#!/usr/bin/env bash
set -euo pipefail

STACK_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
STACK_NAME="${STACK_NAME:-ai-router}"
cd "$STACK_DIR"

set -a
# shellcheck disable=SC1091
source .env
set +a

VLESS_URL="${VLESS_PROXY_URL:-http://vless-proxy:8080}"
NO_PROXY_VAL="${NO_PROXY:-localhost,127.0.0.1,api.novita.ai,novita.ai}"

echo "== Scale vless-proxy and vpn-watchdog to 1 =="
docker service scale "${STACK_NAME}_vless-proxy=1" "${STACK_NAME}_vpn-watchdog=1"

echo "== Wait for vless-proxy healthy (max 90s) =="
for i in $(seq 1 18); do
  CID=$(docker ps -q -f "name=${STACK_NAME}_vless-proxy" | head -1)
  if [[ -n "$CID" ]]; then
    STATUS=$(docker inspect --format='{{.State.Health.Status}}' "$CID" 2>/dev/null || echo "starting")
    if [[ "$STATUS" == "healthy" ]]; then
      echo "vless-proxy is healthy"
      break
    fi
    echo "  attempt $i: status=$STATUS"
  fi
  sleep 5
done

echo "== E2E tunnel probe =="
docker run --rm --network "${STACK_NAME}_ai-internal" curlimages/curl:8.5.0 \
  curl -sf -x "${VLESS_URL}" --max-time 15 https://www.google.com/generate_204 \
  || echo "WARN: tunnel probe failed (may need valid vless.conf)"

echo "== Point litellm through VPN =="
docker service update \
  --env-add "HTTP_PROXY=${VLESS_URL}" \
  --env-add "HTTPS_PROXY=${VLESS_URL}" \
  --env-add "NO_PROXY=${NO_PROXY_VAL}" \
  "${STACK_NAME}_litellm"

echo "VPN enabled. Novita bypasses via NO_PROXY."