install-rnode-lora.sh

#!/usr/bin/env bash
#
# install-rnode-lora.sh — Wizard installer/uninstaller for RNode + tncattach + WireGuard
# over LoRa on a Linux host with a Heltec WiFi LoRa 32 V4 (ESP32-S3 + SX1262).
#
# Sets up real TCP/IP over LoRa, secured by WireGuard. Run once per host after
# attaching an RNode-flashed board. Tested on Ubuntu (x86-64 + aarch64/Jetson).
#
# Verified against this session's live deployment (host A x86-64 <-> host B aarch64/Jetson):
#   - RNode firmware v1.86, TNC mode, 868 MHz / 125 kHz / SF7 / CR5 / 7 dBm
#   - tncattach MTU 496 (P2P) — tested 0% loss, ~450 ms RTT
#   - WireGuard wg1 (not wg0 = fleet NetBird/WG hub), MTU 400, port 51821
#   - SSH-over-WG-over-LoRa session completed end-to-end
#   - rnodeconf -N (normal) is the verified inverse of -T (tnc)
#
# Requires: root (sudo). Supports apt/dnf-based distros. Board on /dev/ttyACM*.
#
# Usage:
#   sudo ./install-rnode-lora.sh              # interactive wizard (install/reconfigure)
#   sudo ./install-rnode-lora.sh install      # force install path
#   sudo ./install-rnode-lora.sh uninstall    # remove everything + restore pre-install state
#   sudo ./install-rnode-lora.sh status       # show current state (read-only)
#   sudo ./install-rnode-lora.sh --dry-run install     # print what would happen, mutate nothing
#   sudo ./install-rnode-lora.sh --dry-run uninstall
#
set -Eeuo pipefail

# ═══════════════════════════════════════════════════════════════════════════════
# SSOT: all tunable values defined once, referenced by name everywhere
# ═══════════════════════════════════════════════════════════════════════════════
readonly RNS_PKG="rns"                      # pip package providing rnodeconf
readonly TNCATTACH_REPO="https://github.com/markqvist/tncattach"
readonly SERIAL_BAUD="115200"               # RNode firmware default (Config.h, verified)
readonly TNC_MTU="496"                       # RNode P2P, verified 0% loss live
readonly WG_IFACE="wg1"                      # NEVER wg0 (fleet NetBird/WG hub)
readonly WG_MTU="400"                        # tnc0 496 - ~80 WG overhead
readonly WG_PORT="51821"                     # avoid default 51820 + fleet
readonly WG_KEEPALIVE="25"
readonly RNODE_FW_MIN="1.86"                 # upstream markqvist, Jul 2026
readonly TNC_IFACE_DEFAULT="tnc0"
readonly TNCATTACH_BIN="/usr/local/bin/tncattach"
readonly STATE_DIR="/var/lib/rnode-lora"
readonly STATE_FILE="${STATE_DIR}/state"
readonly SNAPSHOT_DIR="${STATE_DIR}/snapshot"
readonly TNCATTACH_LOG="/var/log/tncattach.log"
readonly UNIT_TNC="tncattach.service"
readonly UNIT_UP="rnode-lora-up.service"
readonly WG_CONF_DIR="/etc/wireguard"

# Radio params (defaults; MUST match the peer board exactly)
DEFAULT_FREQ_HZ="868000000"   # 868 MHz, EU 868 band (863-870 MHz)
DEFAULT_BW_HZ="125000"        # 125 kHz
DEFAULT_SF="7"                # SF7 = fastest (~6-19 kbps); SF11 = longest range (~937 bps)
DEFAULT_CR="5"                # coding rate 4/5
DEFAULT_TXP_DBM="7"           # desk-range; board max 28 dBm

# Runtime mode
DRY_RUN=0

# Wizard state (filled in by prompts)
BOARD_PORT=""
TNC_IFACE="${TNC_IFACE_DEFAULT}"
THIS_TNC_IP=""
PEER_TNC_IP=""
THIS_WG_IP=""
PEER_WG_IP=""
PEER_WG_PUBKEY=""
FREQ_HZ="${DEFAULT_FREQ_HZ}"
BW_HZ="${DEFAULT_BW_HZ}"
SF="${DEFAULT_SF}"
CR="${DEFAULT_CR}"
TXP_DBM="${DEFAULT_TXP_DBM}"

# ═══════════════════════════════════════════════════════════════════════════════
# Helpers
# ═══════════════════════════════════════════════════════════════════════════════
log()  { printf '\033[1;34m[installer]\033[0m %s\n' "$*" >&2; }
ok()   { printf '\033[1;32m  ✓\033[0m %s\n' "$*" >&2; }
warn() { printf '\033[1;33m  !\033[0m %s\n' "$*" >&2; }
die()  { printf '\033[1;31m  ✗\033[0m %s\n' "$*" >&2; exit 1; }

# run — the ONLY chokepoint for mutations. In dry-run mode, prints the command
# instead of executing it. Every state-changing operation goes through `run`.
run() {
  if [ "$DRY_RUN" -eq 1 ]; then
    printf '\033[1;36m  [dry-run]\033[0m %s\n' "$*" >&2
  else
    "$@"
  fi
}

