#!/usr/bin/env bash
# Surgical: restart exactly one Besu validator LXC service (default VMID 1001 — stuck participant).
# Resolves PVE host via get_host_for_vmid (scripts/lib/load-project-env.sh). No other CTs touched.
#
# Usage:
#   bash scripts/operator/restart-besu-validator-single.sh --dry-run
#   PROXMOX_OPS_APPLY=1 PROXMOX_OPS_ALLOWED_VMIDS=1001 bash scripts/operator/restart-besu-validator-single.sh --vmid 1001 --apply
#
# Requires: LAN SSH to Proxmox. Mutations require --apply or PROXMOX_OPS_APPLY=1 and (if set) allowlist.

set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
# shellcheck source=/dev/null
source "${PROJECT_ROOT}/scripts/lib/load-project-env.sh"
# shellcheck source=/dev/null
source "${PROJECT_ROOT}/scripts/lib/proxmox-production-guard.sh"

VMID="${BESU_SURGICAL_RESTART_VMID:-1001}"
APPLY=false
DRY=false
SSH_OPTS=(-o ConnectTimeout=15 -o BatchMode=yes -o StrictHostKeyChecking=no)

usage() {
  sed -n '1,18p' "$0"
}

while [[ $# -gt 0 ]]; do
  case "$1" in
    --vmid) VMID="$2"; shift 2 ;;
    --apply) APPLY=true; shift ;;
    --dry-run) DRY=true; shift ;;
    -h|--help) usage; exit 0 ;;
    *) echo "Unknown: $1" >&2; usage >&2; exit 2 ;;
  esac
done

[[ "$VMID" =~ ^[0-9]+$ ]] || { echo "Bad vmid: $VMID" >&2; exit 2; }

host="$(get_host_for_vmid "$VMID")"
unit="besu-validator.service"

if $DRY || ! pguard_require_apply_flag "$APPLY"; then
  echo "[dry-run] ssh root@${host} pct exec ${VMID} -- systemctl restart ${unit}"
  echo "[dry-run] Then: cast block-number --rpc-url \${RPC_URL_138:-http://192.168.11.211:8545} (repeat)"
  exit 0
fi

pguard_vmid_allowed "$VMID" || exit 1

echo "[apply] VMID ${VMID} on ${host}: systemctl restart ${unit}"
if ssh "${SSH_OPTS[@]}" "root@${host}" "pct exec ${VMID} -- systemctl restart ${unit}"; then
  echo "[apply] restart command returned 0"
else
  echo "[apply] restart failed (exit $?)" >&2
  exit 1
fi

sleep 5
if ssh "${SSH_OPTS[@]}" "root@${host}" "pct exec ${VMID} -- systemctl is-active ${unit}" 2>/dev/null | grep -q active; then
  echo "[apply] ${unit} is active"
else
  echo "[apply] WARN: service may not be active yet; check journal on CT ${VMID}" >&2
fi