import paramiko
import sys

sys.stdout.reconfigure(encoding='utf-8')
key_path = r'C:\Users\Snarf\.ssh\id_ed25519_snarfnet'

c = paramiko.SSHClient()
c.set_missing_host_key_policy(paramiko.AutoAddPolicy())
c.connect("140.44.4.71", username="root", key_filename=key_path, timeout=10)

print("1. Updating SQLite database for hosts 11 and 28...")
dsm_adv = """proxy_buffer_size 128k;
proxy_buffers 8 256k;
proxy_busy_buffers_size 256k;
proxy_read_timeout 3600s;
proxy_send_timeout 3600s;
proxy_ssl_verify off;"""

py_db = f"""
import sqlite3, datetime
conn = sqlite3.connect('/var/lib/docker/volumes/nginx-proxy-manager_nginx-data/_data/database.sqlite')
cur = conn.cursor()
now = datetime.datetime.now().strftime('%Y-%m-%d %H:%M:%S')

adv = '''{dsm_adv}'''

# Host 11: sn-nas.snarfnet.net -> 14.10.10.71:5001
cur.execute('''UPDATE proxy_host
    SET forward_host = "14.10.10.71", forward_port = 5001, forward_scheme = "https",
        allow_websocket_upgrade = 1, http2_support = 1, advanced_config = ?, modified_on = ?
    WHERE id = 11''', (adv, now))

# Host 28: snarfnas.snarfnet.net -> 14.10.10.72:5001 (Clean DSM, remove dead outpost)
cur.execute('''UPDATE proxy_host
    SET forward_host = "14.10.10.72", forward_port = 5001, forward_scheme = "https",
        allow_websocket_upgrade = 1, http2_support = 1, advanced_config = ?, modified_on = ?
    WHERE id = 28''', (adv, now))

conn.commit()
print("Database updated for hosts 11 and 28.")
conn.close()
"""

sftp = c.open_sftp()
with sftp.open('/tmp/update_nas_db.py', 'w') as f:
    f.write(py_db)
sftp.close()

stdin, stdout, stderr = c.exec_command("python3 /tmp/update_nas_db.py")
print(stdout.read().decode())
err = stderr.read().decode()
if err: print("DB err:", err)

print("2. Generating Nginx configuration files for hosts 11 and 28...")

def make_dsm_conf(pid, domain, cert_id, host, port):
    return f"""# ------------------------------------------------------------
# {domain}
# ------------------------------------------------------------

map $scheme $hsts_header {{
    https   "max-age=63072000;includeSubDomains; preload";
}}

server {{
  set $forward_scheme https;
  set $server         "{host}";
  set $port           {port};

  listen 80;
  listen [::]:80;

  listen 443 ssl;
  listen [::]:443 ssl;

  server_name {domain};
  http2 on;

  # Let's Encrypt SSL
  include conf.d/include/letsencrypt-acme-challenge.conf;
  include conf.d/include/ssl-cache.conf;
  include conf.d/include/ssl-ciphers.conf;
  ssl_certificate /etc/letsencrypt/live/npm-{cert_id}/fullchain.pem;
  ssl_certificate_key /etc/letsencrypt/live/npm-{cert_id}/privkey.pem;

  # Asset Caching
  include conf.d/include/assets.conf;

  # Block Exploits
  include conf.d/include/block-exploits.conf;

  # HSTS
  add_header Strict-Transport-Security $hsts_header always;

  # Force SSL
  set $trust_forwarded_proto "F";
  include conf.d/include/force-ssl.conf;

  proxy_set_header Upgrade $http_upgrade;
  proxy_set_header Connection $http_connection;
  proxy_http_version 1.1;

  access_log /data/logs/proxy-host-{pid}_access.log proxy;
  error_log /data/logs/proxy-host-{pid}_error.log warn;

  location / {{
    # HSTS
    add_header Strict-Transport-Security $hsts_header always;

    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $http_connection;
    proxy_http_version 1.1;

    # DSM Buffer Tuning
    proxy_buffer_size 128k;
    proxy_buffers 8 256k;
    proxy_busy_buffers_size 256k;
    proxy_read_timeout 3600s;
    proxy_send_timeout 3600s;
    proxy_ssl_verify off;

    # Proxy!
    include conf.d/include/proxy.conf;
  }}

  # Custom
  include /data/nginx/custom/server_proxy[.]conf;
}}
"""

conf11 = make_dsm_conf(11, "sn-nas.snarfnet.net", 12, "14.10.10.71", 5001)
conf28 = make_dsm_conf(28, "snarfnas.snarfnet.net", 22, "14.10.10.72", 5001)

path11 = "/var/lib/docker/volumes/nginx-proxy-manager_nginx-data/_data/nginx/proxy_host/11.conf"
path28 = "/var/lib/docker/volumes/nginx-proxy-manager_nginx-data/_data/nginx/proxy_host/28.conf"

stdin, stdout, stderr = c.exec_command(f"cat << 'EOF' > {path11}\n{conf11}\nEOF\n")
stdout.channel.recv_exit_status()
print(f"Wrote {path11}")

stdin, stdout, stderr = c.exec_command(f"cat << 'EOF' > {path28}\n{conf28}\nEOF\n")
stdout.channel.recv_exit_status()
print(f"Wrote {path28}")

print("3. Testing Nginx configuration...")
stdin, stdout, stderr = c.exec_command("docker exec $(docker ps -q -f name=nginx-proxy-manager_app | head -n1) nginx -t")
out = stdout.read().decode()
err = stderr.read().decode()
print("nginx -t stdout:", out)
print("nginx -t stderr:", err)

if "successful" in out or "successful" in err:
    print("4. Reloading Nginx Swarm service...")
    stdin, stdout, stderr = c.exec_command("docker service update --force nginx-proxy-manager_app")
    print(stdout.read().decode())
    print("Reload complete!")
else:
    print("ERROR: Nginx config invalid!")

c.close()