#!/usr/bin/env bash
# Define and start the isolated NAT network "pve-net" with fixed DHCP
# reservations so each VM always gets the same IP.
set -euo pipefail
source "$(dirname "$0")/lab.env"

sudo -v   # prompt for the sudo password once, up front

XML="${BUILD_DIR}/${NET_NAME}.xml"
cat > "$XML" <<EOF
<network>
  <name>${NET_NAME}</name>
  <forward mode='nat'/>
  <bridge name='${NET_BRIDGE}' stp='on' delay='0'/>
  <domain name='${DOMAIN}' localOnly='yes'/>
  <ip address='${NET_GW}' netmask='255.255.255.0'>
    <dhcp>
      <range start='${NET_DHCP_START}' end='${NET_DHCP_END}'/>
      <host mac='${PVE1_MAC}'  name='${PVE1_NAME}'  ip='${PVE1_IP}'/>
      <host mac='${PVE2_MAC}'  name='${PVE2_NAME}'  ip='${PVE2_IP}'/>
      <host mac='${STORE_MAC}' name='${STORE_NAME}' ip='${STORE_IP}'/>
    </dhcp>
  </ip>
</network>
EOF

echo "==> Defining network ${NET_NAME}"
if sudo virsh net-info "$NET_NAME" >/dev/null 2>&1; then
  echo "    already defined; recreating to pick up any changes"
  sudo virsh net-destroy "$NET_NAME" 2>/dev/null || true
  sudo virsh net-undefine "$NET_NAME" 2>/dev/null || true
fi
sudo virsh net-define "$XML"
sudo virsh net-autostart "$NET_NAME"
sudo virsh net-start "$NET_NAME"

echo "==> Network status"
sudo virsh net-info "$NET_NAME"

# On firewalld hosts, libvirt's NAT network often does not get FORWARD-accept
# rules, so guests can reach the host gateway but not the internet (apt on the
# storage VM then fails). Add explicit forward + masquerade for our subnet.
# Idempotent: '-C' checks for the rule before inserting.
echo "==> Ensuring host IP forwarding + NAT for ${NET_SUBNET}/${NET_PREFIX} (${NET_BRIDGE})"
sudo sysctl -wq net.ipv4.ip_forward=1
sudo iptables -t nat -C POSTROUTING -s "${NET_SUBNET}/${NET_PREFIX}" ! -d "${NET_SUBNET}/${NET_PREFIX}" -j MASQUERADE 2>/dev/null \
  || sudo iptables -t nat -I POSTROUTING -s "${NET_SUBNET}/${NET_PREFIX}" ! -d "${NET_SUBNET}/${NET_PREFIX}" -j MASQUERADE
sudo iptables -C FORWARD -i "${NET_BRIDGE}" -j ACCEPT 2>/dev/null || sudo iptables -I FORWARD -i "${NET_BRIDGE}" -j ACCEPT
sudo iptables -C FORWARD -o "${NET_BRIDGE}" -j ACCEPT 2>/dev/null || sudo iptables -I FORWARD -o "${NET_BRIDGE}" -j ACCEPT

echo
echo "Network up. Next: ./02-download-iso.sh"