# Dual-WAN Mikrotik — upload .rsc dan import
# Usage: .\scripts\apply-dual-wan-mikrotik.ps1

param(
    [switch]$DryRun
)

$HostAddr = "10.100.1.1"
$SshPort = 255
$SshUser = "admin"
$KeyFile = Join-Path $env:USERPROFILE ".ssh\id_rsa_mikrotik"
$RscLocal = Join-Path (Split-Path $PSScriptRoot -Parent) "server\mikrotik-dual-wan.rsc"
$RscRemote = "dual-wan.rsc"

$SshBase = @(
    "-o", "BatchMode=yes",
    "-o", "IdentitiesOnly=yes",
    "-i", $KeyFile,
    "-o", "PubkeyAcceptedAlgorithms=rsa-sha2-256,rsa-sha2-512,ssh-rsa",
    "-o", "StrictHostKeyChecking=accept-new",
    "-m", "hmac-sha1",
    "-p", $SshPort,
    "${SshUser}@${HostAddr}"
)

function Invoke-Mikrotik {
    param([string]$Cmd)
    if ($DryRun) {
        Write-Host "[dry-run] $Cmd"
        return
    }
    $out = & ssh @SshBase $Cmd 2>&1
    foreach ($line in $out) { Write-Host $line }
    if ($LASTEXITCODE -ne 0) { Write-Warning "ssh exit $LASTEXITCODE" }
}

Write-Host "=== Apply Dual-WAN Mikrotik ==="
Write-Host "File: $RscLocal"

if (-not $DryRun) {
    Write-Host "Upload $RscRemote ..."
    & scp -P $SshPort -o MACs=hmac-sha1 -o StrictHostKeyChecking=accept-new `
        -i $KeyFile $RscLocal "${SshUser}@${HostAddr}:$RscRemote"
    if ($LASTEXITCODE -ne 0) { throw "SCP gagal" }

    Write-Host "Import config ..."
    Invoke-Mikrotik "/import file=$RscRemote"
    Invoke-Mikrotik "/file remove $RscRemote"
}

Write-Host "`n=== Verifikasi ==="
@(
    '/interface ethernet print where name=sfp-sfpplus1',
    '/ip dhcp-client print',
    '/ip route print where dst-address=0.0.0.0/0',
    '/routing rule print',
    '/ip firewall mangle print where comment~"dual-wan"',
    '/ip firewall nat print where chain=srcnat'
) | ForEach-Object {
    Write-Host "--- $_ ---"
    Invoke-Mikrotik $_
    Write-Host ""
}

Write-Host "Selesai."