park

#!/usr/bin/env bash
set -euo pipefail

# =============================================================
# proxypark – Local reverse-proxy & DNS manager for macOS
# https://github.com/McGo/proxypark
# =============================================================
# Traefik + dnsmasq + mkcert. Zero port conflicts.
# Uses file-provider only (no Docker socket required).
# =============================================================

VERSION="0.1.0"
PARK_DIR="$(cd "$(dirname "$(readlink -f "$0" 2>/dev/null || realpath "$0")")/.." && pwd)"
DATA_DIR="${PROXYPARK_DATA_DIR:-$HOME/.proxypark}"
CERTS_DIR="$DATA_DIR/certs"
DYNAMIC_DIR="$DATA_DIR/dynamic"
COMPOSE_FILE="$DATA_DIR/docker-compose.yml"
TLD="${PROXYPARK_TLD:-test}"

# Homebrew prefix (Apple Silicon vs Intel)
if [ -d "/opt/homebrew" ]; then
    BREW_PREFIX="/opt/homebrew"
else
    BREW_PREFIX="/usr/local"
fi
DNSMASQ_CONF_DIR="$BREW_PREFIX/etc/dnsmasq.d"

# ─── Colors ──────────────────────────────────────────────────

RED=$'\033[0;31m'
GREEN=$'\033[0;32m'
YELLOW=$'\033[1;33m'
BLUE=$'\033[0;34m'
CYAN=$'\033[0;36m'
BOLD=$'\033[1m'
DIM=$'\033[2m'
NC=$'\033[0m'

# ─── Helpers ─────────────────────────────────────────────────

info()    { echo -e "  ${BLUE}→${NC} $*"; }
success() { echo -e "  ${GREEN}✔${NC} $*"; }
warn()    { echo -e "  ${YELLOW}⚠${NC} $*"; }
error()   { echo -e "  ${RED}✖${NC} $*" >&2; }

slugify() {
    echo "$1" | tr '[:upper:]' '[:lower:]' | sed 's/[^a-z0-9-]/-/g' | sed 's/--*/-/g' | sed 's/^-//;s/-$//'
}

ensure_running() {
    if ! docker compose -f "$COMPOSE_FILE" ps --status running 2>/dev/null | grep -q proxypark; then
        error "Traefik is not running. Start with: park start"
        exit 1
    fi
}

# ─── Certificate Management ─────────────────────────────────
# .test is on the Public Suffix List — browsers reject wildcard
# certs for PSL TLDs. We generate explicit certs for each
# linked domain and regenerate whenever links change.
# ─────────────────────────────────────────────────────────────

collect_domains() {
    local domains=("localhost")

    # Extract domains from all link-*.yml files
    if compgen -G "$DYNAMIC_DIR/link-*.yml" > /dev/null 2>&1; then
        for f in "$DYNAMIC_DIR"/link-*.yml; do
            local domain
            domain=$(sed -n "s/.*Host(\`\([^\`]*\).*/\1/p" "$f" 2>/dev/null | head -1)
            if [ -n "$domain" ]; then
                domains+=("$domain")
            fi
        done
    fi

    # Extract domains from valet catchall (skip, it's a regex)
    # Deduplicate and sort
    printf '%s\n' "${domains[@]}" | sort -u
}

regenerate_certs() {
    local domains
    domains=$(collect_domains)

    if [ -z "$domains" ]; then
        warn "No domains found, skipping cert generation."
        return
    fi

    local domain_args=()
    while IFS= read -r d; do
        domain_args+=("$d")
    done <<< "$domains"

    info "Generating certs for: ${domain_args[*]}"

    (cd "$CERTS_DIR" && mkcert \
        -cert-file "wildcard.${TLD}.pem" \
        -key-file "wildcard.${TLD}-key.pem" \
        "${domain_args[@]}")

    success "Certificates updated (${#domain_args[@]} domains)"

    # Restart Traefik to pick up new certificate
    docker compose -f "$COMPOSE_FILE" restart >/dev/null 2>&1 && \
        success "Traefik restarted" || true
}

# ─── install ─────────────────────────────────────────────────

cmd_install() {
    echo ""
    echo -e "  ${BOLD}${CYAN}proxypark v${VERSION}${NC} – Installation"
    echo -e "  ${DIM}────────────────────────────────────${NC}"
    echo ""

    # --- Homebrew check ---
    if ! command -v brew &>/dev/null; then
        error "Homebrew is required. Install from https://brew.sh"
        exit 1
    fi

    # --- mkcert ---
    info "Checking mkcert..."
    if ! command -v mkcert &>/dev/null; then
        info "Installing mkcert + nss (Firefox support)..."
        brew install mkcert nss
    fi
    mkcert -install 2>/dev/null || true
    success "mkcert & local CA ready"

    # --- dnsmasq ---
    info "Checking dnsmasq..."
    if ! brew list dnsmasq &>/dev/null 2>&1; then
        info "Installing dnsmasq..."
        brew install dnsmasq
    fi

    # Ensure conf-dir include
    local dnsmasq_main="$BREW_PREFIX/etc/dnsmasq.conf"
    mkdir -p "$DNSMASQ_CONF_DIR"
    if ! grep -q "conf-dir=$DNSMASQ_CONF_DIR" "$dnsmasq_main" 2>/dev/null; then
        echo "conf-dir=$DNSMASQ_CONF_DIR/,*.conf" >> "$dnsmasq_main"
    fi

    # TLD config
    cat > "$DNSMASQ_CONF_DIR/proxypark-${TLD}.conf" <<EOF
# proxypark – resolve *.${TLD} to localhost
address=/.${TLD}/127.0.0.1
EOF

    sudo brew services restart dnsmasq
    success "dnsmasq configured: *.${TLD} → 127.0.0.1"

    # macOS resolver
    info "Setting up macOS DNS resolver..."
    sudo mkdir -p /etc/resolver
    echo "nameserver 127.0.0.1" | sudo tee /etc/resolver/${TLD} > /dev/null
    success "/etc/resolver/${TLD} created"

    # --- Data directories ---
    mkdir -p "$DATA_DIR" "$CERTS_DIR" "$DYNAMIC_DIR"

    # --- Docker network ---
    info "Creating Docker network 'proxy'..."
    docker network create proxy 2>/dev/null \
        && success "Network 'proxy' created" \
        || success "Network 'proxy' already exists"

