#!/usr/bin/env python3
"""Migrate home tunnel to full local config on Proxmox host.
1. Build complete config.yml from cf-tunnels.md catalog
2. Install systemd unit, stop token-based duplicate, start local
Run ON Proxmox host as root.
"""
import io, subprocess, json

CFG = "/etc/cloudflared/config.yml"
CRED = "/etc/cloudflared/home-tunnel.json"

config = """tunnel: d2871458-1737-4844-b114-9a44b9d71e25
credentials-file: {cred}
ingress:
  - hostname: games.thetempleofdoom.com
    service: http://10.30.20.73:3000
  - hostname: trustgram.thetempleofdoom.com
    service: http://10.30.20.62:80
  - hostname: hydros.thetempleofdoom.com
    service: http://10.30.20.11:3000
  - hostname: purehydro.thetempleofdoom.com
    service: http://10.30.20.24:80
  - hostname: pve.thetempleofdoom.com
    service: http://10.30.20.85:8006
  - hostname: gitea.thetempleofdoom.com
    service: http://10.30.20.149:3000
  - hostname: wiki.thetempleofdoom.com
    service: http://10.30.20.28:3000
  - hostname: CRM.thetempleofdoom.com
    service: http://10.30.20.30:3000
  - hostname: crm.thetempleofdoom.com
    service: http://10.30.20.30:3000
  - hostname: twenty.thetempleofdoom.com
    service: http://10.30.20.30:3000
  - hostname: webcheck.thetempleofdoom.com
    service: http://10.30.20.13:3000
  - hostname: mainagent.thetempleofdoom.com
    service: http://10.30.20.236:5678
  - hostname: agent.thetempleofdoom.com
    service: http://10.30.20.44:3000
  - hostname: btcpay.thetempleofdoom.com
    service: http://10.30.20.140:80
  - hostname: btc.thetempleofdoom.com
    service: http://10.30.20.140:80
  - hostname: torrent.thetempleofdoom.com
    service: http://10.30.20.87:6969
  - hostname: jelly.thetempleofdoom.com
    service: http://10.30.20.88:8096
  - hostname: spirit.thetempleofdoom.com
    service: http://10.30.20.32:7777
  - hostname: share.thetempleofdoom.com
    service: http://10.30.20.129:3000
  - hostname: snowshare.thetempleofdoom.com
    service: http://10.30.20.129:3000
  - hostname: snowshoer.thetempleofdoom.com
    service: http://10.30.20.129:3000
  - hostname: ai.thetempleofdoom.com
    service: http://10.30.20.240:80
  - hostname: tech.thetempleofdoom.com
    service: http://10.30.20.241:80
  - hostname: science.thetempleofdoom.com
    service: http://10.30.20.242:80
  - hostname: crypto.thetempleofdoom.com
    service: http://10.30.20.243:80
  - hostname: linux.thetempleofdoom.com
    service: http://10.30.20.244:80
  - hostname: gaming.thetempleofdoom.com
    service: http://10.30.20.246:80
  - hostname: diy.thetempleofdoom.com
    service: http://10.30.20.247:80
  - hostname: guides.thetempleofdoom.com
    service: http://10.30.20.248:80
  - hostname: digi-market.thetempleofdoom.com
    service: http://10.30.20.210:5000
  - hostname: cardvault-pro.thetempleofdoom.com
    service: http://10.30.20.211:5000
  - hostname: StreamPass-Hub.thetempleofdoom.com
    service: http://10.30.20.212:5000
  - hostname: KeyForge-Digital.thetempleofdoom.com
    service: http://10.30.20.213:5000
  - hostname: CoinBridgeMarket.thetempleofdoom.com
    service: http://10.30.20.214:5000
  - hostname: GiftShift.thetempleofdoom.com
    service: http://10.30.20.217:5000
  - hostname: PremiumPortal.thetempleofdoom.com
    service: http://10.30.20.218:5000
  - hostname: DigiDeals.thetempleofdoom.com
    service: http://10.30.20.219:5000
  - hostname: NexusKeys.thetempleofdoom.com
    service: http://10.30.20.220:5000
  - hostname: VaultPass.thetempleofdoom.com
    service: http://10.30.20.221:5000
  - hostname: PESTCONTROLLER.thetempleofdoom.com
    service: http://10.30.20.249:5052
  - hostname: aisearch.thetempleofdoom.com
    service: http://10.30.20.250:8000
  - hostname: signalsearcher.thetempleofdoom.com
    service: http://10.30.20.23:5099
  - hostname: tarot.thetempleofdoom.com
    service: http://10.30.20.77:80
  - hostname: socialpulse.thetempleofdoom.com
    service: http://10.30.20.252:80
  - hostname: fmd.thetempleofdoom.com
    service: http://10.30.20.181:8443
  - hostname: proxy.thetempleofdoom.com
    service: http://10.30.20.154:3128
  - hostname: proxy2.thetempleofdoom.com
    service: http://10.30.20.71:3128
  - hostname: proxy3.thetempleofdoom.com
    service: http://10.30.20.189:3128
  - hostname: bwt.democracyrisingbwt.us
    service: http://10.30.20.229:8008
  - service: http_status:404
""".replace("{cred}", CRED)

io.open(CFG, "w", encoding="utf-8").write(config)
print("CONFIG WRITTEN:", len(config.splitlines()), "ingress entries")

unit = """[Unit]
Description=Cloudflare Home Tunnel (full fleet config)
After=network-online.target
Wants=network-online.target

[Service]
ExecStart=/usr/bin/cloudflared tunnel --no-autoupdate --config /etc/cloudflared/config.yml run
Restart=always
RestartSec=5

[Install]
WantedBy=multi-user.target
"""
io.open("/etc/systemd/system/cloudflared-home.service", "w", encoding="utf-8").write(unit)
subprocess.run(["systemctl", "daemon-reload"])
print("UNIT INSTALLED")

# stop the token-based home tunnel process (the d2871458 one)
out = subprocess.run(["bash", "-c",
    "ps aux | grep cloudflared | grep -v grep | grep 'd2871458' | awk '{print $2}'"],
    capture_output=True, text=True)
pids = out.stdout.split()
for p in pids:
    subprocess.run(["kill", p])
print("KILLED TOKEN-BASED HOME TUNNEL PIDS:", pids)

subprocess.run(["systemctl", "enable", "cloudflared-home"])
r = subprocess.run(["systemctl", "restart", "cloudflared-home"], capture_output=True, text=True)
print("LOCAL SERVICE STARTED" if r.returncode == 0 else f"START FAILED: {r.stderr[:400]}")