DebTik/cmd/server/main.go

package main

import (
	"context"
	"crypto/tls"
	release "debtik"
	"flag"
	"fmt"
	"log"
	"net"
	"net/http"
	"os"
	"os/signal"
	"sync"
	"syscall"
	"time"

	"debtik/internal/api"
	"debtik/internal/auth"
	"debtik/internal/backup"
	"debtik/internal/bridge"
	"debtik/internal/bwtest"
	"debtik/internal/certs"
	"debtik/internal/cli"
	"debtik/internal/dhcp"
	"debtik/internal/dns"
	"debtik/internal/dynamicrouting"
	"debtik/internal/firewall"
	"debtik/internal/logging"
	"debtik/internal/network"
	"debtik/internal/reverseproxy"
	"debtik/internal/routing"
	"debtik/internal/sdwan"
	"debtik/internal/services"
	"debtik/internal/tools"
	"debtik/internal/vpn"
	"debtik/internal/vrrp"
	"debtik/internal/web"
)

func main() {
	addr := flag.String("addr", ":80", "HTTP service address (e.g. :8080 or :80)")
	cliAddr := flag.String("cli-addr", ":8282", "CLI service address for Telnet and debtik-cli (e.g. :8282)")
	metaPath := flag.String("meta", "/etc/debtik/metadata.json", "Path to interface metadata storage file")
	flag.Parse()
	if os.Geteuid() == 0 {
		if err := release.RefreshUpdateHelpers("/usr/local/libexec"); err != nil {
			log.Printf("Cannot refresh updater helpers: %v", err)
		}
	}

	// Initialize Logging Ring Buffer
	_ = logging.GetLogger()

	// Recover interrupted restores before any subsystem reads persisted config.
	backupMgr := backup.NewManager("", "", "", nil)
	if recovered, err := backupMgr.RecoverInterruptedRestore(); err != nil {
		log.Fatalf("Cannot recover interrupted configuration restore: %v", err)
	} else if recovered {
		log.Printf("Recovered interrupted configuration restore")
	}

	// Initialize components
	metaMgr := network.NewMetadataManager(*metaPath)
	netMgr := network.NewManager(metaMgr)
	persistMgr := network.NewPersistenceManager(netMgr)
	vpnMgr := vpn.NewManager()
	defer vpnMgr.AeroTUN.StopAll()
	fwMgr := firewall.NewFirewallManager()
	routingMgr := routing.NewRoutingManager()
	defer routingMgr.Stop()
	dynRoutingMgr := dynamicrouting.NewManager("")
	bridgeMgr := bridge.NewBridgeManager()
	toolsMgr := tools.NewManager()
	dhcpMgr := dhcp.NewManager()
	dhcpServerMgr := dhcp.NewServerManager()
	vrrpMgr := vrrp.NewManager()
	bwtestMgr := bwtest.NewManager("")
	defer bwtestMgr.Stop()
	dnsMgr := dns.NewManager()
	authMgr := auth.NewManager("")
	servicesMgr := services.NewManager("")
	certMgr, err := certs.NewCertManager("")
	if err != nil {
		log.Fatalf("Failed to initialize certificate manager: %v", err)
	}
	renewCtx, stopRenewal := context.WithCancel(context.Background())
	defer stopRenewal()
	go certMgr.RunRenewal(renewCtx)

	proxyMgr := reverseproxy.NewManager("", certMgr)
	defer proxyMgr.Stop()

	sdwanMgr := sdwan.NewManager()
	defer sdwanMgr.Stop()

	webHandler := web.Handler()

	// Build Unified RouterOS CLI Executor
	cliExecutor := cli.NewExecutor(
		authMgr,
		netMgr,
		routingMgr,
		dynRoutingMgr,
		fwMgr,
		dhcpMgr,
		dhcpServerMgr,
		dnsMgr,
		bridgeMgr,
		vpnMgr,
		vrrpMgr,
		bwtestMgr,
		servicesMgr,
		certMgr,
		proxyMgr,
		backupMgr,
		sdwanMgr,
	)

