#!/usr/bin/env bash
# Configure Pi-hole to forward sweet.home DNS queries to FreeIPA.
#
# Usage:
#   bash configure-pihole-dns.sh <pihole-host>
#   bash configure-pihole-dns.sh pihole.sweet.home
#
# Idempotent — safe to run multiple times.
# Requires SSH access to the Pi-hole host as a user with sudo.

set -euo pipefail

PIHOLE_HOST="${1:-}"
IPA_IP="192.168.2.138"
IPA_DOMAIN="sweet.home"
DNSMASQ_CONF="/etc/dnsmasq.d/10-ipa-${IPA_DOMAIN//./-}.conf"
DIRECTIVE="server=/${IPA_DOMAIN}/${IPA_IP}"

if [[ -z "$PIHOLE_HOST" ]]; then
  echo "Usage: $0 <pihole-host>" >&2
  exit 1
fi

echo "==> Configuring Pi-hole at $PIHOLE_HOST to forward $IPA_DOMAIN → $IPA_IP..."

ssh "$PIHOLE_HOST" "
  set -euo pipefail

  if grep -qF '${DIRECTIVE}' '${DNSMASQ_CONF}' 2>/dev/null; then
    echo '==> Forwarder already configured, skipping write.'
  else
    echo '${DIRECTIVE}' | sudo tee '${DNSMASQ_CONF}'
    echo '==> Written to ${DNSMASQ_CONF}'
  fi

  echo '==> Restarting Pi-hole DNS...'
  sudo pihole restartdns

  echo '==> Verifying SRV record resolution via Pi-hole...'
  sleep 2
  dig +short _kerberos._udp.${IPA_DOMAIN} SRV @127.0.0.1 || true
"

echo "==> Done. Pi-hole now forwards ${IPA_DOMAIN} queries to ${IPA_IP}."
echo "    Verify from a LAN client:"
echo "      dig +short _kerberos._udp.${IPA_DOMAIN} SRV @${PIHOLE_HOST}"