#!/usr/bin/env bash
# netvm-topology.sh — live topology + per-node diagnostics.
# Run as root (operator: sudo -n via the allowlist).
set -u
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
. "$SCRIPT_DIR/netvm-names.sh"
for ns in $(ip netns list 2>/dev/null | awk '{print $1}' | grep '^warp-'); do
  netvm_names "${ns#warp-}"
  hs=$(ip netns exec "$ns" wg show "$WG" latest-handshakes 2>/dev/null | awk '{print $2}')
  [ -z "$hs" ] && hs="none"
  egress=$(ip netns exec "$ns" curl -sk --max-time 10 'https://1.1.1.1/cdn-cgi/trace' 2>/dev/null | grep -oP '^ip=\K.*' || true)
  printf 'node=%s netns=%s ifaces=%s/%s handshake=%s egress=%s\n' "$NODE" "$ns" "$WG" "$VETH" "$hs" "${egress:-?}"
done
iptables -t nat -L POSTROUTING -n 2>/dev/null | grep '10.201\.' || echo "(no netvm NAT rules on host)"
echo "--- CDP bridges (per netns PREROUTING) ---"
for ns in $(ip netns list 2>/dev/null | awk '{print $1}' | grep '^warp-'); do
  redir=$(ip netns exec "$ns" iptables -t nat -L PREROUTING -n 2>/dev/null | grep -c REDIRECT || true)
  echo "$ns: $redir REDIRECT rule(s)"
done