	// Determine Telnet & SSH addresses from services config or flags
	telnetAddr := *cliAddr
	if tSvc, ok := servicesMgr.GetService("telnet"); ok && tSvc.Port > 0 {
		telnetAddr = fmt.Sprintf(":%d", tSvc.Port)
	}

	sshAddr := ":2222"
	if sSvc, ok := servicesMgr.GetService("ssh"); ok && sSvc.Port > 0 {
		sshAddr = fmt.Sprintf(":%d", sSvc.Port)
	}

	cliTelnetServer := cli.NewServer(telnetAddr, authMgr, cliExecutor)
	cliSSHServer := cli.NewSSHServer(sshAddr, authMgr, cliExecutor)

	// Register hooks for dynamic service start/stop & port changes
	servicesMgr.RegisterHook("telnet", func(serviceName string, port int, disabled bool) error {
		cliTelnetServer.Stop()
		if !disabled {
			cliTelnetServer.SetAddr(fmt.Sprintf(":%d", port))
			return waitListener(cliTelnetServer.Start, cliTelnetServer.IsRunning)
		}
		return nil
	})

	servicesMgr.RegisterHook("ssh", func(serviceName string, port int, disabled bool) error {
		cliSSHServer.Stop()
		if !disabled {
			cliSSHServer.SetAddr(fmt.Sprintf(":%d", port))
			return waitListener(cliSSHServer.Start, cliSSHServer.IsRunning)
		}
		return nil
	})

	// Start enabled CLI servers
	if tSvc, ok := servicesMgr.GetService("telnet"); !ok || !tSvc.Disabled {
		go func() {
			if err := cliTelnetServer.Start(); err != nil {
				log.Printf("[CLI-Telnet] Server listener error: %v", err)
			}
		}()
	}
	defer cliTelnetServer.Stop()

	if sSvc, ok := servicesMgr.GetService("ssh"); !ok || !sSvc.Disabled {
		go func() {
			if err := cliSSHServer.Start(); err != nil {
				log.Printf("[CLI-SSH] Server listener error: %v", err)
			}
		}()
	}
	defer cliSSHServer.Stop()

	// API & Web UI Server
	srv := api.NewServer(
		netMgr,
		persistMgr,
		metaMgr,
		vpnMgr,
		fwMgr,
		routingMgr,
		dynRoutingMgr,
		bridgeMgr,
		toolsMgr,
		dhcpMgr,
		dhcpServerMgr,
		vrrpMgr,
		bwtestMgr,
		dnsMgr,
		authMgr,
		servicesMgr,
		certMgr,
		proxyMgr,
		backupMgr,
		sdwanMgr,
		webHandler,
	)

	// Standalone HTTPS Proxy listener when www-ssl is disabled
	var (
		proxyHTTPSServer  *http.Server
		proxyHTTPSMu      sync.Mutex
		proxyHTTPSRunning bool
	)

	startOrRestartProxyHTTPS := func() error {
		proxyHTTPSMu.Lock()
		defer proxyHTTPSMu.Unlock()

		if proxyHTTPSRunning && proxyHTTPSServer != nil {
			ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
			_ = proxyHTTPSServer.Shutdown(ctx)
			cancel()
			proxyHTTPSRunning = false
			proxyHTTPSServer = nil
		}

		// If www-ssl service is running, port 443 is already served by it
		sslSvc, ok := servicesMgr.GetService("www-ssl")
		if ok && !sslSvc.Disabled {
			return nil
		}

		cfg := proxyMgr.GetConfig()
		if !cfg.Enabled || cfg.HTTPSPort <= 0 {
			return nil
		}

		tlsConfig := &tls.Config{
			GetCertificate: proxyMgr.GetTLSCertificate,
		}

		listenAddr := fmt.Sprintf(":%d", cfg.HTTPSPort)
		newSrv := &http.Server{
			Addr:         listenAddr,
			Handler:      srv,
			TLSConfig:    tlsConfig,
			ReadTimeout:  60 * time.Second,
			WriteTimeout: 60 * time.Second,
			IdleTimeout:  120 * time.Second,
		}
		listener, err := tls.Listen("tcp", listenAddr, tlsConfig)
		if err != nil {
			return err
		}
		proxyHTTPSServer = newSrv
		proxyHTTPSRunning = true

		go func() {
			log.Printf("[Proxy-HTTPS] Standalone reverse proxy HTTPS server listening on %s", listenAddr)
			if err := newSrv.Serve(listener); err != nil && err != http.ErrServerClosed {
				log.Printf("[Proxy-HTTPS] Server error: %v", err)
				proxyHTTPSMu.Lock()
				proxyHTTPSRunning = false
				proxyHTTPSMu.Unlock()
			}
		}()
		return nil
	}
	defer func() {
		proxyHTTPSMu.Lock()
		if proxyHTTPSServer != nil {
			ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
			_ = proxyHTTPSServer.Shutdown(ctx)
			cancel()
		}
		proxyHTTPSMu.Unlock()
	}()

