#!/bin/bash
# ═══════════════════════════════════════════════════════════════════
# WireGuard Client Setup (monitoring-uber)
# Install WireGuard, generate client keys, auto-connect to VPN server
# Client IP: 10.0.0.2/24
# ═══════════════════════════════════════════════════════════════════

set -e

# ─── Parameters ────────────────────────────────────────────────────
VPN_SERVER_IP="${1:-}"  # IP publique du serveur VPN
VPN_SERVER_PUBKEY="${2:-}"  # Clé publique du serveur VPN

if [ -z "$VPN_SERVER_IP" ] || [ -z "$VPN_SERVER_PUBKEY" ]; then
  echo "Usage: $0 <VPN_SERVER_IP> <VPN_SERVER_PUBKEY>"
  echo ""
  echo "Example:"
  echo "  $0 123.45.67.89 'aBcDeFgHiJkLmNoPqRsTuVwXyZ1234567890AbCdE='"
  exit 1
fi

echo "[*] Setting up WireGuard Client on monitoring-uber..."
echo "    Server IP: $VPN_SERVER_IP"
echo "    Server Pubkey: $VPN_SERVER_PUBKEY"

# ─── Install WireGuard ─────────────────────────────────────────
echo "[*] Installing WireGuard..."
apt-get update -qq
apt-get install -y wireguard wireguard-tools

# ─── Create key directory ──────────────────────────────────────
mkdir -p /etc/wireguard
cd /etc/wireguard
umask 077

# ─── Generate client keys ──────────────────────────────────────
if [ ! -f client_privatekey ]; then
  echo "[*] Generating client private key..."
  wg genkey > client_privatekey
  cat client_privatekey | wg pubkey > client_publickey
  echo "[✓] Keys generated"
  echo ""
  echo "Client Public Key (for server):"
  cat client_publickey
  echo ""
else
  echo "[!] Client keys already exist"
fi

# ─── Create wg0 configuration ──────────────────────────────────
echo "[*] Creating WireGuard client configuration..."

PRIVATE_KEY=$(cat client_privatekey)
CLIENT_PUBKEY=$(cat client_publickey)

cat > wg0.conf << EOF
[Interface]
# monitoring-uber VPN IP
Address = 10.0.0.2/24
ListenPort = 0
PrivateKey = $PRIVATE_KEY

[Peer]
# VPN Server
PublicKey = $VPN_SERVER_PUBKEY
AllowedIPs = 10.0.0.0/24
Endpoint = $VPN_SERVER_IP:51820
PersistentKeepalive = 25
EOF

chmod 600 wg0.conf

echo "[✓] Configuration created at /etc/wireguard/wg0.conf"

# ─── Enable at boot and start ──────────────────────────────────
echo "[*] Enabling WireGuard at boot..."
systemctl enable wg-quick@wg0 2>/dev/null || true
systemctl start wg-quick@wg0

sleep 2

# Vérifier connexion
if ip addr show wg0 &>/dev/null; then
  echo "[✓] WireGuard interface up"
  ip addr show wg0
else
  echo "[!] WireGuard interface not up, check logs:"
  journalctl -u wg-quick@wg0 -n 10
fi

echo ""
echo "[✓] WireGuard Client configured"
echo ""
echo "Configuration Summary:"
echo "  • Interface: wg0"
echo "  • Client IP: 10.0.0.2/24"
echo "  • Server: $VPN_SERVER_IP:51820"
echo "  • Config: /etc/wireguard/wg0.conf"
echo ""
echo "IMPORTANT: Add this client public key to VPN server:"
echo "  wg set wg0 peer $(cat client_publickey) allowed-ips 10.0.0.2/32"
echo ""
echo "Verify connection:"
echo "  ping 10.0.0.1"