    # --- Initial certificates ---
    info "Generating initial certificates..."
    if [ ! -f "$CERTS_DIR/wildcard.${TLD}.pem" ]; then
        (cd "$CERTS_DIR" && mkcert \
            -cert-file "wildcard.${TLD}.pem" \
            -key-file "wildcard.${TLD}-key.pem" \
            "localhost")
        success "Initial certificate created"
    else
        success "Certificates already exist"
    fi

    # --- TLS dynamic config ---
    cat > "$DYNAMIC_DIR/tls.yml" <<EOF
tls:
  certificates:
    - certFile: /etc/traefik/certs/wildcard.${TLD}.pem
      keyFile: /etc/traefik/certs/wildcard.${TLD}-key.pem
  stores:
    default:
      defaultCertificate:
        certFile: /etc/traefik/certs/wildcard.${TLD}.pem
        keyFile: /etc/traefik/certs/wildcard.${TLD}-key.pem
EOF

    # --- Traefik compose ---
    # File-provider only. No Docker socket needed.
    cat > "$COMPOSE_FILE" <<EOF
services:
  traefik:
    image: traefik:v3.2
    container_name: proxypark
    restart: unless-stopped
    command:
      - --api.insecure=true
      - --entrypoints.web.address=:80
      - --entrypoints.web.http.redirections.entrypoint.to=websecure
      - --entrypoints.websecure.address=:443
      - --entrypoints.websecure.http.tls=true
      - --providers.file.directory=/etc/traefik/dynamic
      - --providers.file.watch=true
      - --log.level=INFO
    ports:
      - "80:80"
      - "443:443"
      - "8080:8080"
    volumes:
      - ${DYNAMIC_DIR}:/etc/traefik/dynamic:ro
      - ${CERTS_DIR}:/etc/traefik/certs:ro
    networks:
      - proxy
    extra_hosts:
      - "host.docker.internal:host-gateway"

networks:
  proxy:
    name: proxy
    external: true
EOF

    # --- Start ---
    echo ""
    cmd_start

    echo ""
    echo -e "  ${BOLD}${GREEN}Installation complete!${NC}"
    echo ""
    echo -e "  Dashboard:     ${CYAN}http://localhost:8080${NC}"
    echo -e "  DNS:           *.${TLD} → 127.0.0.1"
    echo -e "  HTTPS:         mkcert per-domain certificates"
    echo ""
    echo -e "  Get started:"
    echo -e "    ${BOLD}park link myapp 8000${NC}         → https://myapp.${TLD}"
    echo -e "    ${BOLD}park scaffold projekt${NC}        → docker-compose.yml template"
    echo -e "    ${BOLD}park list${NC}                    → show all routes"
    echo ""
}

# ─── uninstall ───────────────────────────────────────────────

cmd_uninstall() {
    echo ""
    echo -e "  ${BOLD}${CYAN}Uninstall proxypark${NC}"
    echo ""
    warn "This removes Traefik, dnsmasq config, certs, and all links."
    echo ""
    read -p "  Continue? (y/N) " -n 1 -r
    echo ""
    [[ $REPLY =~ ^[Yy]$ ]] || exit 0

    if [ -f "$COMPOSE_FILE" ]; then
        docker compose -f "$COMPOSE_FILE" down 2>/dev/null || true
        success "Traefik stopped and removed"
    fi

    docker network rm proxy 2>/dev/null && success "Network 'proxy' removed" || true

    rm -f "$DNSMASQ_CONF_DIR/proxypark-${TLD}.conf" 2>/dev/null
    sudo brew services restart dnsmasq 2>/dev/null || true
    success "dnsmasq config removed"

    sudo rm -f "/etc/resolver/${TLD}" 2>/dev/null
    success "DNS resolver removed"

    rm -rf "$DATA_DIR"
    success "~/.proxypark removed"

    echo ""
    echo -e "  ${GREEN}Uninstall complete.${NC}"
    echo ""
}

# ─── start / stop / restart ─────────────────────────────────

cmd_start() {
    info "Starting Traefik..."
    docker compose -f "$COMPOSE_FILE" up -d --quiet-pull
    success "Traefik running – Dashboard: ${CYAN}http://localhost:8080${NC}"
}

cmd_stop() {
    info "Stopping Traefik..."
    docker compose -f "$COMPOSE_FILE" down
    success "Traefik stopped"
}

cmd_restart() {
    info "Restarting Traefik..."
    docker compose -f "$COMPOSE_FILE" restart
    success "Traefik restarted"
}

# ─── link ────────────────────────────────────────────────────

# ─── parse name into sub + domain ────────────────────────────
# "api.myapp" → sub=api, name=myapp
# "myapp"     → sub="",  name=myapp

parse_link_name() {
    local input="$1"
    if [[ "$input" == *.* ]]; then
        LINK_SUB="$(slugify "${input%%.*}")"
        LINK_NAME="$(slugify "${input#*.}")"
    else
        LINK_SUB=""
        LINK_NAME="$(slugify "$input")"
    fi

    # Derived values
    if [ -n "$LINK_SUB" ]; then
        LINK_DOMAIN="${LINK_SUB}.${LINK_NAME}.${TLD}"
        LINK_FILE_ID="${LINK_SUB}-${LINK_NAME}"
    else
        LINK_DOMAIN="${LINK_NAME}.${TLD}"
        LINK_FILE_ID="${LINK_NAME}"
    fi
}

