#!/bin/bash
# ═══════════════════════════════════════════════════════════════════
# Rebind services to private VPN IP (10.0.0.2)
# Services: Wazuh Dashboard, Dozzle, Beszel, S3/RustFS
#
# IMPORTANT:
#   - Wazuh Manager stays on 0.0.0.0:1514 (agents need access)
#   - Other services bind to 10.0.0.2 (VPN only)
# ═══════════════════════════════════════════════════════════════════

set -e

VPN_IP="10.0.0.2"
COMPOSE_FILE="/home/ubuntu/docker/docker-compose-security.yml"

if [ ! -f "$COMPOSE_FILE" ]; then
  echo "[!] File not found: $COMPOSE_FILE"
  exit 1
fi

echo "[*] Rebinding services to VPN IP ($VPN_IP)..."
echo "    Config: $COMPOSE_FILE"

# ─── Wazuh Dashboard (443) ────────────────────────────────────
echo "[*] Updating Wazuh Dashboard (443)..."
sed -i 's|0\.0\.0\.0:443:|'"$VPN_IP"':443:|g' "$COMPOSE_FILE"

# ─── Dozzle (8080) ────────────────────────────────────────────
echo "[*] Updating Dozzle (8080)..."
sed -i 's|0\.0\.0\.0:8080:|'"$VPN_IP"':8080:|g' "$COMPOSE_FILE"

# ─── Beszel (9090) ────────────────────────────────────────────
echo "[*] Updating Beszel (9090)..."
sed -i 's|0\.0\.0\.0:9090:|'"$VPN_IP"':9090:|g' "$COMPOSE_FILE"

# ─── RustFS / S3 (9000, 9001) ─────────────────────────────────
echo "[*] Updating RustFS/S3 (9000, 9001)..."
sed -i 's|0\.0\.0\.0:9000:|'"$VPN_IP"':9000:|g' "$COMPOSE_FILE"
sed -i 's|0\.0\.0\.0:9001:|'"$VPN_IP"':9001:|g' "$COMPOSE_FILE"

# ─── Keep Wazuh Manager on 0.0.0.0:1514 ───────────────────────
# (agents need public access)

echo ""
echo "[✓] Services rebound to $VPN_IP"
echo ""
echo "Verify changes:"
grep -n "ports:" -A 2 "$COMPOSE_FILE" | grep -E "(443|8080|9090|9000|9001|1514)" || true

echo ""
echo "Services now listening on:"
echo "  • 0.0.0.0:1514 — Wazuh Manager (agents)"
echo "  • $VPN_IP:443 — Wazuh Dashboard (VPN only)"
echo "  • $VPN_IP:8080 — Dozzle (VPN only)"
echo "  • $VPN_IP:9090 — Beszel (VPN only)"
echo "  • $VPN_IP:9000/9001 — RustFS (VPN only)"
echo ""
echo "Next: Restart services"
echo "  cd /home/ubuntu/docker"
echo "  docker compose -f docker-compose-security.yml down"
echo "  docker compose -f docker-compose-security.yml up -d"