package main

import (
	"context"
	"crypto/tls"
	"flag"
	"fmt"
	"log"
	"net/http"
	"os"
	"os/signal"
	"sync"
	"syscall"
	"time"

	"proxmox-router/internal/api"
	"proxmox-router/internal/auth"
	"proxmox-router/internal/bridge"
	"proxmox-router/internal/bwtest"
	"proxmox-router/internal/certs"
	"proxmox-router/internal/cli"
	"proxmox-router/internal/dhcp"
	"proxmox-router/internal/dns"
	"proxmox-router/internal/dynamicrouting"
	"proxmox-router/internal/firewall"
	"proxmox-router/internal/logging"
	"proxmox-router/internal/network"
	"proxmox-router/internal/routing"
	"proxmox-router/internal/services"
	"proxmox-router/internal/tools"
	"proxmox-router/internal/vpn"
	"proxmox-router/internal/vrrp"
	"proxmox-router/internal/web"
)

func main() {
	addr := flag.String("addr", ":8080", "HTTP service address (e.g. :8080 or :80)")
	cliAddr := flag.String("cli-addr", ":8282", "CLI service address for Telnet and debtik-cli (e.g. :8282)")
	metaPath := flag.String("meta", "/etc/proxmox-router/metadata.json", "Path to interface metadata storage file")
	flag.Parse()

	// Initialize Logging Ring Buffer
	_ = logging.GetLogger()

	// Initialize components
	metaMgr := network.NewMetadataManager(*metaPath)
	netMgr := network.NewManager(metaMgr)
	persistMgr := network.NewPersistenceManager(netMgr)
	vpnMgr := vpn.NewManager()
	defer vpnMgr.AeroTUN.StopAll()
	fwMgr := firewall.NewFirewallManager()
	routingMgr := routing.NewRoutingManager()
	defer routingMgr.Stop()
	dynRoutingMgr := dynamicrouting.NewManager("")
	bridgeMgr := bridge.NewBridgeManager()
	toolsMgr := tools.NewManager()
	dhcpMgr := dhcp.NewManager()
	dhcpServerMgr := dhcp.NewServerManager()
	vrrpMgr := vrrp.NewManager()
	bwtestMgr := bwtest.NewManager("")
	defer bwtestMgr.Stop()
	dnsMgr := dns.NewManager()
	authMgr := auth.NewManager("")
	servicesMgr := services.NewManager("")
	certMgr, err := certs.NewCertManager("")
	if err != nil {
		log.Fatalf("Failed to initialize certificate manager: %v", err)
	}
	webHandler := web.Handler()

	// Build Unified RouterOS CLI Executor
	cliExecutor := cli.NewExecutor(
		authMgr,
		netMgr,
		routingMgr,
		dynRoutingMgr,
		fwMgr,
		dhcpMgr,
		dhcpServerMgr,
		dnsMgr,
		bridgeMgr,
		vpnMgr,
		vrrpMgr,
		bwtestMgr,
		servicesMgr,
		certMgr,
	)

	// Determine Telnet & SSH addresses from services config or flags
	telnetAddr := *cliAddr
	if tSvc, ok := servicesMgr.GetService("telnet"); ok && tSvc.Port > 0 {
		telnetAddr = fmt.Sprintf(":%d", tSvc.Port)
	}

	sshAddr := ":2222"
	if sSvc, ok := servicesMgr.GetService("ssh"); ok && sSvc.Port > 0 {
		sshAddr = fmt.Sprintf(":%d", sSvc.Port)
	}

	cliTelnetServer := cli.NewServer(telnetAddr, authMgr, cliExecutor)
	cliSSHServer := cli.NewSSHServer(sshAddr, authMgr, cliExecutor)

	// Register hooks for dynamic service start/stop & port changes
	servicesMgr.RegisterHook("telnet", func(serviceName string, port int, disabled bool) error {
		cliTelnetServer.Stop()
		if !disabled {
			cliTelnetServer.SetAddr(fmt.Sprintf(":%d", port))
			go func() {
				if err := cliTelnetServer.Start(); err != nil {
					log.Printf("[CLI-Telnet] Listener error: %v", err)
				}
			}()
		}
		return nil
	})

	servicesMgr.RegisterHook("ssh", func(serviceName string, port int, disabled bool) error {
		cliSSHServer.Stop()
		if !disabled {
			cliSSHServer.SetAddr(fmt.Sprintf(":%d", port))
			go func() {
				if err := cliSSHServer.Start(); err != nil {
					log.Printf("[CLI-SSH] Listener error: %v", err)
				}
			}()
		}
		return nil
	})

	// Start enabled CLI servers
	if tSvc, ok := servicesMgr.GetService("telnet"); !ok || !tSvc.Disabled {
		go func() {
			if err := cliTelnetServer.Start(); err != nil {
				log.Printf("[CLI-Telnet] Server listener error: %v", err)
			}
		}()
	}
	defer cliTelnetServer.Stop()

	if sSvc, ok := servicesMgr.GetService("ssh"); !ok || !sSvc.Disabled {
		go func() {
			if err := cliSSHServer.Start(); err != nil {
				log.Printf("[CLI-SSH] Server listener error: %v", err)
			}
		}()
	}
	defer cliSSHServer.Stop()

