import paramiko
import sys

sys.stdout.reconfigure(encoding='utf-8')
key_path = r'C:\Users\Snarf\.ssh\id_ed25519_snarfnet'

c = paramiko.SSHClient()
c.set_missing_host_key_policy(paramiko.AutoAddPolicy())
c.connect("140.44.4.71", username="root", key_filename=key_path, timeout=10)

print("1. Creating backup of database and configs...")
backup_cmd = """
cp /var/lib/docker/volumes/nginx-proxy-manager_nginx-data/_data/database.sqlite /var/lib/docker/volumes/nginx-proxy-manager_nginx-data/_data/database.sqlite.bak.$(date +%s)
"""
stdin, stdout, stderr = c.exec_command(backup_cmd)
stdout.channel.recv_exit_status()
print("Backup complete.")

print("2. Updating database.sqlite for hosts 45, 41, and 37...")
py_db = """
import sqlite3, datetime
conn = sqlite3.connect("/var/lib/docker/volumes/nginx-proxy-manager_nginx-data/_data/database.sqlite")
cur = conn.cursor()
now = datetime.datetime.now().strftime("%Y-%m-%d %H:%M:%S")

updates = [
    (45, "140.44.4.34", 443, "https"), # Longhorn -> Aerodrome Traefik
    (41, "140.44.4.62", 443, "https"), # Semaphore -> Spaceport Traefik
    (37, "140.44.4.34", 443, "https"), # Uptime Kuma -> Aerodrome Traefik
]

for pid, host, port, scheme in updates:
    cur.execute('''UPDATE proxy_host
        SET forward_host = ?, forward_port = ?, forward_scheme = ?,
            allow_websocket_upgrade = 1, http2_support = 1, modified_on = ?
        WHERE id = ?''', (host, port, scheme, now, pid))
    print(f"DB updated: Host {pid} -> {scheme}://{host}:{port}")

conn.commit()
conn.close()
"""
stdin, stdout, stderr = c.exec_command(f"python3 -c '{py_db}'")
print(stdout.read().decode())
err = stderr.read().decode()
if err: print("DB err:", err)

print("3. Generating updated nginx configuration files...")

def generate_conf(pid, domains, cert_id, host, port, scheme):
    return f"""# ------------------------------------------------------------
# {domains}
# ------------------------------------------------------------

map $scheme $hsts_header {{
    https   "max-age=63072000; preload";
}}

server {{
  set $forward_scheme {scheme};
  set $server         "{host}";
  set $port           {port};

  listen 80;
  listen [::]:80;

  listen 443 ssl;
  listen [::]:443 ssl;

  server_name {domains};
  http2 on;

  # Let's Encrypt SSL
  include conf.d/include/letsencrypt-acme-challenge.conf;
  include conf.d/include/ssl-cache.conf;
  include conf.d/include/ssl-ciphers.conf;
  ssl_certificate /etc/letsencrypt/live/npm-{cert_id}/fullchain.pem;
  ssl_certificate_key /etc/letsencrypt/live/npm-{cert_id}/privkey.pem;

  # Asset Caching
  include conf.d/include/assets.conf;

  # Block Exploits
  include conf.d/include/block-exploits.conf;

  # Force SSL
  set $trust_forwarded_proto "F";
  include conf.d/include/force-ssl.conf;

  proxy_set_header Upgrade $http_upgrade;
  proxy_set_header Connection $http_connection;
  proxy_http_version 1.1;

  access_log /data/logs/proxy-host-{pid}_access.log proxy;
  error_log /data/logs/proxy-host-{pid}_error.log warn;

  location / {{
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $http_connection;
    proxy_http_version 1.1;

    # Proxy!
    include conf.d/include/proxy.conf;
  }}

  # Custom
  include /data/nginx/custom/server_proxy[.]conf;
}}
"""

configs = [
    (45, "longhorn.aerodrome.snarfnet.net", 37, "140.44.4.34", 443, "https"),
    (41, "semaphore.snarfnet.net", 33, "140.44.4.62", 443, "https"),
    (37, "uptime.snarfnet.net", 27, "140.44.4.34", 443, "https"),
]

for pid, dom, cert_id, host, port, scheme in configs:
    cfg = generate_conf(pid, dom, cert_id, host, port, scheme)
    path = f"/var/lib/docker/volumes/nginx-proxy-manager_nginx-data/_data/nginx/proxy_host/{pid}.conf"
    cmd = f"cat << 'EOF' > {path}\n{cfg}\nEOF\n"
    stdin, stdout, stderr = c.exec_command(cmd)
    stdout.channel.recv_exit_status()
    print(f"Wrote config: {path}")

print("4. Testing Nginx config inside container...")
stdin, stdout, stderr = c.exec_command("docker exec $(docker ps -q -f name=nginx-proxy-manager_app | head -n1) nginx -t")
out = stdout.read().decode()
err = stderr.read().decode()
print("nginx -t stdout:", out)
print("nginx -t stderr:", err)

if "successful" in out or "successful" in err:
    print("5. Reloading Nginx via Swarm service update...")
    stdin, stdout, stderr = c.exec_command("docker service update --force nginx-proxy-manager_app")
    print(stdout.read().decode())
    print("Reload completed.")
else:
    print("ERROR: Nginx config test failed!")

c.close()