# ─── link ────────────────────────────────────────────────────

cmd_link() {
    local input="${1:-}"
    local port="${2:-}"

    if [ -z "$input" ] || [ -z "$port" ]; then
        echo ""
        echo "  Usage: park link <name> <port>"
        echo ""
        echo "  Links a local service. Use dot notation for subdomains."
        echo ""
        echo "  Examples:"
        echo "    park link myshop 8000        → https://myshop.${TLD}"
        echo "    park link api.myshop 8001    → https://api.myshop.${TLD}"
        echo ""
        exit 1
    fi

    parse_link_name "$input"

    if [[ ! "$port" =~ ^[0-9]+$ ]] || [ "$port" -lt 1 ] || [ "$port" -gt 65535 ]; then
        error "Port must be between 1 and 65535."
        exit 1
    fi

    mkdir -p "$DYNAMIC_DIR"

    cat > "$DYNAMIC_DIR/link-${LINK_FILE_ID}.yml" <<EOF
# proxypark link: ${LINK_DOMAIN} → localhost:${port}
http:
  routers:
    link-${LINK_FILE_ID}:
      rule: "Host(\`${LINK_DOMAIN}\`)"
      entrypoints:
        - websecure
      service: link-${LINK_FILE_ID}
      tls: {}

  services:
    link-${LINK_FILE_ID}:
      loadBalancer:
        servers:
          - url: "http://host.docker.internal:${port}"
EOF

    success "Linked: ${CYAN}https://${LINK_DOMAIN}${NC} → localhost:${port}"

    # Regenerate certs to include new domain
    regenerate_certs
}

# ─── link:docker ─────────────────────────────────────────────

cmd_link_docker() {
    local input="${1:-}"
    local container_arg="${2:-}"

    if [ -z "$input" ] || [ -z "$container_arg" ]; then
        echo ""
        echo "  Usage: park link:docker <name> <container>[:<port>]"
        echo ""
        echo "  Links a Docker container without exposed ports."
        echo "  Use dot notation for subdomains."
        echo ""
        echo "  Examples:"
        echo "    park link:docker myapp myapp-container          → https://myapp.${TLD}"
        echo "    park link:docker myapp myapp-container:3000     → https://myapp.${TLD}"
        echo "    park link:docker api.myapp myapp-container      → https://api.myapp.${TLD}"

        # Show available services from compose in CWD
        local compose_file=""
        for f in docker-compose.yml docker-compose.yaml compose.yml compose.yaml; do
            if [ -f "$f" ]; then compose_file="$f"; break; fi
        done
        if [ -n "$compose_file" ]; then
            local config_yaml
            config_yaml=$(docker compose config 2>/dev/null)
            if [ -n "$config_yaml" ]; then
                local services
                services=$(docker compose config --services 2>/dev/null)
                if [ -n "$services" ]; then
                    echo ""
                    echo -e "  ${BOLD}Services${NC} ${DIM}(from ${compose_file})${NC}"
                    echo ""
                    printf "  ${DIM}%-25s  %-25s  %s${NC}\n" "SERVICE" "CONTAINER" "STATE"
                    echo -e "  ${DIM}$(printf '─%.0s' {1..60})${NC}"
                    while IFS= read -r svc; do
                        local cname cstate
                        # Get container_name from compose config YAML (works even when stopped)
                        # Match: "  service:\n    container_name: name" in YAML output
                        cname=$(echo "$config_yaml" | sed -n "/^  ${svc}:/,/^  [^ ]/{ s/^    container_name: *//p; }" | head -1)
                        if [ -z "$cname" ]; then
                            cname="${DIM}(set container_name in compose)${NC}"
                        fi
                        cstate=$(docker compose ps --format '{{.State}}' "$svc" 2>/dev/null | head -1)
                        cstate=${cstate:-stopped}
                        local state_color="${RED}"
                        [ "$cstate" = "running" ] && state_color="${GREEN}"
                        printf "  %-25s  %-25b  ${state_color}%s${NC}\n" "$svc" "$cname" "$cstate"
                    done <<< "$services"
                fi
            fi
        fi

        echo ""
        exit 1
    fi

    parse_link_name "$input"

    # Parse container:port
    local container port
    if [[ "$container_arg" == *:* ]]; then
        container="${container_arg%%:*}"
        port="${container_arg##*:}"
    else
        container="$container_arg"
        port="80"
    fi

    if [[ ! "$port" =~ ^[0-9]+$ ]] || [ "$port" -lt 1 ] || [ "$port" -gt 65535 ]; then
        error "Port must be between 1 and 65535."
        exit 1
    fi

    # Validate container is running
    local running
    running=$(docker inspect --format '{{.State.Running}}' "$container" 2>/dev/null || echo "")
    if [ "$running" != "true" ]; then
        error "Container '${container}' is not running."
        exit 1
    fi

    # Connect container to proxy network if needed
    local networks
    networks=$(docker inspect --format '{{json .NetworkSettings.Networks}}' "$container" 2>/dev/null)
    if ! echo "$networks" | grep -q '"proxy"'; then
        info "Connecting '${container}' to proxy network..."
        docker network connect proxy "$container" 2>/dev/null \
            && success "Connected to proxy network" \
            || { error "Failed to connect '${container}' to proxy network."; exit 1; }
    fi

    mkdir -p "$DYNAMIC_DIR"

    local file_id="docker-${LINK_FILE_ID}"

    # Warn if a conflicting localhost link exists
    if [ -f "$DYNAMIC_DIR/link-${LINK_FILE_ID}.yml" ]; then
        warn "A localhost link for '${LINK_DOMAIN}' already exists. It will take precedence."
    fi

    cat > "$DYNAMIC_DIR/link-${file_id}.yml" <<EOF
# proxypark docker-link: ${LINK_DOMAIN} → ${container}:${port}
http:
  routers:
    link-${file_id}:
      rule: "Host(\`${LINK_DOMAIN}\`)"
      entrypoints:
        - websecure
      service: link-${file_id}
      tls: {}

  services:
    link-${file_id}:
      loadBalancer:
        servers:
          - url: "http://${container}:${port}"
EOF

    success "Linked: ${CYAN}https://${LINK_DOMAIN}${NC} → ${container}:${port}"

    # Regenerate certs to include new domain
    regenerate_certs

    # Check compose file for persistence
    check_compose_persistence "$container"
}

# ─── compose persistence check ──────────────────────────────

check_compose_persistence() {
    local container="$1"

    # Find compose file in CWD
    local compose_file=""
    for f in docker-compose.yml docker-compose.yaml compose.yml compose.yaml; do
        if [ -f "$f" ]; then compose_file="$f"; break; fi
    done
    [ -z "$compose_file" ] && return

    # Find the service that matches this container
    local svc_name=""

    # First try: match by container_name in config
    local config_yaml
    config_yaml=$(docker compose config 2>/dev/null) || return
    svc_name=$(echo "$config_yaml" | sed -n "/container_name: ${container}$/{ x; p; }; h" | sed -n 's/^  \([a-zA-Z0-9_-]*\):$/\1/p' | head -1)

