#!/bin/bash
# Quick fix for production MikroTik connection issues

echo "==================================================================="
echo "Production MikroTik Connection Quick Fix"
echo "==================================================================="
echo ""

echo "Current Issue:"
echo "- Production server cannot reach MikroTik router at 192.168.0.173"
echo "- Error: [Errno 111] Connection refused"
echo "- Router is on private network, not accessible from production"
echo ""

echo "==================================================================="
echo "OPTION 1: Enable Mock Mode (Temporary Fix)"
echo "==================================================================="
echo ""
echo "Add to production .env file:"
echo ""
echo "MIKROTIK_MOCK_MODE=true"
echo ""
echo "This will:"
echo "✓ Return graceful error messages instead of connection refused"
echo "✓ Allow other API endpoints to work normally"
echo "✗ Disable all router management features"
echo ""
echo "To apply:"
echo "1. SSH to production: ssh user@api.kitonga.klikcell.com"
echo "2. Edit .env: nano /path/to/your/project/.env"
echo "3. Add: MIKROTIK_MOCK_MODE=true"
echo "4. Restart Django: sudo systemctl restart gunicorn"
echo ""

echo "==================================================================="
echo "OPTION 2: Setup VPN (Permanent Solution)"
echo "==================================================================="
echo ""
echo "Step 1: Configure WireGuard on MikroTik"
echo "----------------------------------------"
echo "/interface wireguard add name=wg-prod listen-port=13231"
echo "/ip address add address=10.10.0.1/24 interface=wg-prod"
echo ""
echo "Step 2: Install WireGuard on Production Server"
echo "-----------------------------------------------"
echo "sudo apt update && sudo apt install wireguard"
echo "wg genkey | tee /etc/wireguard/privatekey | wg pubkey > /etc/wireguard/publickey"
echo ""
echo "Step 3: Configure WireGuard Peer"
echo "---------------------------------"
echo "Create /etc/wireguard/wg0.conf with:"
echo ""
cat << 'WGCONF'
[Interface]
PrivateKey = <YOUR_PRIVATE_KEY>
Address = 10.10.0.2/24

[Peer]
PublicKey = <MIKROTIK_PUBLIC_KEY>
Endpoint = <YOUR_HOME_PUBLIC_IP>:13231
AllowedIPs = 10.10.0.0/24, 192.168.0.0/24
PersistentKeepalive = 25
WGCONF
echo ""
echo "Step 4: Start WireGuard"
echo "-----------------------"
echo "sudo systemctl enable wg-quick@wg0"
echo "sudo systemctl start wg-quick@wg0"
echo ""
echo "Step 5: Update Production .env"
echo "-------------------------------"
echo "MIKROTIK_HOST=192.168.0.173  # Now reachable via VPN"
echo "MIKROTIK_PORT=8728"
echo "MIKROTIK_MOCK_MODE=false"
echo ""

echo "==================================================================="
echo "OPTION 3: Port Forwarding (Less Secure)"
echo "==================================================================="
echo ""
echo "Step 1: Get Your Public IP"
echo "--------------------------"
echo "curl ifconfig.me"
echo ""
echo "Step 2: Configure MikroTik Port Forwarding"
echo "-------------------------------------------"
echo "/ip firewall nat add chain=dstnat dst-port=8728 protocol=tcp \\"
echo "  action=dst-nat to-addresses=192.168.0.173 to-ports=8728"
echo ""
echo "/ip firewall filter add chain=input protocol=tcp dst-port=8728 \\"
echo "  src-address=<PRODUCTION_SERVER_IP> action=accept \\"
echo "  comment='Allow production API access'"
echo ""
echo "Step 3: Update Production .env"
echo "-------------------------------"
echo "MIKROTIK_HOST=<YOUR_PUBLIC_IP>"
echo "MIKROTIK_PORT=8728"
echo "MIKROTIK_MOCK_MODE=false"
echo ""

echo "==================================================================="
echo "Testing Connection"
echo "==================================================================="
echo ""
echo "Test from production server:"
echo "----------------------------"
echo "nc -zv 192.168.0.173 8728"
echo ""
echo "Test API endpoint:"
echo "------------------"
echo "curl -X POST https://api.kitonga.klikcell.com/api/admin/mikrotik/test-connection/ \\"
echo "  -H 'X-Admin-Access: kitonga_admin_2025' \\"
echo "  -H 'Content-Type: application/json'"
echo ""

echo "==================================================================="
echo "Recommended Next Steps"
echo "==================================================================="
echo ""
echo "1. IMMEDIATE (5 minutes):"
echo "   → Enable MIKROTIK_MOCK_MODE=true in production"
echo "   → This fixes the 500 errors immediately"
echo ""
echo "2. SHORT TERM (1-2 hours):"
echo "   → Set up WireGuard VPN for secure access"
echo "   → Test connection from production"
echo ""
echo "3. LONG TERM (future):"
echo "   → Consider co-locating router with production server"
echo "   → Implement proper network architecture"
echo ""
echo "==================================================================="
echo "Documentation"
echo "==================================================================="
echo ""
echo "Full guide: PRODUCTION_MIKROTIK_SETUP_GUIDE.md"
echo ""