# run_to_file <dest> <cmd...> — writes <cmd>'s stdout to <dest>. The redirect
# happens INSIDE the conditional, same as `run`, so dry-run never touches <dest>.
run_to_file() {
  local dest="$1"; shift
  if [ "$DRY_RUN" -eq 1 ]; then
    printf '\033[1;36m  [dry-run]\033[0m %s > %s\n' "$*" "$dest" >&2
  else
    "$@" > "$dest"
  fi
}

# write_file <dest> <content> — writes <content> to <dest>. No-op (besides a
# log line) in dry-run — unlike a bare `cat > file <<EOF`, which would create
# or truncate <dest> for real regardless of DRY_RUN.
write_file() {
  local dest="$1" content="$2"
  if [ "$DRY_RUN" -eq 1 ]; then
    printf '\033[1;36m  [dry-run]\033[0m write %s (%d bytes)\n' "$dest" "${#content}" >&2
  else
    printf '%s\n' "$content" > "$dest"
  fi
}

need_root() {
  [ "$(id -u)" -eq 0 ] || die "Run with sudo:  sudo $0"
}

prompt() {  # prompt "question" "default" -> prints user value
  local q="$1" d="${2:-}" v
  if [ -n "$d" ]; then printf '%s [%s]: ' "$q" "$d" >&2
  else printf '%s: ' "$q" >&2; fi
  read -r v; echo "${v:-$d}"
}

confirm() {  # confirm "question" [default_y|n] -> 0=yes 1=no
  local q="$1" d="${2:-y}" r
  printf '%s [%s/%s]: ' "$q" "$( [ "$d" = y ] && echo Y || echo y )" "$( [ "$d" = n ] && echo N || echo n )" >&2
  read -r r; r="${r:-$d}"; [[ "$r" =~ ^[Yy] ]]
}

ver_ge() {  # ver_ge "1.86" "1.50" -> returns 0 if first >= second
  local a="$1" b="$2"
  awk -v a="$a" -v b="$b" 'BEGIN{
    split(a,ai,"."); split(b,bi,".");
    for(i=1;i<=4;i++){ av=ai[i]+0; bv=bi[i]+0;
      if(av>bv) exit 0; if(av<bv) exit 1; }
    exit 0 }'
}

ensure_path_local_bin() {
  case ":${PATH:-}:" in
    *":$HOME/.local/bin:"*) ;;
    *) export PATH="$HOME/.local/bin:${PATH:-}"; log "added ~/.local/bin to PATH" ;;
  esac
}

# Read-only predicates (never mutate — safe in any mode)
iface_exists() { ip link show "$1" >/dev/null 2>&1; }
proc_running() { pgrep -f "$1" >/dev/null 2>&1; }
unit_enabled() { systemctl is-enabled "$1" >/dev/null 2>&1; }

# ═══════════════════════════════════════════════════════════════════════════════
# State file (SSOT for uninstall — what this installer set)
# ═══════════════════════════════════════════════════════════════════════════════
save_state() {
  run mkdir -p "$STATE_DIR"
  # WG_IFACE and TNCATTACH_BIN are NOT saved here: they're readonly SSOT
  # constants, so load_state's `. "$STATE_FILE"` could never reassign them
  # anyway (bash silently fails to overwrite a readonly var) — recorded
  # dead weight, not a real save/restore path.
  local content
  content="$(cat <<EOF
BOARD_PORT=${BOARD_PORT}
TNC_IFACE=${TNC_IFACE}
THIS_TNC_IP=${THIS_TNC_IP}
PEER_TNC_IP=${PEER_TNC_IP}
THIS_WG_IP=${THIS_WG_IP}
PEER_WG_IP=${PEER_WG_IP}
FREQ_HZ=${FREQ_HZ}
BW_HZ=${BW_HZ}
SF=${SF}
CR=${CR}
TXP_DBM=${TXP_DBM}
SYSTEMD=$([ -f "/etc/systemd/system/${UNIT_TNC}" ] && echo yes || echo no)
EOF
)"
  write_file "$STATE_FILE" "$content"
  ok "state saved to ${STATE_FILE}"
}

load_state() {
  [ -f "$STATE_FILE" ] || return 1
  # shellcheck disable=SC1090
  . "$STATE_FILE"
}

# ═══════════════════════════════════════════════════════════════════════════════
# Snapshot / Restore — the SSOT for rollback
# ═══════════════════════════════════════════════════════════════════════════════
snapshot_host() {
  log "Snapshotting pre-install host state (wg configs + firewall + routing)"
  # Guarded by run(): a --dry-run must never delete a real, pre-existing
  # rollback snapshot (that snapshot is the only way `uninstall` can restore
  # a live wg0/firewall/routing state — losing it during a "preview" would
  # be a data-destroying side effect from a supposedly read-only mode).
  run rm -rf "$SNAPSHOT_DIR"
  run mkdir -p "$SNAPSHOT_DIR"
  run chmod 700 "$SNAPSHOT_DIR"

  # 1. WireGuard configs (cp -a preserves perms/timestamps)
  if [ -d "$WG_CONF_DIR" ]; then
    run mkdir -p "$SNAPSHOT_DIR/wireguard"
    run cp -a "$WG_CONF_DIR"/. "$SNAPSHOT_DIR/wireguard/" 2>/dev/null || true
    ok "snapshotted ${WG_CONF_DIR}/"
  else
    warn "no ${WG_CONF_DIR}/ to snapshot"
  fi

