# Deploy Hybrid Fase 2 — PCC + Netwatch + check-gateway
# Usage: .\scripts\apply-hybrid-mikrotik.ps1
#        .\scripts\apply-hybrid-mikrotik.ps1 -DryRun
# Restore Fase 1 jika gagal: .\scripts\restore-failover-phase1-mikrotik.ps1
#
# PENTING: Default SSH ke 192.168.0.1 (office gateway) agar tidak putus saat import.

param(
    [string]$HostAddr = "192.168.0.1",
    [string]$MgmtLaptopIp = "192.168.0.33",
    [switch]$DryRun
)

$SshPort = 255
$SshUser = "admin"
$KeyFile = Join-Path $env:USERPROFILE ".ssh\id_rsa_mikrotik"
$RscLocal = Join-Path (Split-Path $PSScriptRoot -Parent) "server\mikrotik-hybrid.rsc"
$RscRemote = "hybrid.rsc"

$SshBase = @(
    "-o", "BatchMode=yes",
    "-o", "ConnectTimeout=15",
    "-o", "IdentitiesOnly=yes",
    "-i", $KeyFile,
    "-o", "PubkeyAcceptedAlgorithms=rsa-sha2-256,rsa-sha2-512,ssh-rsa",
    "-o", "StrictHostKeyChecking=accept-new",
    "-m", "hmac-sha1",
    "-p", $SshPort,
    "${SshUser}@${HostAddr}"
)

function Invoke-Mikrotik {
    param([string]$Cmd)
    if ($DryRun) { Write-Host "[dry-run] $Cmd"; return $true }
    $out = & ssh @SshBase $Cmd 2>&1
    foreach ($line in $out) { Write-Host $line }
    return ($LASTEXITCODE -eq 0)
}

Write-Host "=== Apply Hybrid Mikrotik (Fase 2) ==="
Write-Host "SSH target : ${SshUser}@${HostAddr}:${SshPort}"
Write-Host "Mgmt bypass: $MgmtLaptopIp (hybrid mgmt bypass laptop)"
Write-Host "Restore    : .\scripts\restore-failover-phase1-mikrotik.ps1"
Write-Host ""
Write-Host "CHECKLIST sebelum lanjut:"
Write-Host "  [1] Failover Fase 1 aktif (cek mikrotik-failover-phase1-backup.txt)"
Write-Host "  [2] Laptop terhubung Ethernet office ($MgmtLaptopIp)"
Write-Host "  [3] Buka sesi SSH KEDUA ke 192.168.0.1 (cadangan)"
Write-Host "  [4] Aktifkan Safe Mode di Winbox/SSH (opsional, disarankan)"
Write-Host "  [5] Siapkan restore-failover-phase1 jika gagal"
Write-Host ""

if (-not $DryRun) {
    Write-Host "--- Pre-flight: tes SSH ---"
    if (-not (Invoke-Mikrotik "/system identity print")) {
        throw "SSH ke $HostAddr gagal — gunakan 192.168.0.1 dari jaringan office"
    }

    $rscContent = Get-Content $RscLocal -Raw
    if ($MgmtLaptopIp -ne "192.168.0.33" -and $rscContent -match "192.168.0.33") {
        Write-Warning "IP laptop di hybrid.rsc masih 192.168.0.33 — edit file atau set -MgmtLaptopIp"
    }

    Write-Host "`n--- Fase 0: Backup pre-hybrid ---"
    Invoke-Mikrotik "/export file=pre-hybrid-backup" | Out-Null

    Write-Host "`n--- Upload & import hybrid.rsc ---"
    & scp -P $SshPort -o MACs=hmac-sha1 -o StrictHostKeyChecking=accept-new `
        -i $KeyFile $RscLocal "${SshUser}@${HostAddr}:$RscRemote"
    if ($LASTEXITCODE -ne 0) { throw "SCP gagal" }

    $importOut = & ssh @SshBase "/import file=$RscRemote" 2>&1
    foreach ($line in $importOut) { Write-Host $line }
    if ($importOut -match "error|failure|expected") {
        throw "Import hybrid gagal — jalankan: .\scripts\restore-failover-phase1-mikrotik.ps1"
    }
    Invoke-Mikrotik "/file remove $RscRemote" | Out-Null

    Start-Sleep -Seconds 3
}

Write-Host "`n=== Verifikasi ==="
@(
    "/ip firewall mangle print where comment=`"hybrid mgmt bypass laptop`"",
    '/ip route print detail where dst-address=0.0.0.0/0',
    '/routing rule print',
    '/ip firewall mangle print where comment~"hybrid"',
    '/tool netwatch print',
    '/system script print where name~"hybrid"',
    '/ping 8.8.8.8 count=3',
    '/ping 10.100.1.24 count=2',
    '/ping 192.168.0.1 count=2'
) | ForEach-Object {
    Write-Host "--- $_ ---"
    Invoke-Mikrotik $_ | Out-Null
    Write-Host ""
}

Write-Host "Selesai."
Write-Host "Jika gagal: .\scripts\restore-failover-phase1-mikrotik.ps1 -HostAddr $HostAddr"