#!/usr/bin/env python3
"""Create new cloudflared tunnel for trustgram/games/hydros on CT148 (cert-based, no API token)."""
import io, subprocess, re

CF = "/root/.cloudflared"

# 1. create tunnel
r = subprocess.run(["/usr/bin/cloudflared", "tunnel", "create", "thetemple-fleet"],
                   cwd=CF, capture_output=True, text=True, timeout=120)
print("CREATE:", r.stdout.strip()[-300:], r.stderr.strip()[-300:])
m = re.search(r"Created tunnel\s+\w+\s+with id\s+([0-9a-f-]+)", r.stdout + r.stderr)
if not m:
    m = re.search(r"([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})", r.stdout + r.stderr)
assert m, "tunnel UUID not found in output"
uuid = m.group(1)
print("UUID:", uuid)

# 2. config
cfg = f"""tunnel: {uuid}
credentials-file: {CF}/{uuid}.json
ingress:
  - hostname: trustgram.thetempleofdoom.com
    service: http://10.30.20.62:80
  - hostname: games.thetempleofdoom.com
    service: http://10.30.20.73:3000
  - hostname: hydros.thetempleofdoom.com
    service: http://10.30.20.11:3000
  - service: http_status:404
"""
io.open(f"{CF}/config-fleet.yml", "w", encoding="utf-8").write(cfg)
print("CONFIG WRITTEN")

# 3. DNS routes
for host in ["trustgram", "games", "hydros"]:
    d = host + ".thetempleofdoom.com"
    rr = subprocess.run(["/usr/bin/cloudflared", "tunnel", "route", "dns", uuid, d],
                        cwd=CF, capture_output=True, text=True, timeout=60)
    print(f"DNS {d}:", rr.stdout.strip()[-120:], rr.stderr.strip()[-120:])

# 4. systemd unit
unit = f"""[Unit]
Description=Cloudflare Fleet Tunnel (trustgram/games/hydros)
After=network-online.target
Wants=network-online.target

[Service]
ExecStart=/usr/bin/cloudflared tunnel --no-autoupdate --config {CF}/config-fleet.yml run
Restart=always
RestartSec=5

[Install]
WantedBy=multi-user.target
"""
io.open("/etc/systemd/system/cloudflared-fleet.service", "w", encoding="utf-8").write(unit)
subprocess.run(["systemctl", "daemon-reload"])
subprocess.run(["systemctl", "enable", "cloudflared-fleet"])
r = subprocess.run(["systemctl", "restart", "cloudflared-fleet"], capture_output=True, text=True)
print("SERVICE:", "STARTED" if r.returncode == 0 else r.stderr[:300])