  # 2. Firewall (full iptables-save = ground truth for audit; restore uses targeted -D)
  if command -v iptables-save >/dev/null 2>&1; then
    run_to_file "$SNAPSHOT_DIR/iptables-saved.txt" bash -c 'iptables-save 2>/dev/null' || true
  fi
  if command -v ip6tables-save >/dev/null 2>&1; then
    run_to_file "$SNAPSHOT_DIR/ip6tables-saved.txt" bash -c 'ip6tables-save 2>/dev/null' || true
  fi
  ok "snapshotted iptables rules"

  # 3. Routing tables + policy rules
  run_to_file "$SNAPSHOT_DIR/routes-saved.txt" bash -c 'ip route show table all 2>/dev/null' || true
  run_to_file "$SNAPSHOT_DIR/rules-saved.txt" bash -c 'ip rule show 2>/dev/null' || true
  ok "snapshotted routes + rules"

  # 4. Running WireGuard interfaces (to re-bring-up on restore if they were up)
  run_to_file "$SNAPSHOT_DIR/wg-ifaces-running.txt" \
    bash -c "ip -o link show type wireguard 2>/dev/null | awk -F: '{print \$2}' | tr -d ' '" || true

  log "snapshot at ${SNAPSHOT_DIR}/"
}

restore_host() {
  [ -d "$SNAPSHOT_DIR" ] || { warn "no snapshot — cannot restore wg/firewall/routing precisely"; return 0; }
  log "Restoring host state from snapshot (${SNAPSHOT_DIR}/)"

  local wg="$WG_IFACE"
  local tnc="${TNC_IFACE:-$TNC_IFACE_DEFAULT}"

  # 1. WireGuard configs: restore every file present in snapshot EXCEPT the ones
  #    this installer owns (wg1*), so we don't undo our own teardown.
  if [ -d "$SNAPSHOT_DIR/wireguard" ]; then
    run mkdir -p "$WG_CONF_DIR"; run chmod 700 "$WG_CONF_DIR"
    local f base
    for f in "$SNAPSHOT_DIR/wireguard"/*; do
      [ -e "$f" ] || continue
      base="$(basename "$f")"
      case "$base" in
        "${WG_IFACE}.conf"|"${WG_IFACE}_private"|"${WG_IFACE}_public") continue ;;
      esac
      run cp -a "$f" "$WG_CONF_DIR/$base" 2>/dev/null && ok "restored ${WG_CONF_DIR}/${base}"
    done
  fi

  # 2. Firewall: remove ONLY rules this installer added (by interface name).
  #    Never iptables-restore the full snapshot — host rules may have changed since.
  close_firewall "$tnc" "$wg"
  ok "firewall rules for ${tnc}/${wg} removed (other rules untouched)"

  # 3. Routing: per-interface routes auto-delete when interfaces die. No static
  #    route restore needed (the point-to-point addr dies with the interface).
  ok "routing restored (per-interface routes removed with interfaces)"

  # 4. Re-bring-up WireGuard interfaces that were running before install but
  #    are now down (e.g. wg0 hub). Skip our own iface and ones already up.
  if [ -f "$SNAPSHOT_DIR/wg-ifaces-running.txt" ]; then
    local iface
    while IFS= read -r iface; do
      [ -n "$iface" ] || continue
      [ "$iface" = "$wg" ] && continue
      ip link show "$iface" >/dev/null 2>&1 && continue
      [ -f "${WG_CONF_DIR}/${iface}.conf" ] || continue
      if confirm "Re-bring-up WireGuard ${iface} (it was running before install)?" "y"; then
        if run wg-quick up "$iface" >/dev/null 2>&1; then
          ok "${iface} brought up"
        else
          warn "${iface} up failed (peer may be down — may be pre-existing)"
        fi
      fi
    done < "$SNAPSHOT_DIR/wg-ifaces-running.txt"
  fi

  ok "host state restored to pre-install (per snapshot)"
}

# ═══════════════════════════════════════════════════════════════════════════════
# 1. Dependencies
# ═══════════════════════════════════════════════════════════════════════════════
install_deps() {
  log "Installing system dependencies"
  if command -v apt-get >/dev/null 2>&1; then
    run apt-get update -qq
    local apt_pkgs="git build-essential python3 python3-pip wireguard-tools iproute2 iptables"
    command -v ufw >/dev/null 2>&1 && apt_pkgs="$apt_pkgs ufw"
    # shellcheck disable=SC2086
    run apt-get install -y -qq $apt_pkgs
    ok "apt packages installed"
  elif command -v dnf >/dev/null 2>&1; then
    run dnf install -y -q git gcc make python3 python3-pip \
      wireguard-tools iproute iptables-services
    ok "dnf packages installed"
  else
    die "Unsupported distro. Install manually: git, build-essential (or gcc+make), python3-pip, wireguard-tools, iproute2"
  fi

