#!/usr/bin/bash

die() {
    echo "${BASH_SOURCE[1]}: line ${BASH_LINENO[0]}: ${FUNCNAME[1]}: ${1:-Died}" >&2
    exit 1
}

case "$1" in
    up)
        ip link add "$WIREGUARD_NAME" mtu $WIREGUARD_INITIAL_MTU type wireguard || die

        wg set "$WIREGUARD_NAME" \
            private-key <(echo "$WIREGUARD_PRIVATE_KEY") \
            peer "$WIREGUARD_VPN_PUBLIC_KEY" \
                endpoint "$WIREGUARD_ENDPOINT" \
                allowed-ips "$WIREGUARD_ALLOWED_IPS" || die

        ip link set "$WIREGUARD_NAME" netns "$NETNS_NAME" || die

        # Addresses are comma-separated, so to split them.
        tr ',' '\n' <<<"$WIREGUARD_IP_ADDRESSES" |
            xargs -I '{}' \
                ip -n "$NETNS_NAME" address add '{}' dev "$WIREGUARD_NAME" || die

        ip -n "$NETNS_NAME" link set "$WIREGUARD_NAME" up || die

        # Add default routes for IPv4 and IPv6
        ip -n "$NETNS_NAME" -4 route add default dev "$WIREGUARD_NAME" || die
        if ip -o -6 -a | grep -q "$WIREGUARD_NAME"
        then 
            ip -n "$NETNS_NAME" -6 route add default dev "$WIREGUARD_NAME" || die
        fi
        ;;

    down)
        # We need to delete the WireGuard interface. It's initially created in
        # the init network namespace, then moved to the VPN namespace.
        # Depending how well the "up" operation went, it might be in either.
        ip -n "$NETNS_NAME" link delete "$WIREGUARD_NAME" ||
            ip link delete "$WIREGUARD_NAME" || die
        ;;
esac

