#!/usr/bin/env bash
# One-time install of the yaris-obd phone/home/local-hotspot auto-switch
# watcher on the Pi. Run this ON THE PI as the `yaris` user (needs sudo):
#   cd /home/yaris/app/yaris-obd && bash deploy/install_netwatch.sh
#
# Prerequisite: the "home-wifi" and "Hotspot" NetworkManager profiles must
# already exist (see PLAN.md Phase 6). The optional "phone-hotspot" profile is
# created through the Settings page.
#
# Since 2026-08-14 (FEAT-14): dual T3U — wlan1 (T3U #1) hosts the in-car AP
# ("Hotspot-local"), and a second T3U (wlan2) carries the internet uplink
# (home-wifi / phone-hotspot); the onboard BCM43438 (wlan0) is the fallback.
set -euo pipefail

REPO_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
WLAN=wlan2    # T3U #2 — internet uplink
WLAN_FB=wlan0 # onboard BCM43438 — uplink fallback
AP_IFACE=wlan1 # T3U #1 — hosts the in-car AP

sudo systemctl stop yaris-uplink-wait.service 2>/dev/null || true
sudo systemctl stop yaris-netwatch.timer yaris-netwatch.service 2>/dev/null || true
sudo rm -f /usr/local/bin/yaris-netwatch.sh
sudo install -m 755 "$REPO_DIR/deploy/yaris_uplink.py" /usr/local/bin/yaris-uplink
sudo install -m 440 "$REPO_DIR/deploy/yaris-uplink.sudoers" /etc/sudoers.d/yaris-uplink
sudo visudo -cf /etc/sudoers.d/yaris-uplink
# Passwordless nmcli on the Hotspot-local profile so the Settings page can
# change the in-car hotspot SSID/password at runtime (FEAT-11).
sudo install -m 440 "$REPO_DIR/deploy/yaris-hotspot.sudoers" /etc/sudoers.d/yaris-hotspot
sudo visudo -cf /etc/sudoers.d/yaris-hotspot
sudo install -m 644 "$REPO_DIR/deploy/yaris-hotspot-dns.conf" \
    /etc/NetworkManager/dnsmasq-shared.d/yaris-hotspot-dns.conf
sudo install -m 755 "$REPO_DIR/deploy/90-yaris-uplink" \
    /etc/NetworkManager/dispatcher.d/90-yaris-uplink

# Bind the internet uplink to the second T3U (wlan2)
sudo nmcli connection modify home-wifi connection.interface-name "$WLAN"
# The in-car AP lives on T3U #1 (wlan1), forced to 5GHz
sudo nmcli connection modify Hotspot-local \
    connection.interface-name "$AP_IFACE" \
    802-11-wireless.band a \
    ipv4.method shared \
    ipv4.addresses 10.42.0.1/24
if nmcli connection show phone-hotspot >/dev/null 2>&1; then
    sudo nmcli connection modify phone-hotspot \
        connection.interface-name "$WLAN" \
        ipv4.dhcp-send-hostname yes \
        ipv4.dhcp-hostname yaris \
        802-11-wireless.mtu 1400
fi

# Create wlan0 fallback profile (lower autoconnect-priority so wlan2 wins)
# home-wifi-fb: same SSID as home-wifi but on wlan0 (onboard)
HOME_SSID=$(nmcli -g 802-11-wireless.ssid connection show home-wifi 2>/dev/null || true)
HOME_PSK=$(sudo nmcli -g 802-11-wireless-security.psk connection show --show-secrets home-wifi 2>/dev/null || true)
if [ -n "$HOME_SSID" ] && [ -n "$HOME_PSK" ]; then
    sudo nmcli connection delete home-wifi-fb 2>/dev/null || true
    sudo nmcli connection add \
        type wifi \
        con-name home-wifi-fb \
        ifname "$WLAN_FB" \
        ssid "$HOME_SSID" \
        wifi-sec.key-mgmt wpa-psk \
        wifi-sec.psk "$HOME_PSK" \
        connection.autoconnect no \
        connection.autoconnect-priority 5
    echo "Created home-wifi-fb fallback on $WLAN_FB"
fi

# Re-enable wlan0 (onboard) as a managed low-priority fallback
sudo nmcli device set "$WLAN_FB" managed yes 2>/dev/null || true

sudo cp "$REPO_DIR/deploy/yaris-netwatch.service" /etc/systemd/system/yaris-netwatch.service
sudo cp "$REPO_DIR/deploy/yaris-netwatch.timer" /etc/systemd/system/yaris-netwatch.timer
sudo cp "$REPO_DIR/deploy/yaris-uplink-wait.service" /etc/systemd/system/yaris-uplink-wait.service
sudo systemctl daemon-reload
sudo systemctl enable --now yaris-netwatch.timer

echo "Done. Check status with: systemctl status yaris-netwatch.timer"
echo "Logs: journalctl -t yaris-netwatch -f"