key>
<tls-crypt>
$(cat /vpn/tls-crypt.key)
</tls-crypt>
EOF

  echo "[+] Client config generated at /vpn/client.ovpn"
fi

# 2. Configure Networking & IPTables inside Container
WAN_IF=$(ip route show default | awk '/default/ {print $5}' | head -n1)
echo "[+] Container WAN Interface detected: $WAN_IF"

if [ "$(cat /proc/sys/net/ipv4/ip_forward 2>/dev/null)" = "1" ]; then
  echo "[+] IPv4 forwarding is active."
else
  echo "[!] WARNING: IPv4 forwarding is not active in this container!"
fi

echo 0 > /proc/sys/net/ipv4/conf/all/rp_filter 2>/dev/null || true
echo 0 > /proc/sys/net/ipv4/conf/default/rp_filter 2>/dev/null || true

iptables -F
iptables -t nat -F

iptables -A INPUT -i tun+ -j ACCEPT
iptables -A OUTPUT -o tun+ -j ACCEPT
iptables -A FORWARD -i tun+ -j ACCEPT
iptables -A FORWARD -o tun+ -j ACCEPT

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j MASQUERADE
iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1200

# 3. Start OpenVPN daemon
echo "[+] Starting local OpenVPN daemon on 127.0.0.1:1194..."
openvpn --config /vpn/server.conf \
        --proto tcp4-server \
        --local 127.0.0.1 \
        --lport 1194 &

sleep 2

# 4. Forward GSocket stream directly to 127.0.0.1:1194
echo "[+] Starting gs-netcat port forwarder..."
exec gs-netcat -s "$GS_SECRET" -l -d 127.0.0.1 -p 1194