	// HTTPS (www-ssl) Dynamic Server Listener
	var (
		httpsServer  *http.Server
		httpsMu      sync.Mutex
		httpsRunning bool
	)

	startOrRestartHTTPS := func(port int, disabled bool) error {
		httpsMu.Lock()
		defer httpsMu.Unlock()

		if httpsRunning && httpsServer != nil {
			ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
			_ = httpsServer.Shutdown(ctx)
			cancel()
			httpsRunning = false
			httpsServer = nil
		}

		if disabled {
			log.Printf("[HTTPS] Web SSL (www-ssl) listener stopped")
			return nil
		}

		sslSvc, ok := servicesMgr.GetService("www-ssl")
		if !ok || sslSvc.Certificate == "" {
			return fmt.Errorf("HTTPS requires a configured certificate")
		}

		tlsCert, err := certMgr.GetTLSCertificate(sslSvc.Certificate)
		if err != nil {
			return fmt.Errorf("HTTPS certificate %s: %w", sslSvc.Certificate, err)
		}

		tlsConfig := &tls.Config{
			Certificates: []tls.Certificate{tlsCert},
			GetCertificate: func(hello *tls.ClientHelloInfo) (*tls.Certificate, error) {
				// Priority: Check if reverse proxy has a rule matching this SNI domain with a certificate
				if cert, err := proxyMgr.GetTLSCertificate(hello); err == nil {
					return cert, nil
				}
				curSvc, ok := servicesMgr.GetService("www-ssl")
				if ok && curSvc.Certificate != "" {
					if c, err := certMgr.GetTLSCertificate(curSvc.Certificate); err == nil {
						return &c, nil
					}
				}
				return &tlsCert, nil
			},
		}

		listenAddr := fmt.Sprintf(":%d", port)
		newSrv := &http.Server{
			Addr:         listenAddr,
			Handler:      srv,
			TLSConfig:    tlsConfig,
			ReadTimeout:  60 * time.Second,
			WriteTimeout: 60 * time.Second,
			IdleTimeout:  120 * time.Second,
		}
		listener, err := tls.Listen("tcp", listenAddr, tlsConfig)
		if err != nil {
			return err
		}
		httpsServer = newSrv
		httpsRunning = true

		go func() {
			log.Printf("[HTTPS] Web SSL (www-ssl) server listening on %s with certificate %q", listenAddr, sslSvc.Certificate)
			if err := newSrv.Serve(listener); err != nil && err != http.ErrServerClosed {
				log.Printf("[HTTPS] Server error: %v", err)
				httpsMu.Lock()
				httpsRunning = false
				httpsMu.Unlock()
			}
		}()
		return nil
	}

	servicesMgr.RegisterHook("www-ssl", func(serviceName string, port int, disabled bool) error {
		err := startOrRestartHTTPS(port, disabled)
		_ = startOrRestartProxyHTTPS()
		return err
	})

	if sslSvc, ok := servicesMgr.GetService("www-ssl"); ok && !sslSvc.Disabled {
		if err := startOrRestartHTTPS(sslSvc.Port, sslSvc.Disabled); err != nil {
			log.Printf("HTTPS startup failed: %v", err)
		}
	} else {
		// If www-ssl is disabled, start standalone proxy HTTPS listener
		if err := startOrRestartProxyHTTPS(); err != nil {
			log.Printf("Standalone HTTPS proxy startup note: %v", err)
		}
	}
	defer func() {
		httpsMu.Lock()
		if httpsRunning && httpsServer != nil {
			_ = httpsServer.Close()
		}
		httpsMu.Unlock()
	}()

