#!/usr/bin/env bash
# Refresh vless.conf from subscription and reload vless-proxy on Swarm (IFT).
set -euo pipefail

STACK_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
STACK_NAME="${STACK_NAME:-ai-router}"
cd "$STACK_DIR"

set -a
# shellcheck disable=SC1091
source .env
set +a

bash "${STACK_DIR}/scripts/fetch-vless-subscription.sh" "${STACK_DIR}/vless/vless.conf"

CONF="$(cat "${STACK_DIR}/vless/vless.conf")"
SVC="${STACK_NAME}_vless-proxy"

rotate_vless_secret() {
  if docker secret inspect vless_conf >/dev/null 2>&1; then
    echo "== Detach old vless_conf secret =="
    docker service scale "${SVC}=0" >/dev/null || true
    sleep 3
    docker service update --secret-rm vless_conf "${SVC}" >/dev/null 2>&1 || true
    sleep 2
    docker secret rm vless_conf >/dev/null 2>&1 || true
  fi
  echo -n "$CONF" | docker secret create vless_conf -
}

if docker service inspect "${SVC}" >/dev/null 2>&1; then
  rotate_vless_secret
  docker service update \
    --secret-add "source=vless_conf,target=/app/vless.conf,mode=0444" \
    "${SVC}" >/dev/null
  docker service update --force "${SVC}" >/dev/null
  TARGET="${VPN_ENABLED:-false}"
  if [[ "$TARGET" == "true" ]]; then
    docker service scale "${SVC}=1" >/dev/null
  fi
  echo "refresh-vless: vless-proxy reloaded"
else
  rotate_vless_secret
  echo "refresh-vless: secret vless_conf updated (service ${SVC} missing — run deploy.sh)"
fi