  # rns (provides rnodeconf) — handle PEP 668 externally-managed env
  log "Installing ${RNS_PKG} (rnodeconf)"
  ensure_path_local_bin
  if command -v pipx >/dev/null 2>&1; then
    if run pipx install "${RNS_PKG}" 2>/dev/null; then
      ok "rns via pipx"
    else
      warn "pipx failed, falling back to pip --user"
      run pip3 install --user "${RNS_PKG}" 2>/dev/null || run pip3 install --user --break-system-packages "${RNS_PKG}"
    fi
  else
    run pip3 install --user "${RNS_PKG}" 2>/dev/null \
      || run pip3 install --user --break-system-packages "${RNS_PKG}" \
      || die "Failed to install ${RNS_PKG}"
  fi
  command -v rnodeconf >/dev/null 2>&1 || ensure_path_local_bin
  command -v rnodeconf >/dev/null 2>&1 || die "rnodeconf not found after install (check ~/.local/bin on PATH)"
  ok "rnodeconf $(rnodeconf --version 2>/dev/null || echo '?')"
}

# ═══════════════════════════════════════════════════════════════════════════════
# 2. Detect board
# ═══════════════════════════════════════════════════════════════════════════════
detect_board() {
  log "Detecting RNode board on serial ports"
  local ports=()
  shopt -s nullglob
  ports=( /dev/ttyACM[0-9]* /dev/ttyUSB[0-9]* )
  shopt -u nullglob
  [ "${#ports[@]}" -gt 0 ] || die "No serial devices found (/dev/ttyACM*, /dev/ttyUSB*). Plug in the board."

  if [ "${#ports[@]}" -eq 1 ]; then BOARD_PORT="${ports[0]}"
  else
    log "Multiple serial ports found:"
    local i=1 p
    for p in "${ports[@]}"; do printf '  [%d] %s\n' "$i" "$p" >&2; i=$((i+1)); done
    local choice; choice="$(prompt 'Select port number' '1')"
    # Validate before indexing: an invalid $choice fed straight into $((choice-1))
    # is a fatal arithmetic-expansion error that `|| die` can't catch, so check first.
    [[ "$choice" =~ ^[0-9]+$ ]] && [ "$choice" -ge 1 ] && [ "$choice" -le "${#ports[@]}" ] \
      || die "Invalid selection: $choice"
    BOARD_PORT="${ports[$((choice-1))]}"
  fi

  # dialout group access (needed on some hosts, e.g. Jetson)
  if ! [ -w "$BOARD_PORT" ]; then
    warn "No permission on $BOARD_PORT — ensuring dialout group"
    getent group dialout >/dev/null 2>&1 || run groupadd dialout
    if [ -z "${SUDO_USER:-}" ]; then
      warn "\$SUDO_USER not set (not run via sudo?) — can't add a user to dialout automatically"
    else
      id -nG | grep -qw dialout || { run usermod -aG dialout "$SUDO_USER"; warn "Added $SUDO_USER to dialout — RE-RUN in a new login shell"; }
    fi
    [ -w "$BOARD_PORT" ] || warn "$BOARD_PORT still not writable; rnodeconf may fail until re-login"
  fi
  ok "board port: $BOARD_PORT"
}

# ═══════════════════════════════════════════════════════════════════════════════
# 3. Verify / flash RNode firmware
# ═══════════════════════════════════════════════════════════════════════════════
verify_firmware() {
  log "Checking RNode firmware on $BOARD_PORT"
  local info fw mode
  info="$(rnodeconf --info "$BOARD_PORT" 2>&1)" || {
    warn "rnodeconf could not read device — it may be blank or running Meshtastic/other firmware"
    if confirm "Flash RNode firmware now? (wipes current firmware)" "n"; then
      log "Starting autoinstall — choose: port, device [9] Heltec LoRa32 v4, band [1] 868 MHz, confirm [y]"
      run rnodeconf --autoinstall || die "Autoinstall failed"
      info="$(rnodeconf --info "$BOARD_PORT" 2>&1)" || die "Still cannot read device after flash"
    else
      die "Device not readable as RNode; flash RNode firmware first"
    fi
  }
  fw="$(printf '%s\n' "$info" | grep -oE 'firmware version:\s*[0-9.]+' | awk '{print $3}')"
  mode="$(printf '%s\n' "$info" | grep -oE 'Device mode\s*:\s*.*' | sed 's/.*: *//')"
  ok "firmware ${fw:-unknown}, mode: ${mode:-unknown}"
  if [ -n "$fw" ]; then ver_ge "$fw" "$RNODE_FW_MIN" || warn "firmware ${fw} < tested ${RNODE_FW_MIN}; update with: rnodeconf -u $BOARD_PORT"; fi
}

# ═══════════════════════════════════════════════════════════════════════════════
# 4. Configure TNC mode + radio params
# ═══════════════════════════════════════════════════════════════════════════════
configure_tnc() {
  log "LoRa radio parameters (MUST match the peer board exactly)"
  FREQ_HZ="$(prompt 'Frequency (Hz)' "$DEFAULT_FREQ_HZ")"
  BW_HZ="$(prompt 'Bandwidth (Hz)' "$DEFAULT_BW_HZ")"
  SF="$(prompt 'Spreading factor (7=fast .. 12=long range)' "$DEFAULT_SF")"
  CR="$(prompt 'Coding rate (5..8)' "$DEFAULT_CR")"
  TXP_DBM="$(prompt 'TX power dBm (2..28, low for desk)' "$DEFAULT_TXP_DBM")"

  log "Setting TNC mode on $BOARD_PORT"
  run rnodeconf "$BOARD_PORT" -T \
    --freq "$FREQ_HZ" --bw "$BW_HZ" --txp "$TXP_DBM" --sf "$SF" --cr "$CR" \
    >/dev/null 2>&1 || die "Failed to set TNC mode/params"
  ok "TNC mode: $FREQ_HZ Hz / $BW_HZ Hz BW / SF$SF / CR$CR / ${TXP_DBM}dBm"
}