    # Second try: match by running container name via docker compose ps
    if [ -z "$svc_name" ]; then
        svc_name=$(docker compose ps --format '{{.Service}}\t{{.Name}}' 2>/dev/null | awk -F'\t' -v c="$container" '$2 == c { print $1; exit }')
    fi

    # Third try: match by service name directly
    if [ -z "$svc_name" ]; then
        local services
        services=$(docker compose config --services 2>/dev/null)
        while IFS= read -r s; do
            if [ "$s" = "$container" ]; then
                svc_name="$s"
                break
            fi
        done <<< "$services"
    fi

    [ -z "$svc_name" ] && return

    local needs_fix=0
    local missing_container_name=0
    local missing_proxy_network=0

    # Check container_name in the actual compose file (not rendered config)
    if ! grep -q "container_name:" "$compose_file" 2>/dev/null || \
       ! sed -n "/^  ${svc_name}:/,/^  [^ ]/p" "$compose_file" | grep -q "container_name:"; then
        missing_container_name=1
        needs_fix=1
    fi

    # Check proxy network on service in actual compose file
    local svc_block
    svc_block=$(sed -n "/^  ${svc_name}:/,/^  [^ ]/p" "$compose_file")
    if ! echo "$svc_block" | grep -q "proxy"; then
        missing_proxy_network=1
        needs_fix=1
    fi

    # Check top-level proxy network definition
    local missing_top_network=0
    if ! grep -q "external: *true" "$compose_file" 2>/dev/null || \
       ! sed -n '/^networks:/,$ p' "$compose_file" | grep -q "proxy"; then
        missing_top_network=1
        needs_fix=1
    fi

    [ "$needs_fix" -eq 0 ] && return

    echo ""
    warn "Your ${compose_file} is missing config for persistent proxy support:"
    [ "$missing_container_name" -eq 1 ] && echo -e "    ${DIM}• container_name: ${container}  (service: ${svc_name})${NC}"
    [ "$missing_proxy_network" -eq 1 ] && echo -e "    ${DIM}• proxy network on service '${svc_name}'${NC}"
    [ "$missing_top_network" -eq 1 ] && echo -e "    ${DIM}• top-level proxy network definition${NC}"
    echo ""
    echo -en "  Fix ${compose_file} automatically? [Y/n] "
    read -r answer
    answer=${answer:-Y}

    if [[ ! "$answer" =~ ^[Yy]$ ]]; then
        info "Skipped. Add manually to avoid 'bad gateway' after container restart."
        return
    fi

    # Apply fixes
    if [ "$missing_container_name" -eq 1 ]; then
        # Add container_name after the service key
        sed -i '' "/^  ${svc_name}:/a\\
\\    container_name: ${container}
" "$compose_file"
        success "Added container_name: ${container}"
    fi

    if [ "$missing_proxy_network" -eq 1 ]; then
        # Check if service already has a networks: key
        if echo "$svc_block" | grep -q "^    networks:"; then
            # Add proxy to existing networks list
            sed -i '' "/^  ${svc_name}:/,/^  [^ ]/{
                /^    networks:/a\\
\\      - proxy
            }" "$compose_file"
        else
            # Find the last line of the service block and add networks before it
            sed -i '' "/^  ${svc_name}:/,/^  [^ ]/{
                /^  ${svc_name}:/a\\
\\    networks:\\
\\      - default\\
\\      - proxy
            }" "$compose_file"
        fi
        success "Added proxy network to service '${svc_name}'"
    fi

    if [ "$missing_top_network" -eq 1 ]; then
        # Check if top-level networks: key exists
        if grep -q "^networks:" "$compose_file"; then
            # Add proxy under existing networks key
            sed -i '' "/^networks:/a\\
\\  proxy:\\
\\    external: true
" "$compose_file"
        else
            # Append networks block
            printf '\nnetworks:\n  proxy:\n    external: true\n' >> "$compose_file"
        fi
        success "Added top-level proxy network definition"
    fi
}

# ─── unlink ──────────────────────────────────────────────────

cmd_unlink() {
    local name="${1:-}"

    if [ -z "$name" ]; then
        echo "  Usage: park unlink <name>"
        exit 1
    fi

    name="$(slugify "$name")"
    local found=0

    for f in "$DYNAMIC_DIR"/link-*"${name}".yml "$DYNAMIC_DIR"/link-*"-${name}".yml; do
        if [ -f "$f" ]; then
            rm "$f"
            success "Removed: $(basename "$f" .yml)"
            found=1
        fi
    done

    if [ "$found" -eq 0 ]; then
        error "No link found for '${name}'"
        exit 1
    fi

    # Regenerate certs without removed domain
    regenerate_certs
}

# ─── list ────────────────────────────────────────────────────

cmd_list() {
    echo ""
    echo -e "  ${BOLD}${CYAN}proxypark routes${NC}"
    echo ""

    local has_links=0

    # File-provider links
    if compgen -G "$DYNAMIC_DIR/link-*.yml" > /dev/null 2>&1; then
        printf "  ${DIM}%-35s  %-25s  %s${NC}\n" "DOMAIN" "TARGET" "CONFIG"
        echo -e "  ${DIM}$(printf '─%.0s' {1..75})${NC}"

        for f in "$DYNAMIC_DIR"/link-*.yml; do
            local domain target filename url
            domain=$(sed -n "s/.*Host(\`\([^\`]*\).*/\1/p" "$f" 2>/dev/null | head -1)
            domain=${domain:-?}
            url=$(sed -n 's/.*url: *"\(.*\)"/\1/p' "$f" 2>/dev/null | head -1)
            if echo "$url" | grep -q 'host.docker.internal'; then
                target=":$(echo "$url" | sed 's/.*://')"
            else
                target=$(echo "$url" | sed 's|http://||')
            fi
            target=${target:-?}
            filename=$(basename "$f")
            printf "  %-35s  %-25s  ${DIM}%s${NC}\n" "https://${domain}" "$target" "$filename"
        done
        has_links=1
        echo ""
    fi

