#!/usr/bin/env python3
"""Take over all healthy routes onto thetemple-fleet tunnel (CT148)."""
import io, subprocess

UUID = "1aeb1ac0-3c49-4801-b61d-bc92e6e4932a"
CF = "/root/.cloudflared"

# verified-live routes (liveness sweep 2026-08-13); problem routes stay on old tunnel
ROUTES = [
    ("pve.thetempleofdoom.com", "http://10.30.20.85:8006"),
    ("gitea.thetempleofdoom.com", "http://10.30.20.149:3000"),
    ("wiki.thetempleofdoom.com", "http://10.30.20.28:3000"),
    ("CRM.thetempleofdoom.com", "http://10.30.20.30:3000"),
    ("crm.thetempleofdoom.com", "http://10.30.20.30:3000"),
    ("twenty.thetempleofdoom.com", "http://10.30.20.30:3000"),
    ("webcheck.thetempleofdoom.com", "http://10.30.20.13:3000"),
    ("agent.thetempleofdoom.com", "http://10.30.20.44:3000"),
    ("btcpay.thetempleofdoom.com", "http://10.30.20.140:80"),
    ("btc.thetempleofdoom.com", "http://10.30.20.140:80"),
    ("torrent.thetempleofdoom.com", "http://10.30.20.87:6969"),
    ("jelly.thetempleofdoom.com", "http://10.30.20.88:8096"),
    ("spirit.thetempleofdoom.com", "http://10.30.20.32:7777"),
    ("share.thetempleofdoom.com", "http://10.30.20.129:3000"),
    ("snowshare.thetempleofdoom.com", "http://10.30.20.129:3000"),
    ("snowshoer.thetempleofdoom.com", "http://10.30.20.129:3000"),
    ("ai.thetempleofdoom.com", "http://10.30.20.240:80"),
    ("tech.thetempleofdoom.com", "http://10.30.20.241:80"),
    ("science.thetempleofdoom.com", "http://10.30.20.242:80"),
    ("crypto.thetempleofdoom.com", "http://10.30.20.243:80"),
    ("linux.thetempleofdoom.com", "http://10.30.20.244:80"),
    ("gaming.thetempleofdoom.com", "http://10.30.20.246:80"),
    ("diy.thetempleofdoom.com", "http://10.30.20.247:80"),
    ("guides.thetempleofdoom.com", "http://10.30.20.248:80"),
    ("digi-market.thetempleofdoom.com", "http://10.30.20.210:5000"),
    ("cardvault-pro.thetempleofdoom.com", "http://10.30.20.211:5000"),
    ("StreamPass-Hub.thetempleofdoom.com", "http://10.30.20.212:5000"),
    ("KeyForge-Digital.thetempleofdoom.com", "http://10.30.20.213:5000"),
    ("CoinBridgeMarket.thetempleofdoom.com", "http://10.30.20.214:5000"),
    ("GiftShift.thetempleofdoom.com", "http://10.30.20.217:5000"),
    ("PremiumPortal.thetempleofdoom.com", "http://10.30.20.218:5000"),
    ("DigiDeals.thetempleofdoom.com", "http://10.30.20.219:5000"),
    ("NexusKeys.thetempleofdoom.com", "http://10.30.20.220:5000"),
    ("VaultPass.thetempleofdoom.com", "http://10.30.20.221:5000"),
    ("PESTCONTROLLER.thetempleofdoom.com", "http://10.30.20.249:5052"),
    ("aisearch.thetempleofdoom.com", "http://10.30.20.250:8000"),
    ("signalsearcher.thetempleofdoom.com", "http://10.30.20.23:5099"),
    ("tarot.thetempleofdoom.com", "http://10.30.20.77:80"),
    ("socialpulse.thetempleofdoom.com", "http://10.30.20.252:80"),
    ("proxy.thetempleofdoom.com", "http://10.30.20.154:3128"),
    ("proxy2.thetempleofdoom.com", "http://10.30.20.71:3128"),
    ("proxy3.thetempleofdoom.com", "http://10.30.20.189:3128"),
    ("trustgram.thetempleofdoom.com", "http://10.30.20.62:80"),
    ("games.thetempleofdoom.com", "http://10.30.20.73:3000"),
    ("hydros.thetempleofdoom.com", "http://10.30.20.11:3000"),
    ("bwt.democracyrisingbwt.us", "http://10.30.20.229:8008"),
]

# build config
ingress = "\n".join(f"  - hostname: {h}\n    service: {s}" for h, s in ROUTES)
cfg = f"""tunnel: {UUID}
credentials-file: {CF}/{UUID}.json
ingress:
{ingress}
  - service: http_status:404
"""
io.open(f"{CF}/config-fleet.yml", "w", encoding="utf-8").write(cfg)
print(f"CONFIG: {len(ROUTES)} routes written")
subprocess.run(["systemctl", "restart", "cloudflared-fleet"])
print("TUNNEL RESTARTED")

# flip DNS
fails = []
for h, _ in ROUTES:
    r = subprocess.run(["/usr/bin/cloudflared", "tunnel", "route", "dns", "--overwrite-dns", UUID, h],
                       cwd=CF, capture_output=True, text=True, timeout=60)
    ok = "Added CNAME" in (r.stdout + r.stderr)
    print(f"{'OK ' if ok else 'FAIL'} {h}")
    if not ok:
        fails.append(h)
print("DNS FAILS:", fails if fails else "none")