	var httpMu sync.Mutex
	var httpServer *http.Server
	host, _, _ := net.SplitHostPort(*addr)
	startHTTP := func(port int, disabled bool) error {
		httpMu.Lock()
		defer httpMu.Unlock()
		old := httpServer
		// If www is disabled for management, keep HTTP port 80 listening if Reverse Proxy is enabled,
		// so that reverse proxy rules and Let's Encrypt ACME HTTP-01 challenges continue functioning.
		proxyActive := (proxyMgr != nil && proxyMgr.IsEnabled())
		if disabled && !proxyActive {
			httpServer = nil
			if old != nil {
				go old.Shutdown(context.Background())
			}
			return nil
		}
		address := net.JoinHostPort(host, fmt.Sprint(port))
		if old != nil && old.Addr == address {
			return nil
		}
		listener, err := net.Listen("tcp", address)
		if err != nil {
			return err
		}
		next := &http.Server{Addr: address, Handler: srv, ReadTimeout: 60 * time.Second, WriteTimeout: 60 * time.Second, IdleTimeout: 120 * time.Second}
		httpServer = next
		go func() {
			if err := next.Serve(listener); err != nil && err != http.ErrServerClosed {
				log.Printf("HTTP listener failed: %v", err)
			}
		}()
		if old != nil {
			go old.Shutdown(context.Background())
		}
		return nil
	}
	servicesMgr.RegisterHook("www", func(_ string, port int, disabled bool) error { return startHTTP(port, disabled) })
	_, httpPortText, _ := net.SplitHostPort(*addr)
	var httpPort int
	_, _ = fmt.Sscan(httpPortText, &httpPort)
	httpDisabled := false
	explicitAddr := false
	flag.Visit(func(f *flag.Flag) {
		if f.Name == "addr" {
			explicitAddr = true
		}
	})
	if svc, ok := servicesMgr.GetService("www"); ok {
		httpDisabled = svc.Disabled
		httpPort = effectiveHTTPPort(httpPort, svc.Port, explicitAddr)
	}
	if err := startHTTP(httpPort, httpDisabled); err != nil {
		log.Fatalf("HTTP startup failed: %v", err)
	}

	// Print startup banner
	fmt.Println("========================================================")
	fmt.Println("            ⚡ DebTik Appliance Controller ⚡           ")
	fmt.Println("========================================================")
	fmt.Printf(" Web UI & API        : http://0.0.0.0%s\n", *addr)
	fmt.Printf(" CLI Telnet Service  : 0.0.0.0%s (debtik-cli / telnet)\n", telnetAddr)
	fmt.Printf(" CLI SSH Service     : 0.0.0.0%s (ssh admin@<router-ip> -p 2222)\n", sshAddr)
	fmt.Printf(" Metadata Storage    : %s\n", *metaPath)
	fmt.Printf(" Debian Config Path  : %s\n", network.DebianVlansCfgPath)

	if ifaces, err := netMgr.ListInterfaces(); err == nil {
		fmt.Printf(" Discovered Links    : %d interfaces\n", len(ifaces))
		for _, i := range ifaces {
			fmt.Printf("   - %-10s (%s) [%s] MTU:%d\n", i.Name, i.Type, i.State, i.MTU)
		}
	}
	fmt.Println("========================================================")
	fmt.Println(" DebTik Appliance ready. Press Ctrl+C to terminate.")

	// Graceful shutdown handling
	stopChan := make(chan os.Signal, 1)
	signal.Notify(stopChan, os.Interrupt, syscall.SIGTERM)

	<-stopChan
	fmt.Println("\nShutting down DebTik Controller gracefully...")

	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
	defer cancel()

	httpMu.Lock()
	currentHTTP := httpServer
	httpMu.Unlock()
	if currentHTTP != nil {
		if err := currentHTTP.Shutdown(ctx); err != nil {
			log.Printf("Server shutdown error: %v", err)
		}
	}
	fmt.Println("DebTik Controller stopped.")
}

func waitListener(start func() error, running func() bool) error {
	result := make(chan error, 1)
	go func() { result <- start() }()
	timer := time.NewTimer(5 * time.Second)
	defer timer.Stop()
	ticker := time.NewTicker(20 * time.Millisecond)
	defer ticker.Stop()
	for {
		select {
		case err := <-result:
			return err
		case <-timer.C:
			return fmt.Errorf("listener did not become ready")
		case <-ticker.C:
			if running() {
				return nil
			}
		}
	}
}

// A configured service port is used unless the operator explicitly overrides
// the listening address on the command line.
func effectiveHTTPPort(flagPort, servicePort int, explicitAddr bool) int {
	if explicitAddr {
		return flagPort
	}
	return servicePort
}