#!/usr/bin/env python3
"""Route exposedgays.com DNS via cloudflared on COOLIFY_01."""
import paramiko

PASS = "Bbt9115xty9176!"
HOST = "10.10.0.10"
USER = "localadministrator"
TUNNEL = "03079a26-f14c-4622-b463-ba54a24f7472"
CREDS = f"/etc/cloudflared/{TUNNEL}.json"
DOMAIN = "exposedgays.com"

c = paramiko.SSHClient()
c.set_missing_host_key_policy(paramiko.AutoAddPolicy())
c.connect(HOST, username=USER, password=PASS, timeout=30)

cmds = [
    f"echo '{PASS}' | sudo -S find / -name 'cert.pem' 2>/dev/null | head -20",
    f"echo '{PASS}' | sudo -S cat {CREDS}",
    f"echo '{PASS}' | sudo -S cloudflared tunnel --cred-file {CREDS} route dns -f {TUNNEL} {DOMAIN} 2>&1",
    f"echo '{PASS}' | sudo -S cloudflared tunnel --cred-file {CREDS} route dns -f {TUNNEL} www.{DOMAIN} 2>&1",
    "dig @1.1.1.1 exposedgays.com CNAME +short 2>&1",
    "dig @1.1.1.1 www.exposedgays.com CNAME +short 2>&1",
    "dig @1.1.1.1 exposedgays.com A +short 2>&1",
]
for cmd in cmds:
    print("===", cmd[:100], "===")
    _, o, e = c.exec_command(cmd, timeout=120)
    o.channel.recv_exit_status()
    out = (o.read() + e.read()).decode(errors="replace")
    # redact tunnel secret if present
    if "TunnelSecret" in out:
        import re
        out = re.sub(r'"TunnelSecret":\s*"[^"]+"', '"TunnelSecret": "[REDACTED]"', out)
    print(out[:8000])
    print()

c.close()