#!/bin/sh
# /etc/hotplug.d/iface/40-wg-track
# 触发: 小路由 WAN iface 起来时 (boot / DHCP renew / link bounce)
# 目的: 跟踪 WG 隧道自动恢复状态,验证坑 #15 是否真根除
# 安装: scp 到 /etc/hotplug.d/iface/40-wg-track + chmod +x

[ "$ACTION" = "ifup" ] || exit 0
case "$INTERFACE" in
    wan) ;;
    *) exit 0 ;;
esac

WAN_IP=$(ip -4 addr show eth0 2>/dev/null | awk '/inet / {print $2; exit}' | cut -d/ -f1)
[ -z "$WAN_IP" ] && exit 0

LOGFILE=/tmp/wg-tunnel-track.log

# 等 30s 让 tunnel 稳定 (handshake init + keepalive 至少跑两轮)
sleep 30

TS=$(date '+%Y-%m-%d %H:%M:%S')
ENDPOINT=$(wg show wg0 2>/dev/null | awk '/endpoint:/ {print $2; exit}')
HANDSHAKE=$(wg show wg0 2>/dev/null | awk -F': ' '/latest handshake/ {print $2}')
TRANSFER=$(wg show wg0 2>/dev/null | awk '/transfer:/ {print $2, $3, $4, $5}')
PING_LOSS=$(ping -c 3 -W 2 10.99.0.1 2>&1 | awk '/packets transmitted/ {print $6}')

STATUS="OK"
[ "$PING_LOSS" != "0%" ] && STATUS="FAIL"

echo "$TS | status=$STATUS | WAN=$WAN_IP | endpoint=$ENDPOINT | handshake=$HANDSHAKE | loss=$PING_LOSS | xfer=$TRANSFER" >> "$LOGFILE"

# Rotate: 只保留最后 200 行
tail -200 "$LOGFILE" > "$LOGFILE.tmp" 2>/dev/null && mv "$LOGFILE.tmp" "$LOGFILE"