# Restore Mikrotik ke Failover Fase 1 (setelah Hybrid Fase 2 gagal)
# Usage: .\scripts\restore-failover-phase1-mikrotik.ps1
# Default SSH: 192.168.0.1 (office gateway — stabil saat hybrid gagal)

param(
    [string]$HostAddr = "192.168.0.1",
    [switch]$DryRun
)

$SshPort = 255
$SshUser = "admin"
$KeyFile = Join-Path $env:USERPROFILE ".ssh\id_rsa_mikrotik"
$RscLocal = Join-Path (Split-Path $PSScriptRoot -Parent) "server\mikrotik-restore-failover-phase1.rsc"
$RscRemote = "restore-failover-phase1.rsc"

$SshBase = @(
    "-o", "BatchMode=yes",
    "-o", "ConnectTimeout=15",
    "-o", "IdentitiesOnly=yes",
    "-i", $KeyFile,
    "-o", "PubkeyAcceptedAlgorithms=rsa-sha2-256,rsa-sha2-512,ssh-rsa",
    "-o", "StrictHostKeyChecking=accept-new",
    "-m", "hmac-sha1",
    "-p", $SshPort,
    "${SshUser}@${HostAddr}"
)

function Invoke-Mikrotik {
    param([string]$Cmd)
    if ($DryRun) { Write-Host "[dry-run] $Cmd"; return $true }
    $out = & ssh @SshBase $Cmd 2>&1
    foreach ($line in $out) { Write-Host $line }
    return ($LASTEXITCODE -eq 0)
}

Write-Host "=== Restore Failover Fase 1 ==="
Write-Host "Target: $HostAddr"

if (-not $DryRun) {
    & scp -P $SshPort -o MACs=hmac-sha1 -o StrictHostKeyChecking=accept-new `
        -i $KeyFile $RscLocal "${SshUser}@${HostAddr}:$RscRemote"
    if ($LASTEXITCODE -ne 0) { throw "SCP gagal" }
    Invoke-Mikrotik "/import file=$RscRemote" | Out-Null
    Invoke-Mikrotik "/file remove $RscRemote" | Out-Null
}

@(
    '/ip route print detail where dst-address=0.0.0.0/0',
    '/ip firewall mangle print where comment~"hybrid"',
    '/routing rule print',
    '/ip dhcp-client print where interface=sfp-sfpplus1',
    '/ping 8.8.8.8 count=3'
) | ForEach-Object {
    Write-Host "--- $_ ---"
    Invoke-Mikrotik $_ | Out-Null
    Write-Host ""
}

Write-Host "Selesai. Acuan: server/mikrotik-failover-phase1-backup.txt"