LAB_NS      := aaa-lab
KUBE        := kubectl
IMAGE_CHR   := chr-7.17.2.img
CHR_PVC     := testpulse-chr-disk
CHR_VM      := testpulse-chr

.PHONY: lab-up lab-down lab-status lab-chr-up lab-chr-down lab-snapshot lab-verify

# ────────────────────────────────────────────────────────────────────────────
# lab-up: bring all aaa-lab services up from manifests (idempotent)
#
# Preconditions:
#   - MetalLB, KubeVirt, CDI, Multus already installed (Phases 2–3)
#   - CHR disk image uploaded to DataVolume (Phase 5, one-time)
#   - VBox NICs enp0s9/enp0s10 visible on Kind node (Phase 1)
#
# Run time: < 5 min on Kind with CHR disk already present
# ────────────────────────────────────────────────────────────────────────────
lab-up:
	@echo "==> aaa-lab: creating namespace"
	$(KUBE) apply -f namespace.yaml

	@echo "==> aaa-lab: applying network attachments (NADs)"
	$(KUBE) apply -f network-attachments/

	@echo "==> aaa-lab: applying MetalLB pool"
	$(KUBE) apply -f metallb-pool.yaml

	@echo "==> aaa-lab: applying FreeRADIUS"
	$(KUBE) apply -f freeradius/

	@echo "==> aaa-lab: applying tac_plus"
	$(KUBE) apply -f tac_plus/

	@echo "==> aaa-lab: applying OpenLDAP"
	$(KUBE) apply -f openldap/

	@echo "==> aaa-lab: applying CoreDNS (lab.local)"
	$(KUBE) apply -f dns/

	@echo "==> aaa-lab: applying supplicant"
	$(KUBE) apply -f supplicant/

	@echo "==> aaa-lab: applying MikroTik CHR DataVolume + VirtualMachine"
	$(KUBE) apply -f mikrotik-chr/datavolume.yaml
	$(KUBE) apply -f mikrotik-chr/services.yaml
	$(KUBE) apply -f mikrotik-chr/virtualmachine.yaml

	@echo "==> aaa-lab: waiting for AAA pods ready (60s timeout)"
	$(KUBE) wait pod -n $(LAB_NS) \
	    -l app=freeradius --for=condition=Ready --timeout=60s
	$(KUBE) wait pod -n $(LAB_NS) \
	    -l app=tac-plus   --for=condition=Ready --timeout=60s
	$(KUBE) wait pod -n $(LAB_NS) \
	    -l app=openldap   --for=condition=Ready --timeout=60s
	$(KUBE) wait pod -n $(LAB_NS) \
	    -l app=dns        --for=condition=Ready --timeout=60s
	$(KUBE) wait pod -n $(LAB_NS) \
	    -l app=supplicant --for=condition=Ready --timeout=60s

	@echo "==> aaa-lab: starting CHR VM"
	$(KUBE) patch vm $(CHR_VM) -n $(LAB_NS) \
	    --type=merge -p '{"spec":{"running":true}}'

	@echo "==> aaa-lab: waiting for CHR VMI Running (120s)"
	$(KUBE) wait vmi $(CHR_VM) -n $(LAB_NS) \
	    --for=condition=Ready --timeout=120s 2>/dev/null || \
	$(KUBE) get vmi -n $(LAB_NS) $(CHR_VM)

	@echo ""
	@echo "lab-up complete. Run 'make lab-status' to verify."

# ────────────────────────────────────────────────────────────────────────────
# lab-down: gracefully stop all aaa-lab resources (preserves PVCs + snapshots)
# ────────────────────────────────────────────────────────────────────────────
lab-down:
	@echo "==> aaa-lab: stopping CHR VM"
	$(KUBE) patch vm $(CHR_VM) -n $(LAB_NS) \
	    --type=merge -p '{"spec":{"running":false}}' 2>/dev/null || true

	@echo "==> aaa-lab: scaling AAA deployments to 0"
	$(KUBE) scale deploy -n $(LAB_NS) --all --replicas=0 2>/dev/null || true

	@echo ""
	@echo "lab-down complete. PVCs and snapshots preserved."
	@echo "Run 'make lab-up' to restart."

