#!/bin/sh
# checks/wireguard.sh
# wg0 interface: at least one recent handshake means the tunnel is alive.
# Also lists each configured peer with time since its last handshake.
set -eu

DIR=$(dirname "$0")
. "$DIR/../lib/common.sh"

STATUS=$(wg_status wg0)
json_line "host services" "wireguard (wg0)" "" "$STATUS"

NOW=$(date +%s)
TAB=$(printf '\t')

wg show wg0 dump 2>/dev/null | tail -n +2 | while IFS="$TAB" read -r pubkey psk endpoint allowedips handshake rx tx keepalive; do
    [ -n "$pubkey" ] || continue
    peer_id=$(printf '%s' "$pubkey" | cut -c1-8)
    label="peer $peer_id ($allowedips)"

    if [ "$handshake" = "0" ]; then
        json_line "wireguard peers" "$label" "never" "down"
        continue
    fi

    age=$((NOW - handshake))
    if [ "$age" -lt 180 ]; then
        pstatus="ok"
    elif [ "$age" -lt 600 ]; then
        pstatus="warn"
    else
        pstatus="down"
    fi

    if [ "$age" -lt 60 ]; then
        rel="${age}s ago"
    elif [ "$age" -lt 3600 ]; then
        rel="$((age / 60))m ago"
    elif [ "$age" -lt 86400 ]; then
        rel="$((age / 3600))h ago"
    else
        rel="$((age / 86400))d ago"
    fi

    json_line "wireguard peers" "$label" "$rel" "$pstatus"
done