    # Valet catchall
    if [ -f "$DYNAMIC_DIR/valet.yml" ]; then
        echo -e "  ${DIM}Valet catchall active → http://host.docker.internal:8080${NC}"
        echo ""
    fi

    if [ "$has_links" -eq 0 ]; then
        echo "  No routes registered yet."
        echo ""
        echo "  Get started:"
        echo "    park link myapp 8000"
        echo "    park scaffold myproject"
        echo ""
    fi
}

# ─── status ──────────────────────────────────────────────────

cmd_status() {
    echo ""
    echo -e "  ${BOLD}${CYAN}proxypark status${NC}"
    echo ""

    # Traefik
    echo -n "  Traefik:     "
    if docker compose -f "$COMPOSE_FILE" ps --status running 2>/dev/null | grep -q proxypark; then
        echo -e "${GREEN}running${NC}"
    else
        echo -e "${RED}stopped${NC}"
    fi

    # dnsmasq
    echo -n "  dnsmasq:     "
    if pgrep -x dnsmasq &>/dev/null; then
        echo -e "${GREEN}running${NC}"
    else
        echo -e "${RED}stopped${NC}"
    fi

    # DNS probe
    echo -n "  DNS:         "
    local dns_result
    dns_result=$(dig +short "probe.${TLD}" @127.0.0.1 2>/dev/null | head -1)
    if [ "$dns_result" = "127.0.0.1" ]; then
        echo -e "${GREEN}OK${NC} ${DIM}(probe.${TLD} → 127.0.0.1)${NC}"
    else
        echo -e "${RED}FAIL${NC} ${DIM}(dnsmasq not resolving)${NC}"
    fi

    # Resolver
    echo -n "  Resolver:    "
    if [ -f "/etc/resolver/${TLD}" ]; then
        echo -e "${GREEN}/etc/resolver/${TLD}${NC}"
    else
        echo -e "${RED}missing${NC}"
    fi

    # Certs
    echo -n "  Certs:       "
    if [ -f "$CERTS_DIR/wildcard.${TLD}.pem" ]; then
        local cert_domains
        cert_domains=$(openssl x509 -in "$CERTS_DIR/wildcard.${TLD}.pem" -noout -ext subjectAltName 2>/dev/null \
            | sed 's/,/\n/g' | sed -n 's/.*DNS://p' | tr -s ' \n' ' ' || echo "unknown")
        echo -e "${GREEN}valid${NC} ${DIM}(${cert_domains})${NC}"
    else
        echo -e "${RED}missing${NC}"
    fi

    # Docker network
    echo -n "  Network:     "
    if docker network inspect proxy &>/dev/null 2>&1; then
        local containers
        containers=$(docker network inspect proxy --format '{{len .Containers}}' 2>/dev/null || echo 0)
        echo -e "${GREEN}proxy${NC} ${DIM}(${containers} containers)${NC}"
    else
        echo -e "${RED}not found${NC}"
    fi

    # Links
    local link_count=0
    if compgen -G "$DYNAMIC_DIR/link-*.yml" > /dev/null 2>&1; then
        link_count=$(ls "$DYNAMIC_DIR"/link-*.yml 2>/dev/null | wc -l | tr -d ' ')
    fi
    echo "  Links:       ${link_count} registered"
    echo ""
}

# ─── doctor ─────────────────────────────────────────────────

doctor_ok()   { printf "  ${GREEN}✔${NC} %-18s %s\n" "$1" "$2"; }
doctor_warn() { printf "  ${YELLOW}⚠${NC} %-18s %s\n" "$1" "$2"; }
doctor_fail() { printf "  ${RED}✖${NC} %-18s %s\n" "$1" "$2"; DOCTOR_ISSUES=$((DOCTOR_ISSUES + 1)); }

doctor_ask_fix() {
    local prompt="$1"
    if [ "$DOCTOR_AUTOFIX" = "1" ]; then
        return 0
    fi
    echo -en "    → ${prompt} [Y/n] "
    local answer
    read -r answer
    answer=${answer:-Y}
    [[ "$answer" =~ ^[Yy]$ ]]
}

cmd_doctor() {
    local DOCTOR_ISSUES=0
    local DOCTOR_AUTOFIX=0
    [ "${1:-}" = "--fix" ] && DOCTOR_AUTOFIX=1

    echo ""
    echo -e "  ${BOLD}${CYAN}proxypark doctor${NC}"
    echo ""

    # ── 1. Docker daemon ──
    if docker info &>/dev/null; then
        doctor_ok "Docker" "running"
    else
        doctor_fail "Docker" "not running"
        echo -e "    ${DIM}Start Docker Desktop or your Docker runtime manually.${NC}"
        echo ""
        echo -e "  ${RED}Cannot continue without Docker.${NC}"
        echo ""
        return 1
    fi

    # ── 2. Port 80 ──
    local port80_pid
    port80_pid=$(lsof -ti :80 2>/dev/null | head -1)
    if [ -z "$port80_pid" ]; then
        doctor_ok "Port 80" "available"
    else
        local port80_name
        port80_name=$(lsof -i :80 -sTCP:LISTEN 2>/dev/null | awk 'NR==2{print $1}')
        if [ "$port80_name" = "com.docke" ] || [ "$port80_name" = "docker-pr" ]; then
            doctor_ok "Port 80" "used by proxypark"
        else
            doctor_fail "Port 80" "occupied by ${port80_name:-unknown} (PID ${port80_pid})"
            echo -e "    ${DIM}Stop the other service or change its port.${NC}"
        fi
    fi

    # ── 3. Port 443 ──
    local port443_pid
    port443_pid=$(lsof -ti :443 2>/dev/null | head -1)
    if [ -z "$port443_pid" ]; then
        doctor_ok "Port 443" "available"
    else
        local port443_name
        port443_name=$(lsof -i :443 -sTCP:LISTEN 2>/dev/null | awk 'NR==2{print $1}')
        if [ "$port443_name" = "com.docke" ] || [ "$port443_name" = "docker-pr" ]; then
            doctor_ok "Port 443" "used by proxypark"
        else
            doctor_fail "Port 443" "occupied by ${port443_name:-unknown} (PID ${port443_pid})"
            echo -e "    ${DIM}Stop the other service or change its port.${NC}"
        fi
    fi

