#!/bin/bash
# ═══════════════════════════════════════════════════════════════════
# Generate WireGuard client config for admin
# Usage: wireguard-admin-client.sh <admin_name> <server_ip> <server_pubkey>
# Output: admin_name.conf (ready for import in WireGuard app)
# ═══════════════════════════════════════════════════════════════════

set -e

ADMIN_NAME="${1:-admin1}"
VPN_SERVER_IP="${2:-}"
VPN_SERVER_PUBKEY="${3:-}"

if [ -z "$VPN_SERVER_IP" ] || [ -z "$VPN_SERVER_PUBKEY" ]; then
  echo "Usage: $0 <admin_name> <server_ip> <server_pubkey>"
  echo ""
  echo "Example:"
  echo "  $0 admin1 123.45.67.89 'aBcDeFgHiJkLmNoPqRsTuVwXyZ1234567890AbCdE='"
  exit 1
fi

echo "[*] Generating WireGuard config for admin: $ADMIN_NAME"

# ─── Generate unique keys for this admin ───────────────────────
ADMIN_PRIVATEKEY=$(wg genkey)
ADMIN_PUBKEY=$(echo "$ADMIN_PRIVATEKEY" | wg pubkey)

# ─── Auto-assign IP from 10.0.0.3+ ─────────────────────────────
# Format: [admin_name].conf uses 10.0.0.3, 10.0.0.4, etc.
# You should track these manually or use a database
ADMIN_IP="10.0.0.3"  # ← CHANGE THIS for each admin

# ─── Create config file ────────────────────────────────────────
cat > "${ADMIN_NAME}.conf" << EOF
[Interface]
Address = $ADMIN_IP/32
PrivateKey = $ADMIN_PRIVATEKEY
DNS = 8.8.8.8

[Peer]
PublicKey = $VPN_SERVER_PUBKEY
AllowedIPs = 10.0.0.0/24
Endpoint = $VPN_SERVER_IP:51820
PersistentKeepalive = 25
EOF

echo "[✓] Config created: ${ADMIN_NAME}.conf"
echo ""
echo "Configuration:"
echo "  Name: $ADMIN_NAME"
echo "  IP: $ADMIN_IP"
echo "  Public Key: $ADMIN_PUBKEY"
echo ""
echo "Steps to add to VPN server:"
echo "  1. Copy public key above"
echo "  2. SSH to VPN server"
echo "  3. wg set wg0 peer $ADMIN_PUBKEY allowed-ips $ADMIN_IP/32"
echo "  4. wg show"
echo ""
echo "To import on your device:"
echo "  1. Install WireGuard app (Windows/Mac/Linux/iPhone/Android)"
echo "  2. Import ${ADMIN_NAME}.conf"
echo "  3. Connect to VPN"
echo "  4. Access services:"
echo "     • Wazuh: https://10.0.0.2"
echo "     • Dozzle: http://10.0.0.2:8080"
echo "     • Beszel: http://10.0.0.2:9090"
echo "     • S3: http://10.0.0.2:9000"