#!/usr/bin/env bash
# Stellt die für 50-paw-install.yml relevante NetworkManager-Konfiguration wieder her.
set -Eeuo pipefail
IFS=$'\n\t'
umask 077

SRC="${1:?Aufruf: sudo $0 /pfad/zum/backup/network}"
APPLY_NETWORK="${APPLY_NETWORK:-0}"
OVERWRITE_NETWORK="${OVERWRITE_NETWORK:-1}"
[[ $EUID -eq 0 ]] || { echo "FEHLER: Bitte als root ausführen." >&2; exit 1; }
[[ -d "$SRC/rootfs" ]] || { echo "FEHLER: Ungültiges Netzwerk-Backup: $SRC" >&2; exit 1; }

log(){ printf '\n==> %s\n' "$*"; }
warn(){ echo "WARNUNG: $*" >&2; }

# Aktuelle Geräte anhand permanenter MAC inventarisieren.
declare -A MAC_TO_IF
for sysdev in /sys/class/net/*; do
  iface="${sysdev##*/}"
  [[ "$iface" == "lo" ]] && continue
  pmac="$(ethtool -P "$iface" 2>/dev/null | awk '{print tolower($3)}' || true)"
  [[ "$pmac" =~ ^([0-9a-f]{2}:){5}[0-9a-f]{2}$ ]] || pmac="$(tr '[:upper:]' '[:lower:]' < "$sysdev/address" 2>/dev/null || true)"
  if [[ "$pmac" =~ ^([0-9a-f]{2}:){5}[0-9a-f]{2}$ ]]; then
    MAC_TO_IF["$pmac"]="$iface"
  else
    warn "Keine gültige MAC für Interface $iface ermittelbar; übersprungen."
  fi
done

log "Kopiere gesicherte PAW-Konfiguration"
while IFS=$'\t' read -r original relative; do
  [[ -n "${original:-}" && -n "${relative:-}" ]] || continue
  source_path="$SRC/$relative"
  [[ -e "$source_path" ]] || { warn "Quelle fehlt: $source_path"; continue; }
  if [[ -e "$original" && "$OVERWRITE_NETWORK" != "1" ]]; then
    warn "Vorhanden, übersprungen: $original"
    continue
  fi
  mkdir -p "$(dirname "$original")"
  if [[ -d "$source_path" ]]; then
    mkdir -p "$original"
    rsync -aHAX --numeric-ids "$source_path/" "$original/"
  else
    rsync -aHAX --numeric-ids "$source_path" "$original"
  fi
done < "$SRC/metadata/files.tsv"

log "Ordne br-lan-Ports anhand permanenter MAC neu zu"
if [[ -f "$SRC/metadata/paw-ports.tsv" ]]; then
  tail -n +2 "$SRC/metadata/paw-ports.tsv" | while IFS=$'\t' read -r profile con_id old_if pmac master; do
    [[ -n "$profile" ]] || continue
    target="/etc/NetworkManager/system-connections/$profile"
    [[ -f "$target" ]] || { warn "Profil fehlt nach Restore: $target"; continue; }
    pmac="$(tr '[:upper:]' '[:lower:]' <<<"${pmac:-}")"
    new_if=""
    if [[ "$pmac" =~ ^([0-9a-f]{2}:){5}[0-9a-f]{2}$ ]]; then
      new_if="${MAC_TO_IF["$pmac"]:-}"
    fi
    if [[ -z "$pmac" || -z "$new_if" ]]; then
      warn "Keine aktuelle Schnittstelle für $con_id (alte Schnittstelle $old_if, MAC ${pmac:-unbekannt}) gefunden."
      continue
    fi
    sed -i -E "s/^interface-name=.*/interface-name=$new_if/" "$target"
    # Hardwarebindung ergänzen/aktualisieren, damit wechselnde Gerätenamen unschädlich sind.
    python3 - "$target" "$pmac" <<'PY'
import configparser, sys
p, mac = sys.argv[1:]
cfg = configparser.RawConfigParser(strict=False, interpolation=None)
cfg.optionxform = str
cfg.read(p)
if not cfg.has_section('802-3-ethernet'):
    cfg.add_section('802-3-ethernet')
cfg.set('802-3-ethernet', 'mac-address', mac)
with open(p, 'w') as f:
    cfg.write(f, space_around_delimiters=False)
PY
    echo "$con_id: $old_if -> $new_if ($pmac)"
  done
fi

# Bridge-MAC festschreiben. 50-paw-install.yml tut dies bislang nicht.
if [[ -s "$SRC/metadata/br-lan.mac" ]]; then
  bridge_mac="$(tr '[:upper:]' '[:lower:]' < "$SRC/metadata/br-lan.mac")"
  bridge_profile="/etc/NetworkManager/system-connections/br-lan.nmconnection"
  if [[ -f "$bridge_profile" ]]; then
    python3 - "$bridge_profile" "$bridge_mac" <<'PY'
import configparser, sys
p, mac = sys.argv[1:]
cfg = configparser.RawConfigParser(strict=False, interpolation=None)
cfg.optionxform = str
cfg.read(p)
if not cfg.has_section('bridge'):
    cfg.add_section('bridge')
cfg.set('bridge', 'mac-address', mac)
with open(p, 'w') as f:
    cfg.write(f, space_around_delimiters=False)
PY
    echo "br-lan MAC festgelegt: $bridge_mac"
  else
    warn "br-lan.nmconnection fehlt; Bridge-MAC konnte nicht eingetragen werden."
  fi
fi

chown root:root /etc/NetworkManager/system-connections/*.nmconnection 2>/dev/null || true
chmod 600 /etc/NetworkManager/system-connections/*.nmconnection 2>/dev/null || true
chown root:root /etc/NetworkManager/dispatcher.d/* 2>/dev/null || true
chmod 0755 /etc/NetworkManager/dispatcher.d/* 2>/dev/null || true

log "Validiere NetworkManager-Keyfiles"
for f in /etc/NetworkManager/system-connections/*.nmconnection; do
  [[ -f "$f" ]] || continue
  grep -q '^\[connection\]' "$f" || warn "Ungültiges Profil: $f"
done

if [[ "$APPLY_NETWORK" == "1" ]]; then
  log "Aktiviere NetworkManager-Konfiguration"
  nmcli connection reload
  systemctl restart NetworkManager
  sleep 3
  nmcli connection up br-lan || warn "br-lan konnte nicht automatisch aktiviert werden."
  ip -br link show br-lan || true
else
  log "Konfiguration vorbereitet, aber nicht aktiviert"
  echo "Aktivierung lokal an der Konsole:"
  echo "  sudo APPLY_NETWORK=1 $0 '$SRC'"
fi