    # ── 4. Docker network ──
    if docker network inspect proxy &>/dev/null 2>&1; then
        doctor_ok "Network" "proxy exists"
    else
        doctor_fail "Network" "proxy not found"
        if doctor_ask_fix "Create proxy network?"; then
            docker network create proxy &>/dev/null \
                && doctor_ok "Network" "proxy created (fixed)" \
                || echo -e "    ${RED}Failed to create network.${NC}"
        fi
    fi

    # ── 5. Traefik ──
    if docker compose -f "$COMPOSE_FILE" ps --status running 2>/dev/null | grep -q proxypark; then
        doctor_ok "Traefik" "running"
    else
        doctor_fail "Traefik" "not running"
        if [ -f "$COMPOSE_FILE" ]; then
            if doctor_ask_fix "Start Traefik?"; then
                docker compose -f "$COMPOSE_FILE" up -d &>/dev/null \
                    && doctor_ok "Traefik" "running (fixed)" \
                    || echo -e "    ${RED}Failed to start Traefik.${NC}"
            fi
        else
            echo -e "    ${DIM}Run 'park install' first.${NC}"
        fi
    fi

    # ── 6. Homebrew ──
    if command -v brew &>/dev/null; then
        doctor_ok "Homebrew" "installed"
    else
        doctor_fail "Homebrew" "not found"
        echo -e "    ${DIM}Install from https://brew.sh${NC}"
    fi

    # ── 7. mkcert ──
    if command -v mkcert &>/dev/null; then
        doctor_ok "mkcert" "installed"
    else
        doctor_fail "mkcert" "not installed"
        if command -v brew &>/dev/null && doctor_ask_fix "Install mkcert?"; then
            brew install mkcert nss &>/dev/null \
                && mkcert -install &>/dev/null \
                && doctor_ok "mkcert" "installed (fixed)" \
                || echo -e "    ${RED}Failed to install mkcert.${NC}"
        fi
    fi

    # ── 8. dnsmasq installed ──
    if brew list dnsmasq &>/dev/null 2>&1; then
        doctor_ok "dnsmasq" "installed"
    else
        doctor_fail "dnsmasq" "not installed"
        if doctor_ask_fix "Install dnsmasq?"; then
            brew install dnsmasq &>/dev/null \
                && doctor_ok "dnsmasq" "installed (fixed)" \
                || echo -e "    ${RED}Failed to install dnsmasq.${NC}"
        fi
    fi

    # ── 9. dnsmasq running ──
    if pgrep -x dnsmasq &>/dev/null; then
        doctor_ok "dnsmasq" "running"
    else
        doctor_fail "dnsmasq" "not running"
        if doctor_ask_fix "Restart dnsmasq?"; then
            sudo brew services restart dnsmasq &>/dev/null \
                && doctor_ok "dnsmasq" "running (fixed)" \
                || echo -e "    ${RED}Failed to restart dnsmasq.${NC}"
        fi
    fi

    # ── 10. dnsmasq config ──
    local dns_conf="$DNSMASQ_CONF_DIR/proxypark-${TLD}.conf"
    if [ -f "$dns_conf" ] && grep -q "address=/.${TLD}/127.0.0.1" "$dns_conf" 2>/dev/null; then
        doctor_ok "DNS config" "$dns_conf"
    else
        doctor_fail "DNS config" "missing or invalid"
        if doctor_ask_fix "Write dnsmasq config?"; then
            mkdir -p "$DNSMASQ_CONF_DIR"
            cat > "$dns_conf" <<DNSEOF
# proxypark – resolve *.${TLD} to localhost
address=/.${TLD}/127.0.0.1
DNSEOF
            sudo brew services restart dnsmasq &>/dev/null
            doctor_ok "DNS config" "$dns_conf (fixed)"
        fi
    fi

    # ── 11. Resolver ──
    if [ -f "/etc/resolver/${TLD}" ]; then
        doctor_ok "Resolver" "/etc/resolver/${TLD}"
    else
        doctor_fail "Resolver" "/etc/resolver/${TLD} missing"
        if doctor_ask_fix "Create resolver file?"; then
            sudo mkdir -p /etc/resolver
            echo "nameserver 127.0.0.1" | sudo tee "/etc/resolver/${TLD}" > /dev/null \
                && doctor_ok "Resolver" "/etc/resolver/${TLD} (fixed)" \
                || echo -e "    ${RED}Failed to create resolver.${NC}"
        fi
    fi

    # ── 12. DNS resolution ──
    local dns_result
    dns_result=$(dig +short "probe.${TLD}" @127.0.0.1 2>/dev/null | head -1)
    if [ "$dns_result" = "127.0.0.1" ]; then
        doctor_ok "DNS" "probe.${TLD} → 127.0.0.1"
    else
        doctor_fail "DNS" "probe.${TLD} not resolving"
        if doctor_ask_fix "Restart dnsmasq and flush DNS cache?"; then
            sudo brew services restart dnsmasq &>/dev/null
            dscacheutil -flushcache 2>/dev/null
            sleep 1
            dns_result=$(dig +short "probe.${TLD}" @127.0.0.1 2>/dev/null | head -1)
            if [ "$dns_result" = "127.0.0.1" ]; then
                doctor_ok "DNS" "probe.${TLD} → 127.0.0.1 (fixed)"
            else
                echo -e "    ${RED}Still not resolving. Check dnsmasq logs.${NC}"
            fi
        fi
    fi

