#!/bin/sh
# STUN/TURN (coturn) on cast02 — co-located with Janus SFU for lab NAT traversal.
set -eu
ROOT="$(cd "$(dirname "$0")/.." && pwd)"
# shellcheck source=/dev/null
. "$ROOT/scripts/lib/common.sh"
load_cluster_env

install_coturn_on_cast02() {
  [ "$(host_short)" = "$CAST02_HOST" ] || return 0
  log "cast02: install/configure coturn"
  apk add --no-cache coturn 2>/dev/null || apk add --no-cache turnserver 2>/dev/null || {
    log "WARN cast02: coturn package not available"
    return 1
  }

  TURN_REALM="${LAB_TURN_REALM:-acl0.f0xx.org}"
  TURN_USER="${LAB_TURN_USER:-acturn}"
  TURN_SECRET="$(read_cred coturn secret 2>/dev/null || echo 'ac-lab-turn-change-me')"
  TURN_LISTEN="${CAST02_IP:-127.0.0.1}"

  mkdir -p /etc/coturn
  cat > /etc/turnserver.conf <<EOF
# Android Cast lab TURN (cast02) — static auth for WebRTC clients
listening-port=3478
tls-listening-port=5349
listening-ip=${TURN_LISTEN}
relay-ip=${TURN_LISTEN}
realm=${TURN_REALM}
server-name=cast02-turn
fingerprint
lt-cred-mech
user=${TURN_USER}:${TURN_SECRET}
no-cli
no-tlsv1
no-tlsv1_1
min-port=49152
max-port=65535
log-file=/var/log/turnserver.log
EOF

  rc-update add coturn default 2>/dev/null || rc-update add turnserver default 2>/dev/null || true
  rc-service coturn restart 2>/dev/null || rc-service turnserver restart 2>/dev/null || true
  if ss -lun | grep -q ':3478 '; then
    log "cast02: coturn listening on UDP 3478"
  else
    log "WARN cast02: coturn may not be listening (check /var/log/turnserver.log)"
  fi
}

write_sfu_turn_config() {
  WS="${AC_WORKSPACE_ROOT:-/var/www/ac/workspace}/ac-ms-sfu-signaling/config/config.php"
  [ -f "$WS" ] || return 0
  TURN_USER="${LAB_TURN_USER:-acturn}"
  TURN_SECRET="$(read_cred coturn secret 2>/dev/null || echo 'ac-lab-turn-change-me')"
  TURN_HOST="${CAST02_IP}"
  if grep -q "'turn_" "$WS" 2>/dev/null; then
    return 0
  fi
  log "append TURN hints to sfu config (clients may still use public STUN)"
  # shellcheck disable=SC2016
  sed -i "/];$/i\\
    'turn_host' => '${TURN_HOST}',\\
    'turn_port' => 3478,\\
    'turn_user' => '${TURN_USER}',\\
    'turn_pass' => '${TURN_SECRET}',\\
    'stun_urls' => ['stun:stun.l.google.com:19302'],\\
" "$WS" 2>/dev/null || true
}

install_coturn_on_cast02
write_sfu_turn_config
log "deploy-coturn_ok $(host_short)"