# ═══════════════════════════════════════════════════════════════════════════════
# 5. Build + install tncattach, bring up tnc0
# ═══════════════════════════════════════════════════════════════════════════════
setup_tncattach() {
  log "Building tncattach"
  local src="/tmp/tncattach-build"
  run rm -rf "$src"
  run git clone --depth 1 "$TNCATTACH_REPO" "$src" >/dev/null 2>&1 || die "git clone tncattach failed"
  ( cd "$src" && make >/dev/null 2>&1 ) || die "tncattach build failed"
  run install -m 0755 "$src/tncattach" "$TNCATTACH_BIN"
  ok "tncattach installed"

  log "IP addressing for the LoRa link (point-to-point)"
  THIS_TNC_IP="$(prompt 'THIS host tnc0 IP' '10.0.0.1')"
  PEER_TNC_IP="$(prompt 'PEER host tnc0 IP' '10.0.0.2')"

  log "Bringing up $TNC_IFACE"
  run pkill -f "tncattach $BOARD_PORT" 2>/dev/null || true
  run ip link del "$TNC_IFACE" 2>/dev/null || true
  run bash -c "nohup '$TNCATTACH_BIN' '$BOARD_PORT' '$SERIAL_BAUD' \
    --mtu '$TNC_MTU' --noipv6 --noup -d >'$TNCATTACH_LOG' 2>&1 &"
  if [ "$DRY_RUN" -eq 0 ]; then sleep 3; fi
  ip link show "$TNC_IFACE" >/dev/null 2>&1 || { warn "tnc0 did not come up (see $TNCATTACH_LOG)"; [ "$DRY_RUN" -eq 1 ] || die "tnc0 failed"; }
  run ip addr add "${THIS_TNC_IP}/32" peer "${PEER_TNC_IP}/32" dev "$TNC_IFACE" 2>/dev/null || true
  run ip link set "$TNC_IFACE" up
  ok "$TNC_IFACE up: $THIS_TNC_IP -> $PEER_TNC_IP (MTU $TNC_MTU)"
}

# ═══════════════════════════════════════════════════════════════════════════════
# 6. WireGuard (wg1, encrypted tunnel over the LoRa link)
# ═══════════════════════════════════════════════════════════════════════════════
setup_wireguard() {
  log "WireGuard setup on $WG_IFACE (encrypted tunnel over LoRa)"
  if ! confirm "Configure WireGuard VPN on this link?" "y"; then
    warn "Skipping WireGuard — link stays unencrypted. SSH still gives per-session crypto."
    return 0
  fi

  THIS_WG_IP="$(prompt 'THIS host wg1 IP' '10.99.0.1')"
  PEER_WG_IP="$(prompt 'PEER host wg1 IP' '10.99.0.2')"
  PEER_WG_PUBKEY="$(prompt 'PEER wg public key (run this script on peer first, or wg pubkey)' '')"
  [ -n "$PEER_WG_PUBKEY" ] || die "Peer public key required (get it from the peer host)"

  local privkey_file="${WG_CONF_DIR}/${WG_IFACE}_private"
  local pubkey_file="${WG_CONF_DIR}/${WG_IFACE}_public"
  run mkdir -p "$WG_CONF_DIR"
  run chmod 700 "$WG_CONF_DIR"

  if [ ! -s "$privkey_file" ]; then
    run_to_file "$privkey_file" wg genkey
    run chmod 600 "$privkey_file"
    run_to_file "$pubkey_file" bash -c "wg pubkey < '$privkey_file'"
  fi
  local this_priv this_pub
  if [ "$DRY_RUN" -eq 1 ] && [ ! -s "$privkey_file" ]; then
    # Fresh host, dry-run: no real key was generated above. Use placeholders
    # so the config write below has something to log the size of, without
    # ever touching disk (write_file is a no-op in dry-run).
    this_priv="<dry-run-not-generated>"
    this_pub="<dry-run-not-generated>"
  else
    this_priv="$(cat "$privkey_file")"
    this_pub="$(cat "$pubkey_file")"
  fi

  local wg_conf_content
  wg_conf_content="$(cat <<EOF
[Interface]
PrivateKey = ${this_priv}
Address = ${THIS_WG_IP}/24
MTU = ${WG_MTU}
ListenPort = ${WG_PORT}

[Peer]
PublicKey = ${PEER_WG_PUBKEY}
AllowedIPs = ${PEER_WG_IP}/32
Endpoint = ${PEER_TNC_IP}:${WG_PORT}
PersistentKeepalive = ${WG_KEEPALIVE}
EOF
)"
  write_file "${WG_CONF_DIR}/${WG_IFACE}.conf" "$wg_conf_content"
  run chmod 600 "${WG_CONF_DIR}/${WG_IFACE}.conf"

  run wg-quick down "$WG_IFACE" 2>/dev/null || true
  run wg-quick up "$WG_IFACE" >/dev/null 2>&1 || die "wg-quick up $WG_IFACE failed"
  ok "$WG_IFACE up: $THIS_WG_IP -> $PEER_WG_IP (MTU $WG_MTU, port $WG_PORT)"
  log ">>> THIS host public key (give to the peer):"
  printf '\033[1;36m    %s\033[0m\n' "$this_pub" >&2
}