    # ── 13-15. Certificates ──
    if [ -f "$CERTS_DIR/wildcard.${TLD}.pem" ]; then
        # Check expiry
        local cert_expiry
        cert_expiry=$(openssl x509 -in "$CERTS_DIR/wildcard.${TLD}.pem" -noout -enddate 2>/dev/null \
            | sed 's/notAfter=//')
        local cert_expiry_epoch
        cert_expiry_epoch=$(date -jf "%b %d %T %Y %Z" "$cert_expiry" "+%s" 2>/dev/null || echo "0")
        local now_epoch
        now_epoch=$(date "+%s")
        local days_left=$(( (cert_expiry_epoch - now_epoch) / 86400 ))

        if [ "$days_left" -lt 0 ]; then
            doctor_fail "Certificates" "expired"
            if doctor_ask_fix "Regenerate certificates?"; then
                regenerate_certs
                doctor_ok "Certificates" "regenerated (fixed)"
            fi
        elif [ "$days_left" -lt 30 ]; then
            doctor_warn "Certificates" "expiring in ${days_left} days"
            if doctor_ask_fix "Regenerate certificates?"; then
                regenerate_certs
                doctor_ok "Certificates" "regenerated (fixed)"
            fi
        else
            # Check domain coverage
            local cert_domains
            cert_domains=$(openssl x509 -in "$CERTS_DIR/wildcard.${TLD}.pem" -noout -ext subjectAltName 2>/dev/null \
                | sed 's/,/\n/g' | sed -n 's/.*DNS://p' | tr -s ' ' | sed 's/^ //;s/ $//')
            local linked_domains
            linked_domains=$(collect_domains | grep -v "^localhost$")
            local missing=""
            while IFS= read -r d; do
                if ! echo "$cert_domains" | grep -q "$d"; then
                    missing="${missing} ${d}"
                fi
            done <<< "$linked_domains"

            if [ -n "$missing" ]; then
                doctor_fail "Certificates" "missing domains:${missing}"
                if doctor_ask_fix "Regenerate certificates?"; then
                    regenerate_certs
                    doctor_ok "Certificates" "regenerated (fixed)"
                fi
            else
                local cert_date
                cert_date=$(echo "$cert_expiry" | awk '{print $1, $2, $4}')
                local domain_count
                domain_count=$(echo "$cert_domains" | wc -w | tr -d ' ')
                doctor_ok "Certificates" "valid (expires ${cert_date}, ${domain_count} domains)"
            fi
        fi
    else
        doctor_fail "Certificates" "not found"
        if doctor_ask_fix "Generate certificates?"; then
            regenerate_certs
            doctor_ok "Certificates" "generated (fixed)"
        fi
    fi

    # ── 16. TLS config ──
    if [ -f "$DYNAMIC_DIR/tls.yml" ]; then
        doctor_ok "TLS config" "tls.yml present"
    else
        doctor_fail "TLS config" "tls.yml missing"
        if doctor_ask_fix "Create tls.yml?"; then
            cat > "$DYNAMIC_DIR/tls.yml" <<TLSEOF
tls:
  certificates:
    - certFile: /etc/traefik/certs/wildcard.${TLD}.pem
      keyFile: /etc/traefik/certs/wildcard.${TLD}-key.pem
  stores:
    default:
      defaultCertificate:
        certFile: /etc/traefik/certs/wildcard.${TLD}.pem
        keyFile: /etc/traefik/certs/wildcard.${TLD}-key.pem
TLSEOF
            doctor_ok "TLS config" "tls.yml created (fixed)"
        fi
    fi

    # ── Summary ──
    echo ""
    if [ "$DOCTOR_ISSUES" -eq 0 ]; then
        echo -e "  ${BOLD}${GREEN}All checks passed!${NC}"
    else
        echo -e "  ${BOLD}${RED}${DOCTOR_ISSUES} issue(s) found.${NC}"
        echo -e "  ${DIM}Run 'park doctor --fix' to auto-fix all issues.${NC}"
    fi
    echo ""
}

# ─── scaffold ────────────────────────────────────────────────

cmd_scaffold() {
    local name="${1:-}"

    if [ -z "$name" ]; then
        echo ""
        echo "  Usage: park scaffold <projectname>"
        echo ""
        echo "  Generates a docker-compose.yml with Traefik-compatible"
        echo "  settings in the current directory."
        echo ""
        echo "  Note: proxypark uses file-provider routing. After"
        echo "  'docker compose up -d', register with:"
        echo "    park link <projectname> <nuxt-port>"
        echo "    park link:sub api <projectname> <api-port>"
        echo ""
        exit 1
    fi

    name="$(slugify "$name")"

    local outfile="docker-compose.yml"
    if [ -f "$outfile" ]; then
        warn "$outfile already exists."
        read -p "  Overwrite? (y/N) " -n 1 -r
        echo ""
        [[ $REPLY =~ ^[Yy]$ ]] || exit 0
    fi

    cat > "$outfile" <<EOF
## =============================================================
## ${name} – generated by: park scaffold ${name}
## =============================================================
## After 'docker compose up -d', register routes:
##   park link ${name} 3000
##   park link:sub api ${name} 8080
##
## Then visit:
##   https://${name}.${TLD}
##   https://api.${name}.${TLD}
## =============================================================

services:

  nuxt:
    build: ./docker/nuxt
    ports:
      - "3000"  # Random host port, use 'park link' for routing
    volumes:
      - ./frontend:/app
    environment:
      - NUXT_PUBLIC_API_BASE=https://api.${name}.${TLD}
    networks:
      - internal

  api:
    build: ./docker/api
    ports:
      - "8080"  # Random host port, use 'park link:sub' for routing
    volumes:
      - ./api:/var/www/html
    environment:
      - APP_URL=https://api.${name}.${TLD}
    networks:
      - internal

  db:
    image: postgres:16-alpine
    environment:
      POSTGRES_DB: ${name}
      POSTGRES_USER: app
      POSTGRES_PASSWORD: secret
    volumes:
      - pgdata:/var/lib/postgresql/data
    networks:
      - internal

  redis:
    image: redis:7-alpine
    networks:
      - internal

volumes:
  pgdata:

networks:
  internal:
    driver: bridge
EOF

    echo ""
    success "Created docker-compose.yml for '${name}'"
    echo ""
    echo "  After 'docker compose up -d', register routes:"
    echo ""
    echo -e "    ${BOLD}park link ${name} 3000${NC}"
    echo -e "    ${BOLD}park link:sub api ${name} 8080${NC}"
    echo ""
    echo -e "  Nuxt:  ${CYAN}https://${name}.${TLD}${NC}"
    echo -e "  API:   ${CYAN}https://api.${name}.${TLD}${NC}"
    echo ""
}

