# Static, Sol-style destination policy for selected traffic via the EU peer.
# This is policy routing, not application learning: prefixes are declared here,
# and OpenRouter addresses are refreshed from DNS on a timer.
{ config, pkgs, ... }:
let
  ip = "${pkgs.iproute2}/bin/ip";
  getent = "${pkgs.getent}/bin/getent";
  routeScript = pkgs.writeShellScript "mesh-egress-routes" ''
    set -eu
    ${ip} link show wg-mesh >/dev/null

    # Rebuild the destination table, while leaving the normal main table alone.
    ${ip} route flush table 1101 2>/dev/null || true
    ${ip} rule del pref 1101 2>/dev/null || true
    ${ip} rule add pref 1101 lookup 1101

    add_route() {
      prefix="$1"
      ${ip} route replace "$prefix" dev wg-mesh table 1101
    }

    # Telegram DC ranges (static destination policy, as in Sol's prefix lists).
    for prefix in \
      91.105.192.0/23 \
      91.108.0.0/22 \
      91.108.4.0/22 \
      91.108.8.0/22 \
      91.108.12.0/22 \
      91.108.16.0/22 \
      91.108.20.0/22 \
      91.108.56.0/22 \
      95.161.64.0/20 \
      149.154.160.0/20; do
      add_route "$prefix"
    done

    # OpenRouter is behind a CDN; refresh its current IPv4 addresses. We do
    # not route all Cloudflare, only the names used by the API/web endpoint.
    for name in openrouter.ai www.openrouter.ai api.openrouter.ai; do
      ${getent} ahostsv4 "$name" 2>/dev/null | ${pkgs.gawk}/bin/awk '{print $1}' | sort -u | while read -r addr; do
        [ -n "$addr" ] || continue
        add_route "$addr/32"
      done
    done
  '';
in {
  # Clients whose selected destinations match table 1101 are forwarded to
  # hyacinth. Other traffic keeps Heather's normal route.
  networking.nat = {
    enable = true;
    internalInterfaces = [ "wg-clients1" ];
    externalInterface = "enp7s0";
  };

  systemd.services.mesh-egress-routes = {
    description = "Install Sol-style selected destination routes via hyacinth";
    wantedBy = [ "network-online.target" ];
    after = [ "network-online.target" "wireguard-wg-mesh.service" ];
    wants = [ "wireguard-wg-mesh.service" ];
    serviceConfig = {
      Type = "oneshot";
      RemainAfterExit = true;
      ExecStart = routeScript;
    };
  };

  systemd.timers.mesh-egress-routes = {
    description = "Refresh selected mesh egress destinations";
    wantedBy = [ "timers.target" ];
    timerConfig = {
      OnBootSec = "30s";
      OnUnitActiveSec = "5min";
      Unit = "mesh-egress-routes.service";
    };
  };
}