#!/usr/bin/env bash
# netvm-topology.sh — live topology + per-node diagnostics.
# Run as root (operator: sudo -n via the allowlist).
set -u
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
. "$SCRIPT_DIR/netvm-names.sh"
for ns in $(ip netns list 2>/dev/null | awk '{print $1}' | grep '^warp-'); do
  netvm_names "${ns#warp-}"
  hs=$(ip netns exec "$ns" wg show "$WG" latest-handshakes 2>/dev/null | awk '{print $2}')
  [ -z "$hs" ] && hs="none"
  egress=$(ip netns exec "$ns" curl -sk --max-time 10 'https://1.1.1.1/cdn-cgi/trace' 2>/dev/null | grep -oP '^ip=\K.*' || true)
  printf 'node=%s netns=%s ifaces=%s/%s handshake=%s egress=%s\n' "$NODE" "$ns" "$WG" "$VETH" "$hs" "${egress:-?}"
done
iptables -t nat -L POSTROUTING -n 2>/dev/null | grep '10.201\.' || echo "(no netvm NAT rules on host)"
echo "--- CDP bridges (per netns PREROUTING) ---"
for ns in $(ip netns list 2>/dev/null | awk '{print $1}' | grep '^warp-'); do
  echo "$ns PREROUTING:"
  ip netns exec "$ns" iptables -t nat -L PREROUTING -n -v --line-numbers 2>/dev/null | grep -E "REDIRECT|Chain" || echo "  (empty)"
  echo "$ns route_localnet: $(ip netns exec "$ns" sysctl -n net.ipv4.conf.all.route_localnet 2>/dev/null || echo ?)"
done