#!/bin/sh
# flux-pace installer: paces Capacitor -> UT Synapse PACS (10.93.11.68:104) with
# macOS dummynet to avoid burst loss on the 10.103->10.93 path. Persists via a
# LaunchDaemon that re-applies the pipe/rule at boot and every 5 minutes.
#
#   Install:  sudo sh p            (optional rate: sudo sh p 500Mbit/s)
#   Remove:   sudo sh p remove
set -e

RATE="${1:-300Mbit/s}"
SCRIPT=/usr/local/sbin/flux-pace.sh
PLIST=/Library/LaunchDaemons/co.fluxinc.pace.plist
ANCHOR="com.apple/flux-pace"

[ "$(id -u)" = 0 ] || { echo "run with sudo"; exit 1; }

if [ "$1" = "remove" ]; then
  launchctl bootout system "$PLIST" 2>/dev/null || true
  rm -f "$PLIST" "$SCRIPT"
  pfctl -q -a "$ANCHOR" -F all 2>/dev/null || true
  dnctl pipe delete 1 2>/dev/null || true
  echo "flux-pace removed"
  exit 0
fi

echo "== existing pf rules (review: is anything else managing pf?) =="
pfctl -sr 2>/dev/null || true

mkdir -p /usr/local/sbin
cat > "$SCRIPT" <<EOF
#!/bin/sh
# Pace Capacitor -> UT Synapse PACS to avoid burst loss on the 10.103->10.93 path.
RATE="$RATE"
ANCHOR="$ANCHOR"
RULE="dummynet out proto tcp from any to 10.93.11.68 port 104 pipe 1"

/usr/sbin/dnctl list 2>/dev/null | grep -q "^00001:" || \\
  /usr/sbin/dnctl pipe 1 config bw "\$RATE" queue 100
/sbin/pfctl -a "\$ANCHOR" -s dummynet 2>/dev/null | grep -q "pipe 1" || \\
  echo "\$RULE" | /sbin/pfctl -q -a "\$ANCHOR" -f -
/sbin/pfctl -s info 2>/dev/null | grep -q "Status: Enabled" || /sbin/pfctl -q -E
EOF
chmod 755 "$SCRIPT"

cat > "$PLIST" <<'EOF'
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0"><dict>
  <key>Label</key><string>co.fluxinc.pace</string>
  <key>ProgramArguments</key><array><string>/usr/local/sbin/flux-pace.sh</string></array>
  <key>RunAtLoad</key><true/>
  <key>StartInterval</key><integer>300</integer>
  <key>StandardOutPath</key><string>/var/log/flux-pace.log</string>
  <key>StandardErrorPath</key><string>/var/log/flux-pace.log</string>
</dict></plist>
EOF
chown root:wheel "$PLIST"
chmod 644 "$PLIST"

# Re-install cleanly: drop any previous daemon and pipe so a new RATE applies.
launchctl bootout system "$PLIST" 2>/dev/null || true
dnctl pipe delete 1 2>/dev/null || true

echo "== main dummynet ruleset (needs dummynet-anchor \"com.apple/*\") =="
pfctl -s dummynet 2>&1 || true

echo "== apply (traced) =="
sh -x "$SCRIPT"

echo "== verify =="
FAIL=0
dnctl list | grep -q "^00001:" || { echo "FAIL: pipe 1 missing"; FAIL=1; }
pfctl -a "$ANCHOR" -s dummynet 2>/dev/null | grep -q "pipe 1" || { echo "FAIL: anchor rule missing"; FAIL=1; }
pfctl -s info 2>/dev/null | grep -q "Status: Enabled" || { echo "FAIL: pf not enabled"; FAIL=1; }
dnctl list
pfctl -a "$ANCHOR" -s dummynet 2>&1
pfctl -s info | head -1
if [ "$FAIL" != 0 ]; then
  echo "flux-pace NOT installed (daemon not loaded); fix the failure above and re-run"
  exit 1
fi

launchctl bootstrap system "$PLIST"
echo "flux-pace installed at $RATE (daemon log: /var/log/flux-pace.log)"