# Hybrid PREP — bypass laptop + office→server (tanpa PCC/Netwatch)
# Usage: .\scripts\apply-hybrid-prep-mikrotik.ps1
# Hapus prep: /ip firewall mangle remove [find comment~"hybrid"]

param(
    [string]$HostAddr = "192.168.0.1",
    [string]$MgmtLaptopIp = "192.168.0.33",
    [switch]$DryRun
)

$SshPort = 255
$SshUser = "admin"
$KeyFile = Join-Path $env:USERPROFILE ".ssh\id_rsa_mikrotik"
$RscLocal = Join-Path (Split-Path $PSScriptRoot -Parent) "server\mikrotik-hybrid-prep.rsc"
$RscRemote = "hybrid-prep.rsc"

$SshBase = @(
    "-o", "BatchMode=yes",
    "-o", "ConnectTimeout=15",
    "-o", "IdentitiesOnly=yes",
    "-i", $KeyFile,
    "-o", "PubkeyAcceptedAlgorithms=rsa-sha2-256,rsa-sha2-512,ssh-rsa",
    "-o", "StrictHostKeyChecking=accept-new",
    "-m", "hmac-sha1",
    "-p", $SshPort,
    "${SshUser}@${HostAddr}"
)

function Invoke-Mikrotik {
    param([string]$Cmd)
    if ($DryRun) { Write-Host "[dry-run] $Cmd"; return $true }
    $out = & ssh @SshBase $Cmd 2>&1
    foreach ($line in $out) { Write-Host $line }
    return ($LASTEXITCODE -eq 0)
}

Write-Host "=== Hybrid PREP (bukan Fase 2 penuh) ==="
Write-Host "SSH: ${SshUser}@${HostAddr}:${SshPort}"
Write-Host "Mgmt IP: $MgmtLaptopIp"
Write-Host "Hanya: mgmt bypass + office-to-server bypass"
Write-Host "TIDAK: PCC, Netwatch, routing rules hybrid"
Write-Host ""

if (-not $DryRun) {
    if ($MgmtLaptopIp -ne "192.168.0.33") {
        Write-Warning "Edit mikrotik-hybrid-prep.rsc jika IP laptop bukan 192.168.0.33"
    }
    $existing = & ssh @SshBase '/ip firewall mangle print where comment~"hybrid"' 2>&1
    if ($existing -match "hybrid mgmt bypass") {
        Write-Host "Prep sudah ada — skip import."
    } else {
        & scp -P $SshPort -o MACs=hmac-sha1 -o StrictHostKeyChecking=accept-new `
            -i $KeyFile $RscLocal "${SshUser}@${HostAddr}:$RscRemote"
        if ($LASTEXITCODE -ne 0) { throw "SCP gagal" }
        Invoke-Mikrotik "/import file=$RscRemote" | Out-Null
        Invoke-Mikrotik "/file remove $RscRemote" | Out-Null
    }
}

@(
    '/ip firewall mangle print where comment~"hybrid"',
    '/routing rule print',
    '/tool netwatch print',
    '/ip route print where comment~"failover"',
    '/ping 8.8.8.8 count=2'
) | ForEach-Object {
    Write-Host "--- $_ ---"
    Invoke-Mikrotik $_ | Out-Null
    Write-Host ""
}

Write-Host "Selesai. Failover Fase 1 tetap aktif. Fase 2 penuh: apply-hybrid-mikrotik.ps1"