#!/usr/bin/env python3
"""Add exposedgays.com to cloudflared tunnel on COOLIFY_01."""
import paramiko
import re

HOST = "10.10.0.10"
USER = "localadministrator"
PASS = "Bbt9115xty9176!"
CONFIG = "/etc/cloudflared/config.yml"

c = paramiko.SSHClient()
c.set_missing_host_key_policy(paramiko.AutoAddPolicy())
c.connect(HOST, username=USER, password=PASS, timeout=20, allow_agent=False, look_for_keys=False)

_, o, e = c.exec_command(f"sudo cat {CONFIG}", timeout=30)
config = o.read().decode()
print("Current config snippet:")
print(config[-2000:])

if "exposedgays.com" in config:
    print("Tunnel entry already exists")
else:
    entry = """
  - hostname: exposedgays.com
    service: https://localhost:443
    originRequest:
      noTLSVerify: true
  - hostname: www.exposedgays.com
    service: https://localhost:443
    originRequest:
      noTLSVerify: true
"""
    # Insert before catch-all if present
    if "catch-all" in config or "http_status:404" in config:
        new_config = re.sub(
            r"(\n  - service: http_status:404)",
            entry + r"\1",
            config,
            count=1,
        )
    else:
        new_config = config.rstrip() + "\ningress:" + entry

    sftp = c.open_sftp()
    with sftp.file("/tmp/cloudflared_exposedgays.yml", "w") as f:
        f.write(new_config)
    sftp.close()
    c.exec_command(f"sudo cp {CONFIG} {CONFIG}.bak.exposedgays")
    c.exec_command(f"sudo cp /tmp/cloudflared_exposedgays.yml {CONFIG}")
    c.exec_command("sudo systemctl restart cloudflared")
    print("Tunnel updated and cloudflared restarted")

c.close()