	// API & Web UI Server
	srv := api.NewServer(
		netMgr,
		persistMgr,
		metaMgr,
		vpnMgr,
		fwMgr,
		routingMgr,
		dynRoutingMgr,
		bridgeMgr,
		toolsMgr,
		dhcpMgr,
		dhcpServerMgr,
		vrrpMgr,
		bwtestMgr,
		dnsMgr,
		authMgr,
		servicesMgr,
		certMgr,
		webHandler,
	)

	// HTTPS (www-ssl) Dynamic Server Listener
	var (
		httpsServer  *http.Server
		httpsMu      sync.Mutex
		httpsRunning bool
	)

	startOrRestartHTTPS := func(port int, disabled bool) {
		httpsMu.Lock()
		defer httpsMu.Unlock()

		if httpsRunning && httpsServer != nil {
			ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
			_ = httpsServer.Shutdown(ctx)
			cancel()
			httpsRunning = false
			httpsServer = nil
		}

		if disabled {
			log.Printf("[HTTPS] Web SSL (www-ssl) listener stopped")
			return
		}

		sslSvc, ok := servicesMgr.GetService("www-ssl")
		if !ok || sslSvc.Certificate == "" {
			log.Printf("[HTTPS] Cannot start www-ssl: no certificate configured (set certificate=<name>)")
			return
		}

		tlsCert, err := certMgr.GetTLSCertificate(sslSvc.Certificate)
		if err != nil {
			log.Printf("[HTTPS] Cannot start www-ssl: failed loading certificate %q: %v", sslSvc.Certificate, err)
			return
		}

		tlsConfig := &tls.Config{
			Certificates: []tls.Certificate{tlsCert},
			GetCertificate: func(hello *tls.ClientHelloInfo) (*tls.Certificate, error) {
				curSvc, ok := servicesMgr.GetService("www-ssl")
				if ok && curSvc.Certificate != "" {
					if c, err := certMgr.GetTLSCertificate(curSvc.Certificate); err == nil {
						return &c, nil
					}
				}
				return &tlsCert, nil
			},
		}

		listenAddr := fmt.Sprintf(":%d", port)
		newSrv := &http.Server{
			Addr:         listenAddr,
			Handler:      srv,
			TLSConfig:    tlsConfig,
			ReadTimeout:  60 * time.Second,
			WriteTimeout: 60 * time.Second,
			IdleTimeout:  120 * time.Second,
		}
		httpsServer = newSrv
		httpsRunning = true

		go func() {
			log.Printf("[HTTPS] Web SSL (www-ssl) server listening on %s with certificate %q", listenAddr, sslSvc.Certificate)
			if err := newSrv.ListenAndServeTLS("", ""); err != nil && err != http.ErrServerClosed {
				log.Printf("[HTTPS] Server error: %v", err)
				httpsMu.Lock()
				httpsRunning = false
				httpsMu.Unlock()
			}
		}()
	}

	servicesMgr.RegisterHook("www-ssl", func(serviceName string, port int, disabled bool) error {
		startOrRestartHTTPS(port, disabled)
		return nil
	})

	if sslSvc, ok := servicesMgr.GetService("www-ssl"); ok && !sslSvc.Disabled {
		startOrRestartHTTPS(sslSvc.Port, sslSvc.Disabled)
	}
	defer func() {
		httpsMu.Lock()
		if httpsRunning && httpsServer != nil {
			_ = httpsServer.Close()
		}
		httpsMu.Unlock()
	}()

	httpServer := &http.Server{
		Addr:         *addr,
		Handler:      srv,
		ReadTimeout:  60 * time.Second,
		WriteTimeout: 60 * time.Second,
		IdleTimeout:  120 * time.Second,
	}

	// Print startup banner
	fmt.Println("========================================================")
	fmt.Println("            ⚡ DebTik Appliance Controller ⚡           ")
	fmt.Println("========================================================")
	fmt.Printf(" Web UI & API        : http://0.0.0.0%s\n", *addr)
	fmt.Printf(" CLI Telnet Service  : 0.0.0.0%s (debtik-cli / telnet)\n", telnetAddr)
	fmt.Printf(" CLI SSH Service     : 0.0.0.0%s (ssh admin@<router-ip> -p 2222)\n", sshAddr)
	fmt.Printf(" Metadata Storage    : %s\n", *metaPath)
	fmt.Printf(" Debian Config Path  : %s\n", network.DebianVlansCfgPath)

	if ifaces, err := netMgr.ListInterfaces(); err == nil {
		fmt.Printf(" Discovered Links    : %d interfaces\n", len(ifaces))
		for _, i := range ifaces {
			fmt.Printf("   - %-10s (%s) [%s] MTU:%d\n", i.Name, i.Type, i.State, i.MTU)
		}
	}
	fmt.Println("========================================================")
	fmt.Println(" DebTik Appliance ready. Press Ctrl+C to terminate.")

	// Graceful shutdown handling
	stopChan := make(chan os.Signal, 1)
	signal.Notify(stopChan, os.Interrupt, syscall.SIGTERM)

	go func() {
		if err := httpServer.ListenAndServe(); err != nil && err != http.ErrServerClosed {
			log.Fatalf("HTTP server failed: %v", err)
		}
	}()

	<-stopChan
	fmt.Println("\nShutting down DebTik Controller gracefully...")

	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
	defer cancel()

	if err := httpServer.Shutdown(ctx); err != nil {
		log.Printf("Server shutdown error: %v", err)
	}
	fmt.Println("DebTik Controller stopped.")
}