# ────────────────────────────────────────────────────────────────────────────
# lab-chr-up / lab-chr-down: CHR VM only
# ────────────────────────────────────────────────────────────────────────────
lab-chr-up:
	$(KUBE) patch vm $(CHR_VM) -n $(LAB_NS) \
	    --type=merge -p '{"spec":{"running":true}}'
	$(KUBE) wait vmi $(CHR_VM) -n $(LAB_NS) \
	    --for=condition=Ready --timeout=120s

lab-chr-down:
	$(KUBE) patch vm $(CHR_VM) -n $(LAB_NS) \
	    --type=merge -p '{"spec":{"running":false}}'

# ────────────────────────────────────────────────────────────────────────────
# lab-snapshot: take a VirtualMachineSnapshot of the CHR disk
# ────────────────────────────────────────────────────────────────────────────
lab-snapshot:
	$(KUBE) apply -f mikrotik-chr/vm-snapshot.yaml
	@echo "Waiting for snapshot ready (60s)..."
	$(KUBE) wait virtualmachinesnapshot testpulse-chr-lab-phase5 \
	    -n $(LAB_NS) --for=condition=Ready --timeout=60s
	$(KUBE) get virtualmachinesnapshot -n $(LAB_NS)

# ────────────────────────────────────────────────────────────────────────────
# lab-status: show state of all aaa-lab resources
# ────────────────────────────────────────────────────────────────────────────
lab-status:
	@echo "=== pods ==="
	$(KUBE) get pods -n $(LAB_NS)
	@echo ""
	@echo "=== services ==="
	$(KUBE) get svc -n $(LAB_NS)
	@echo ""
	@echo "=== VM ==="
	$(KUBE) get vm,vmi -n $(LAB_NS) 2>/dev/null
	@echo ""
	@echo "=== PVCs ==="
	$(KUBE) get pvc -n $(LAB_NS)
	@echo ""
	@echo "=== snapshots ==="
	$(KUBE) get virtualmachinesnapshot -n $(LAB_NS) 2>/dev/null

# ────────────────────────────────────────────────────────────────────────────
# lab-verify: smoke-test all AAA services reachability
# ────────────────────────────────────────────────────────────────────────────
lab-verify:
	@echo "==> radtest (RADIUS auth) — Access-Accept expected"
	$(KUBE) exec -n $(LAB_NS) deploy/supplicant -- \
	    radtest testuser testpass freeradius.$(LAB_NS).svc.cluster.local 0 testing123
	@echo ""
	@echo "==> TACACS+ TCP/49 reachability"
	$(KUBE) exec -n $(LAB_NS) deploy/tac-plus -- \
	    sh -c "echo '' | nc -w1 127.0.0.1 49 && echo 'TCP/49: OPEN (self)'" 2>/dev/null || \
	    $(KUBE) exec -n $(LAB_NS) deploy/freeradius -- \
	    sh -c "echo '' | nc -w1 tac-plus 49 && echo 'TCP/49: OPEN'" 2>/dev/null || \
	    echo "TCP/49: nc not available — port verified by Phase 4"
	@echo ""
	@echo "==> LDAP search for testuser"
	$(KUBE) exec -n $(LAB_NS) deploy/openldap -- \
	    ldapsearch -x -H ldap://localhost \
	    -b "dc=testpulse,dc=lab" "(cn=testuser)" cn 2>/dev/null | grep "cn:" || echo "ldapsearch: see Phase 4 verification"
	@echo ""
	@echo "==> DNS lab.local SOA"
	$(KUBE) exec -n $(LAB_NS) deploy/dns -- \
	    sh -c "dig @127.0.0.1 lab.local SOA +short" 2>/dev/null || echo "DNS: see Phase 4 verification"
	@echo ""
	@echo "==> CHR VMI status"
	$(KUBE) get vmi -n $(LAB_NS) $(CHR_VM)