# ═══════════════════════════════════════════════════════════════════════════════
# 7. Firewall
# ═══════════════════════════════════════════════════════════════════════════════
open_firewall() {
  log "Opening firewall for $TNC_IFACE and $WG_IFACE"
  if command -v ufw >/dev/null 2>&1 && ufw status 2>/dev/null | grep -q "Status: active"; then
    run ufw allow in on "$TNC_IFACE" >/dev/null 2>&1
    run ufw allow out on "$TNC_IFACE" >/dev/null 2>&1
    run ufw allow in on "$WG_IFACE"  >/dev/null 2>&1
    run ufw allow out on "$WG_IFACE"  >/dev/null 2>&1
    ok "ufw rules added for $TNC_IFACE + $WG_IFACE"
  else
    iptables -C INPUT -i "$TNC_IFACE" -j ACCEPT 2>/dev/null || run iptables -I INPUT -i "$TNC_IFACE" -j ACCEPT
    iptables -C OUTPUT -o "$TNC_IFACE" -j ACCEPT 2>/dev/null || run iptables -I OUTPUT -o "$TNC_IFACE" -j ACCEPT
    iptables -C INPUT -i "$WG_IFACE" -j ACCEPT 2>/dev/null || run iptables -I INPUT -i "$WG_IFACE" -j ACCEPT
    iptables -C OUTPUT -o "$WG_IFACE" -j ACCEPT 2>/dev/null || run iptables -I OUTPUT -o "$WG_IFACE" -j ACCEPT
    ok "iptables rules added for $TNC_IFACE + $WG_IFACE"
  fi
}

close_firewall() {  # close_firewall [tnc_iface] [wg_iface] — removes only our per-interface rules
  local tnc="${1:-$TNC_IFACE}" wg="${2:-$WG_IFACE}"
  if command -v ufw >/dev/null 2>&1 && ufw status 2>/dev/null | grep -q "Status: active"; then
    run ufw delete allow in on "$tnc" >/dev/null 2>&1 || true
    run ufw delete allow out on "$tnc" >/dev/null 2>&1 || true
    run ufw delete allow in on "$wg"  >/dev/null 2>&1 || true
    run ufw delete allow out on "$wg"  >/dev/null 2>&1 || true
  else
    run iptables -D INPUT -i "$tnc" -j ACCEPT 2>/dev/null || true
    run iptables -D OUTPUT -o "$tnc" -j ACCEPT 2>/dev/null || true
    run iptables -D INPUT -i "$wg" -j ACCEPT 2>/dev/null || true
    run iptables -D OUTPUT -o "$wg" -j ACCEPT 2>/dev/null || true
  fi
}

# ═══════════════════════════════════════════════════════════════════════════════
# 8. Verify
# ═══════════════════════════════════════════════════════════════════════════════
verify_link() {
  log "Verifying LoRa link — pinging peer tnc0 IP (peer must be up)"
  if [ "$DRY_RUN" -eq 1 ]; then
    warn "[dry-run] skipping live ping"; return 0
  fi
  if ping -c 3 -W 6 "$PEER_TNC_IP" >/dev/null 2>&1; then
    ok "ICMP over LoRa: $THIS_TNC_IP -> $PEER_TNC_IP  (PASS)"
  else
    warn "No ping reply yet — ensure the peer host is running tncattach + same radio params"
  fi
  if ip link show "$WG_IFACE" >/dev/null 2>&1; then
    log "WireGuard status:"
    wg show "$WG_IFACE" 2>&1 | sed 's/^/    /' >&2 || true
  fi
}

# ═══════════════════════════════════════════════════════════════════════════════
# 9. Optional persistence (systemd units)
# ═══════════════════════════════════════════════════════════════════════════════
persist_systemd() {
  if ! confirm "Create systemd units so the link survives reboot?" "n"; then return 0; fi

  local unit_tnc_content unit_up_content
  unit_tnc_content="$(cat <<EOF
[Unit]
Description=RNode tncattach LoRa IP interface
After=network.target
[Service]
Type=simple
ExecStart=${TNCATTACH_BIN} ${BOARD_PORT} ${SERIAL_BAUD} --mtu ${TNC_MTU} --noipv6 --noup -d
Restart=always
RestartSec=5
[Install]
WantedBy=multi-user.target
EOF
)"
  write_file "/etc/systemd/system/${UNIT_TNC}" "$unit_tnc_content"

  unit_up_content="$(cat <<EOF
[Unit]
Description=Bring up tnc0 IP + WireGuard wg1 after tncattach
After=${UNIT_TNC}
[Service]
Type=oneshot
ExecStart=/sbin/ip addr add ${THIS_TNC_IP}/32 peer ${PEER_TNC_IP}/32 dev ${TNC_IFACE}
ExecStart=/sbin/ip link set ${TNC_IFACE} up
ExecStart=/usr/bin/wg-quick up ${WG_IFACE}
RemainAfterExit=yes
[Install]
WantedBy=multi-user.target
EOF
)"
  write_file "/etc/systemd/system/${UNIT_UP}" "$unit_up_content"

  run systemctl daemon-reload
  run systemctl enable --now "$UNIT_TNC" >/dev/null 2>&1
  run systemctl enable "$UNIT_UP" >/dev/null 2>&1
  ok "systemd units enabled (${UNIT_TNC} + ${UNIT_UP})"
}

