#!/usr/bin/env bash
# netvm-topology.sh — live topology + per-node diagnostics.
# Run as root (operator: sudo -n via the allowlist).
set -u
for ns in $(ip netns list 2>/dev/null | awk '{print $1}' | grep '^warp-'); do
  node="${ns#warp-}"
  hs=$(ip netns exec "$ns" wg show "wg-${node}" latest-handshakes 2>/dev/null | awk '{print $2}')
  [ -z "$hs" ] && hs="none"
  routes=$(ip netns exec "$ns" ip route 2>/dev/null | tr '\n' '|' )
  egress=$(ip netns exec "$ns" curl -sk --max-time 10 'https://1.1.1.1/cdn-cgi/trace' 2>/dev/null | grep -oP '^ip=\K.*' || true)
  printf 'node=%s netns=%s handshake=%s egress=%s\n  routes: %s\n' "$node" "$ns" "$hs" "${egress:-?}" "${routes:-none}"
done
# host-side NAT rules for our subnets
iptables -t nat -L POSTROUTING -n 2>/dev/null | grep '10.201\.' || echo "no netvm NAT rules on host"