#!/usr/bin/env bash
# Local read-only report. Does not reapply rules or contact external services.
set -uo pipefail
SCRIPT_DIR=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
port=${1:-19086}
[[ $port =~ ^[0-9]+$ ]] && (( port >= 1 && port <= 65535 )) || { echo "usage: network-diagnose [TCP_PORT]" >&2; exit 2; }
echo "CFPP diagnostic $(date -Is) port=$port"
uname -srmo
ip -o -4 address show scope global
systemctl is-active cf-pp-gateway.service cf-pp-gateway-network.service
ss -H -lnt "sport = :$port"
ip -4 rule show
if [[ -r ${CFPP_NETWORK_ENV_FILE:-/etc/cf-pp-gateway/network.env} ]]; then
  ( source "$SCRIPT_DIR/network-common"; ip -4 route show table "$CFPP_ROUTE_TABLE"; echo 'Detected Docker bridge routes:'; docker_bridge_routes )
else
  echo 'MISSING: gateway network.env'
fi
if command -v docker >/dev/null 2>&1 && [[ -r ${CFPP_NETWORK_ENV_FILE:-/etc/cf-pp-gateway/network.env} ]]; then
  ( source "$SCRIPT_DIR/network-common"; docker_local ps --format '{{.Names}} {{.Ports}}' )
fi
if "$SCRIPT_DIR/network-check"; then
  echo 'NETWORK_CHECK=PASS (does not prove backend login or real-IP delivery)'
else
  echo 'NETWORK_CHECK=FAIL'; exit 1
fi