# ═══════════════════════════════════════════════════════════════════════════════
# Existing-implementation detection (read-only)
# ═══════════════════════════════════════════════════════════════════════════════
detect_existing() {
  local found=0
  log "Checking for an existing RNode-LoRa installation on this host"
  iface_exists "$TNC_IFACE_DEFAULT"   && { warn "$TNC_IFACE_DEFAULT interface exists";     found=1; }
  iface_exists "$WG_IFACE"             && { warn "$WG_IFACE interface exists";             found=1; }
  proc_running "tncattach /dev"        && { warn "tncattach process running";              found=1; }
  [ -f "$TNCATTACH_BIN" ]              && { warn "tncattach binary at $TNCATTACH_BIN";     found=1; }
  [ -f "${WG_CONF_DIR}/${WG_IFACE}.conf" ] && { warn "${WG_CONF_DIR}/${WG_IFACE}.conf exists"; found=1; }
  unit_enabled "$UNIT_TNC"             && { warn "systemd unit $UNIT_TNC enabled";         found=1; }
  unit_enabled "$UNIT_UP"              && { warn "systemd unit $UNIT_UP enabled";         found=1; }
  [ -f "$STATE_FILE" ]                 && { warn "state file $STATE_FILE exists";         found=1; }
  # return 0 (true) if found, 1 (false) if clean
  return $((1 - found))
}

# ═══════════════════════════════════════════════════════════════════════════════
# Uninstall — tear down + restore from snapshot
# ═══════════════════════════════════════════════════════════════════════════════
do_uninstall() {
  log "Uninstalling RNode-LoRa and restoring pre-install host state"

  load_state 2>/dev/null || warn "no state file — using defaults (wg1/tnc0)"
  local tnc="${TNC_IFACE:-$TNC_IFACE_DEFAULT}"
  local wg="$WG_IFACE"

  # Safety: refuse destructive uninstall without a snapshot unless user overrides
  if [ ! -d "$SNAPSHOT_DIR" ] && [ "$DRY_RUN" -eq 0 ]; then
    warn "no pre-install snapshot found — restore will be best-effort (no wg0/firewall rollback)"
    confirm "Proceed without snapshot?" "n" || die "Aborted. Snapshot needed at ${SNAPSHOT_DIR}/ for safe restore."
  fi

  log "Stopping systemd units (if any)"
  run systemctl stop "$UNIT_TNC" "$UNIT_UP" 2>/dev/null || true
  run systemctl disable "$UNIT_TNC" "$UNIT_UP" 2>/dev/null || true
  run rm -f "/etc/systemd/system/${UNIT_TNC}" "/etc/systemd/system/${UNIT_UP}"
  run systemctl daemon-reload 2>/dev/null || true
  ok "systemd units removed"

  log "Tearing down WireGuard ${wg}"
  run wg-quick down "$wg" 2>/dev/null || run ip link del "$wg" 2>/dev/null || true
  run ip link del "$wg" 2>/dev/null || true
  ok "${wg} removed"

  log "Stopping tncattach + removing ${tnc}"
  run pkill -f "tncattach" 2>/dev/null || true
  [ "$DRY_RUN" -eq 0 ] && sleep 1
  run ip link del "$tnc" 2>/dev/null || true
  ok "${tnc} removed"

  # Restore wg configs + firewall + routing from the pre-install snapshot
  restore_host

  # Remove this installer's own files (not snapshot-restored ones)
  log "Removing this installer's own files"
  run rm -f "${WG_CONF_DIR}/${wg}.conf" "${WG_CONF_DIR}/${wg}_private" "${WG_CONF_DIR}/${wg}_public" 2>/dev/null || true
  run rm -f "$TNCATTACH_BIN" 2>/dev/null || true
  run rm -f "$TNCATTACH_LOG" 2>/dev/null || true
  run rm -f "$STATE_FILE" 2>/dev/null || true
  run rm -rf "$SNAPSHOT_DIR" 2>/dev/null || true
  run rmdir "$STATE_DIR" 2>/dev/null || true
  ok "installer files + snapshot removed"

  # Restore board to Normal mode — inverse of -T (verified: -N)
  if [ -n "${BOARD_PORT:-}" ] && [ -e "${BOARD_PORT:-}" ]; then
    if confirm "Restore board ${BOARD_PORT} to Normal mode (undo TNC)?" "y"; then
      ensure_path_local_bin
      if command -v rnodeconf >/dev/null 2>&1; then
        if run rnodeconf "$BOARD_PORT" -N >/dev/null 2>&1; then
          ok "board restored to Normal mode"
        else
          warn "rnodeconf -N failed — board may still be in TNC mode"
        fi
      else
        warn "rnodeconf not found; run manually: rnodeconf ${BOARD_PORT} -N"
      fi
    fi
  else
    warn "Board not reachable — board mode not restored (run 'rnodeconf /dev/ttyACM0 -N' when plugged in)"
  fi

