#!/usr/bin/env bash
# Install / update wyrs-geo-guard on the Singapore ECS (run on host or via SSH).
set -euo pipefail

ROOT="$(cd "$(dirname "$0")" && pwd)"
DST=/opt/wyrs-geo-guard

need_pkg() {
  if ! rpm -q "$1" >/dev/null 2>&1; then
    dnf install -y "$1"
  fi
}

need_pkg python3-geoip2
# maxminddb usually pulled in; ensure present
need_pkg python3-maxminddb || true

if [[ ! -f /usr/share/GeoIP/GeoLite2-City.mmdb ]]; then
  echo "missing /usr/share/GeoIP/GeoLite2-City.mmdb" >&2
  exit 1
fi

mkdir -p "$DST" /etc/nginx/snippets /var/www/wyrs-geo-deny
install -m 0755 "$ROOT/wyrs_geo_guard.py" "$DST/wyrs_geo_guard.py"
install -m 0644 "$ROOT/wyrs-geo-guard.service" /etc/systemd/system/wyrs-geo-guard.service
install -m 0644 "$ROOT/../nginx/snippets/wyrs-cn-geo-access.conf" /etc/nginx/snippets/wyrs-cn-geo-access.conf
install -m 0644 "$ROOT/../nginx/static/cn-mainland-denied.html" /var/www/wyrs-geo-deny/index.html

systemctl daemon-reload
systemctl enable --now wyrs-geo-guard.service
systemctl restart wyrs-geo-guard.service
sleep 0.3
curl -fsS "http://127.0.0.1:18099/healthz" >/dev/null
echo "geo-guard ok"
# quick probes
curl -sS -o /dev/null -w "shanghai:%{http_code}\n" "http://127.0.0.1:18099/check?ip=114.80.80.80"
curl -sS -o /dev/null -w "hangzhou:%{http_code}\n" "http://127.0.0.1:18099/check?ip=223.5.5.5"
curl -sS -o /dev/null -w "us:%{http_code}\n" "http://127.0.0.1:18099/check?ip=8.8.8.8"