#!/usr/bin/env bash
# Remove the lab's host layer from test-server. Packages stay.
#
#   sudo bash deploy/lab/host/teardown-host.sh
#
# The host's sudo asks for a password, so run this in a terminal — not over a
# non-interactive ssh, where sudo fails silently into an empty result.
#
# ★ Certificates are BACKED UP, NOT DELETED. Let's Encrypt allows 5 duplicate
#   certificates per week for the same name set, and this lab's names resolve to
#   a tailnet address (100.64.0.0/10, not routable from the public internet), so
#   an HTTP-01 reissue cannot be validated from here. Deleting the files turns a
#   free restore into a problem that has to be solved first. Restoring is:
#
#     sudo tar xzf ~/letsencrypt-backup-<stamp>.tgz -C /etc
set -u

STAMP="$(date +%Y%m%d-%H%M%S)"
HOME_DIR="${SUDO_USER:+/home/$SUDO_USER}"
HOME_DIR="${HOME_DIR:-$HOME}"

echo "===== 1) 인증서 백업 (지우지 않는다) ====="
if [ -d /etc/letsencrypt ]; then
	out="$HOME_DIR/letsencrypt-backup-$STAMP.tgz"
	tar czf "$out" -C /etc letsencrypt
	chown "${SUDO_USER:-root}" "$out"
	echo "백업: $out ($(du -h "$out" | cut -f1))"
	echo "현재 인증서:"
	certbot certificates 2>/dev/null | grep -E "Certificate Name|Domains|Expiry Date" || true
	echo "검증 방식 (재발급이 되는지의 답):"
	grep -H authenticator /etc/letsencrypt/renewal/*.conf 2>/dev/null || echo "  (renewal 설정 없음)"
else
	echo "/etc/letsencrypt 없음 — 건너뜀"
fi
echo

echo "===== 2) nginx 실험대 설정 제거 ====="
if [ -f /etc/nginx/sites-available/keycloak-lab ]; then
	cp /etc/nginx/sites-available/keycloak-lab "$HOME_DIR/keycloak-lab.nginx.$STAMP.bak"
	echo "백업: $HOME_DIR/keycloak-lab.nginx.$STAMP.bak"
fi
rm -fv /etc/nginx/sites-enabled/keycloak-lab
rm -fv /etc/nginx/sites-available/keycloak-lab
systemctl disable --now nginx
echo

echo "===== 3) certbot 갱신 타이머 정지 ====="
# 인증서 파일은 남기지만, 갱신 시도는 멈춘다. 지금 DNS 로는 HTTP-01 검증이
# 실패하고, 실패가 로그에만 쌓이면서 「왜 안 되지」의 원인이 된다.
systemctl disable --now certbot-renew.timer 2>/dev/null || true
echo

echo "===== 4) 엣지 DNAT (있으면) ====="
systemctl disable --now lab-edge-dnat.service 2>/dev/null || true
rm -fv /etc/systemd/system/lab-edge-dnat.service /etc/nftables.d/lab-edge-dnat.nft
systemctl daemon-reload
nft delete table ip lab_edge 2>/dev/null || true
echo

echo "===== 5) 확인 ====="
echo "-- nginx:          $(systemctl is-active nginx) / $(systemctl is-enabled nginx 2>&1)"
echo "-- certbot timer:  $(systemctl is-active certbot-renew.timer 2>&1) / $(systemctl is-enabled certbot-renew.timer 2>&1)"
echo "-- 80/443 리스너:"; ss -tlnp | grep -E ':(80|443) ' || echo "   (없음 — 정상)"
echo "-- sites-enabled:"; ls -A /etc/nginx/sites-enabled 2>/dev/null || echo "   (비었음 — 정상)"
echo "-- letsencrypt:"; ls /etc/letsencrypt/live 2>/dev/null || echo "   (없음)"
echo "-- libvirt 도메인:"; virsh list --all 2>/dev/null | tail -n +3 | grep -v '^$' || echo "   (없음 — 정상)"
echo
echo "완료. 패키지(nginx · libvirt · qemu · certbot · kubectl)와 base.qcow2 는 남아 있다."