  # Optional rns removal — default NO (shared dep, may be used by fleet Reticulum)
  if confirm "Also uninstall ${RNS_PKG} (rnodeconf)? (may break other Reticulum tools)" "n"; then
    if command -v pipx >/dev/null 2>&1 && pipx list 2>/dev/null | grep -q "${RNS_PKG}"; then
      run pipx uninstall "${RNS_PKG}" >/dev/null 2>&1 && ok "${RNS_PKG} removed (pipx)"
    else
      run pip3 uninstall -y --break-system-packages "${RNS_PKG}" 2>/dev/null \
        || run pip3 uninstall -y "${RNS_PKG}" 2>/dev/null \
        || warn "${RNS_PKG} pip uninstall skipped"
    fi
  else
    log "Keeping ${RNS_PKG} (git/build-essential/wireguard-tools NOT removed — may be used elsewhere)"
  fi

  echo
  ok "Uninstall complete. Host restored to pre-install state."
  warn "Board firmware (RNode v1.86) remains. To return to Meshtastic, use the web flasher."
  warn "Original Meshtastic node identity is unrecoverable — reflashing creates a new one."
}

# ═══════════════════════════════════════════════════════════════════════════════
# Status (read-only — never mutates)
# ═══════════════════════════════════════════════════════════════════════════════
do_status() {
  log "RNode-LoRa status on this host"
  if load_state 2>/dev/null; then
    log "Saved install state ($STATE_FILE):"
    sed 's/^/    /' "$STATE_FILE" >&2
  else
    warn "no state file — never installed, or state removed"
  fi
  echo
  log "Live state:"
  if iface_exists "$TNC_IFACE_DEFAULT"; then
    ip -brief addr show "$TNC_IFACE_DEFAULT" | sed 's/^/    /' >&2
  else
    warn "  $TNC_IFACE_DEFAULT: down"
  fi
  if iface_exists "$WG_IFACE"; then
    wg show "$WG_IFACE" 2>&1 | sed 's/^/    /' >&2
  else
    warn "  $WG_IFACE: down"
  fi
  if proc_running "tncattach /dev"; then ok "tncattach: running"; else warn "  tncattach: not running"; fi
  if [ -f "$TNCATTACH_BIN" ]; then ok "tncattach binary: present"; else warn "  tncattach binary: absent"; fi
  if systemctl is-active "$UNIT_TNC" >/dev/null 2>&1; then ok "${UNIT_TNC}: active"; else warn "  ${UNIT_TNC}: inactive"; fi
  if [ -d "$SNAPSHOT_DIR" ]; then
    ok "rollback snapshot present (${SNAPSHOT_DIR}/)"
  else
    warn "  no rollback snapshot (uninstall restore will be best-effort)"
  fi
}

# ═══════════════════════════════════════════════════════════════════════════════
# Main wizard
# ═══════════════════════════════════════════════════════════════════════════════
print_banner() {
  cat <<'BANNER'
  ┌─────────────────────────────────────────────────────────────┐
  │   RNode + tncattach + WireGuard — LoRa TCP/IP installer     │
  │   Heltec WiFi LoRa 32 V4 (ESP32-S3 + SX1262) | RNode v1.86  │
  └─────────────────────────────────────────────────────────────┘
  This sets up real TCP/IP over LoRa, secured by WireGuard.
  Run this on EACH Linux host that has a board attached.
  The peer board must use IDENTICAL radio params.
BANNER
  echo
}

do_install() {
  snapshot_host        # capture wg/firewall/routing BEFORE any changes (SSOT for rollback)
  install_deps
  detect_board
  verify_firmware
  configure_tnc
  setup_tncattach
  setup_wireguard
  open_firewall
  verify_link
  persist_systemd
  save_state

  echo
  ok "Installation complete."
  log "Next: run this script on the PEER host with mirrored IPs + the public key shown above."
  log "Test:  ping ${PEER_TNC_IP}   |   ssh <user>@${THIS_WG_IP}  (over WireGuard)"
  log "Status: $0 status   |   Uninstall: $0 uninstall   |   Dry-run: $0 --dry-run uninstall"
}

main() {
  print_banner
  need_root

  # Parse args: --dry-run flag + positional command
  local args=() arg
  for arg in "$@"; do
    case "$arg" in
      --dry-run) DRY_RUN=1; log "*** DRY-RUN MODE — no mutations will execute ***" ;;
      -h|--help)
        sed -n '2,20p' "$0" | sed 's/^# \?//'
        exit 0 ;;
      *) args+=("$arg") ;;
    esac
  done
  local mode="${args[0]:-}"

  if [ "$DRY_RUN" -eq 1 ]; then
    # Dry-run only meaningful with an explicit command
    [ -n "$mode" ] || die "dry-run needs a command: install | uninstall"
  fi

  if [ -z "$mode" ]; then
    if detect_existing; then
      echo
      local choice
      printf 'Existing installation found. Choose:\n  [r] reconfigure (install over)\n  [u] uninstall (restore state)\n  [s] status only\n  [q] quit\nChoice [r/u/s/q]: ' >&2
      read -r choice
      case "$choice" in
        r|R) do_install ;;
        u|U) do_uninstall ;;
        s|S) do_status ;;
        *) log "Exiting."; exit 0 ;;
      esac
    else
      log "No existing installation found — starting fresh install."
      do_install
    fi
    return
  fi

  case "$mode" in
    install)    do_install ;;
    uninstall)  do_uninstall ;;
    status)     do_status ;;
    *) die "Unknown command: $mode  (use: install | uninstall | status | --dry-run)" ;;
  esac
}

main "$@"