# ─── valet ───────────────────────────────────────────────────

cmd_valet() {
    local action="${1:-}"

    case "$action" in
        enable)
            local valet_port="${2:-8080}"
            cat > "$DYNAMIC_DIR/valet.yml" <<EOF
# proxypark: Valet catchall → localhost:${valet_port}
# Lowest priority — explicit links always win.
http:
  routers:
    valet-catchall:
      rule: "HostRegexp(\`.+\\\\.${TLD}\`)"
      entrypoints:
        - websecure
      service: valet-backend
      tls: {}
      priority: 1
  services:
    valet-backend:
      loadBalancer:
        servers:
          - url: "http://host.docker.internal:${valet_port}"
EOF
            success "Valet catchall enabled → localhost:${valet_port}"
            echo ""
            echo "  Make sure Valet is running on port ${valet_port}:"
            echo "    valet stop && valet port ${valet_port} && valet start"
            echo ""
            ;;
        disable)
            rm -f "$DYNAMIC_DIR/valet.yml"
            success "Valet catchall disabled"
            ;;
        *)
            echo ""
            echo "  Usage: park valet <enable|disable> [port]"
            echo ""
            echo "  Routes unmatched *.${TLD} domains to Valet."
            echo ""
            echo "  Examples:"
            echo "    park valet enable          # Valet on :8080 (default)"
            echo "    park valet enable 9090     # Valet on :9090"
            echo "    park valet disable         # Remove catchall"
            echo ""
            ;;
    esac
}

# ─── open ────────────────────────────────────────────────────

cmd_open() {
    local name="${1:-}"
    if [ -z "$name" ]; then
        echo "  Usage: park open <name>"
        exit 1
    fi
    open "https://$(slugify "$name").${TLD}"
}

# ─── dashboard ───────────────────────────────────────────────

cmd_dashboard() {
    ensure_running
    info "Opening Traefik dashboard..."
    open "http://localhost:8080"
}

# ─── logs ────────────────────────────────────────────────────

cmd_logs() {
    docker compose -f "$COMPOSE_FILE" logs -f --tail=50 traefik
}

# ─── trust ───────────────────────────────────────────────────

cmd_trust() {
    info "Installing local CA (system + Firefox)..."
    brew list nss &>/dev/null 2>&1 || brew install nss
    mkcert -install
    success "CA installed – restart browser if needed"
}

# ─── certs ───────────────────────────────────────────────────

cmd_certs() {
    info "Regenerating certificates from current links..."
    regenerate_certs
}

# ─── help ────────────────────────────────────────────────────

cmd_help() {
    cat <<EOF

  ${BOLD}proxypark v${VERSION}${NC} – Local reverse-proxy & DNS manager
  ${DIM}https://github.com/McGo/proxypark${NC}

  ${BOLD}USAGE${NC}
    park <command> [arguments]

  ${BOLD}INFRASTRUCTURE${NC}
    install              First-time setup (Traefik, dnsmasq, mkcert)
    uninstall            Remove everything
    start                Start Traefik
    stop                 Stop Traefik
    restart              Restart Traefik
    status               Health check of all components
    doctor [--fix]       Diagnose and fix common issues
    trust                (Re-)install mkcert CA (system + Firefox)
    certs                Regenerate certificates from current links
    logs                 Tail Traefik logs
    dashboard            Open Traefik dashboard in browser

  ${BOLD}PROJECTS${NC}  ${DIM}(use dot notation for subdomains: api.myapp)${NC}
    link <name> <port>            Link local service → https://<name>.${TLD}
    link:docker <name> <c>[:<p>]  Link Docker container (no exposed ports)
    unlink <name>                 Remove link
    list                          Show all routes
    open <name>                   Open project in browser
    scaffold <n>                  Generate docker-compose.yml template

  ${BOLD}VALET INTEGRATION${NC}
    valet enable [port]           Route unmatched domains to Valet
    valet disable                 Remove Valet catchall

  ${BOLD}EXAMPLES${NC}
    park install                     # First-time setup
    park link myshop 8000               # https://myshop.${TLD} → :8000
    park link api.myshop 8001            # https://api.myshop.${TLD} → :8001
    park link:docker myapp container     # https://myapp.${TLD} → container:80
    park link:docker api.myapp api:3000  # https://api.myapp.${TLD} → api:3000
    park valet enable                # Valet fallback on :8080
    park scaffold kundenportal       # Generate docker-compose.yml
    park list                        # Show all routes
    park open kundenportal           # Open in browser

  ${BOLD}HOW IT WORKS${NC}
    proxypark uses Traefik's file-provider exclusively.
    Each 'park link' creates a YAML config in ~/.proxypark/dynamic/
    and regenerates TLS certificates for all linked domains.
    Traefik watches the directory and picks up changes instantly.

  ${BOLD}CONFIG${NC}
    Data:     ~/.proxypark/
    Certs:    ~/.proxypark/certs/
    Links:    ~/.proxypark/dynamic/link-*.yml
    Compose:  ~/.proxypark/docker-compose.yml

    Environment variables:
      PROXYPARK_DATA_DIR   Data directory (default: ~/.proxypark)
      PROXYPARK_TLD        Top-level domain (default: test)

EOF
}

# ─── Command Router ──────────────────────────────────────────

COMMAND="${1:-help}"
shift || true

case "$COMMAND" in
    install)    cmd_install "$@" ;;
    uninstall)  cmd_uninstall "$@" ;;
    start)      cmd_start "$@" ;;
    stop)       cmd_stop "$@" ;;
    restart)    cmd_restart "$@" ;;
    link)       cmd_link "$@" ;;
    link:sub)   cmd_link "$2.$1" "$3" ;;  # legacy: park link:sub api myapp 8001 → park link api.myapp 8001
    link:docker) cmd_link_docker "$@" ;;
    unlink)     cmd_unlink "$@" ;;
    list|ls)    cmd_list "$@" ;;
    status|st)  cmd_status "$@" ;;
    doctor)     cmd_doctor "$@" ;;
    valet)      cmd_valet "$@" ;;
    dashboard)  cmd_dashboard "$@" ;;
    open)       cmd_open "$@" ;;
    logs)       cmd_logs "$@" ;;
    trust)      cmd_trust "$@" ;;
    certs)      cmd_certs "$@" ;;
    scaffold)   cmd_scaffold "$@" ;;
    help|--help|-h) cmd_help ;;
    version|--version|-v) echo "proxypark v${VERSION}" ;;
    *)
        error "Unknown command: $COMMAND"
        echo "  Run 'park help' for usage."
        exit 1
        ;;
esac