#!/bin/bash
# clockctl.sh — B6 #7/#8/#10: move the rehearsal VM's clock from OUTSIDE (rehearsal 2026-10-20).
# The VM's own clock only; demo-hp's clock is never touched. Runs from DooPlex, acts on demo-hp.
#   clockctl.sh ntp-off            drop NTP (UDP 123) and NTS-KE (TCP 4460) leaving the VM's tap (positive control: counters)
#   clockctl.sh ntp-on             remove that table
#   clockctl.sh counters           show the drop counters
#   clockctl.sh boot <UTC-ISO>     clean shutdown, set the VM's RTC start date (UTC), start
#   clockctl.sh boot-real          clean shutdown, remove the start date, start
#   clockctl.sh stop               clean shutdown only (box „off")
#   clockctl.sh boxtime            the box's own clock, read from its HTTP Date header (a different channel than the RTC setting)
set -euo pipefail
VM=${VM:-9320}; TAP=tap${VM}i0; TBL=rh1020ntp; IP=${BOX_IP:-192.168.0.133}; HOSTH=${BOX_HOST:-felhom.tester4.test}
down() {
  ssh demo-hp "LC_ALL=C qm shutdown $VM --timeout 300 || LC_ALL=C qm stop $VM"
  echo "down $(date -u +%T)"
}
case "$1" in
  ntp-off)
    ssh demo-hp "nft add table bridge $TBL && nft add chain bridge $TBL c1 '{ type filter hook forward priority 0; }' && \
      nft add rule bridge $TBL c1 iifname $TAP udp dport 123 counter drop && \
      nft add rule bridge $TBL c1 iifname $TAP tcp dport 4460 counter drop && nft list table bridge $TBL"; echo "ntp off $(date -u +%T)";;
  ntp-on) ssh demo-hp "nft delete table bridge $TBL"; echo "ntp on $(date -u +%T)";;
  counters) ssh demo-hp "nft list table bridge $TBL | grep counter";;
  boot) down; ssh demo-hp "LC_ALL=C qm set $VM --startdate $2 && LC_ALL=C qm start $VM"; echo "started with RTC $2 at real $(date -u +%T)";;
  boot-real) down; ssh demo-hp "LC_ALL=C qm set $VM --delete startdate && LC_ALL=C qm start $VM"; echo "started with real RTC at $(date -u +%T)";;
  stop) down;;
  boxtime) echo "real $(date -u +%FT%TZ) box $(curl -sk -m 10 -D - -o /dev/null -H "Host: $HOSTH" https://$IP/api/health | tr -d '\r' | sed -n 's/^[Dd]ate: //p')";;
  *) echo "usage: $0 ntp-off|ntp-on|counters|boot <UTC-ISO>|boot-real|stop|boxtime" >&2; exit 1;;
esac