#!/usr/bin/env bash
#==============================================================================
#  Zoraxy DHCP Server — All-in-One Installer
#  Installs dnsmasq + NAT/routing + dhcp-lease-manager Zoraxy plugin
#
#  Usage:  curl -sSL https://git.lohmar.co.uk/cclohmar/zoraxy-dhcp/raw/branch/main/install.sh | sudo bash
#          or:  sudo bash install.sh
#          or:  sudo bash install.sh --remove    (clean uninstall)
#==============================================================================
set -euo pipefail

# --- Colors ----------------------------------------------------------------
RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'
BLUE='\033[0;34m'; CYAN='\033[0;36m'; BOLD='\033[1m'; NC='\033[0m'

# --- Globals ---------------------------------------------------------------
PLUGIN_REPO="https://git.lohmar.co.uk/cclohmar/zoraxy-dhcp.git"
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
CONFIG_SAVE="/root/.dnsmasq-setup.conf"

# User-provided values (populated by prompts or saved config)
IFACE=""; RANGE_START=""; RANGE_END=""; NETMASK=""
LEASE_TIME=""; GATEWAY_IP=""; DNS_SERVERS=""
SUBNET_MASK="255.255.255.0"  # auto-detected from interface

# Detected values
ZORAXY_MODE=""          # baremetal | docker | fresh
ZORAXY_CONF_DIR=""      # /opt/zoraxy/conf or docker mount source
ZORAXY_PLUGIN_DIR=""    # /opt/zoraxy/plugins or docker mount source

#==============================================================================
#  UTILITY FUNCTIONS
#==============================================================================

log()  { echo -e "${GREEN}[+]${NC} $*"; }
warn() { echo -e "${YELLOW}[!]${NC} $*"; }
err()  { echo -e "${RED}[✗]${NC} $*"; }
info() { echo -e "${CYAN}[i]${NC} $*"; }

banner() {
    echo -e "${GREEN}========================================${NC}"
    echo -e "${GREEN}   Zoraxy DHCP Server — Auto Installer  ${NC}"
    echo -e "${GREEN}========================================${NC}"
    echo ""
}

ensure_root() {
    if [[ $EUID -ne 0 ]]; then
        warn "This script requires root privileges. Restarting with sudo..."
        sudo bash "$0" "$@"
        exit $?
    fi
}

#==============================================================================
#  OS DETECTION
#==============================================================================

detect_os() {
    if [ -f /etc/os-release ]; then
        . /etc/os-release
        OS_ID="$ID"
        OS_VERSION="${VERSION_ID:-unknown}"
    elif [ -f /etc/alpine-release ]; then
        OS_ID="alpine"
        OS_VERSION="$(cat /etc/alpine-release)"
    else
        err "Cannot detect OS. Unsupported system."
        exit 1
    fi
    log "Detected: ${BOLD}$OS_ID${NC} $OS_VERSION"
}

#==============================================================================
#  DEPENDENCY INSTALLATION
#==============================================================================

install_deps() {
    log "Installing dependencies..."

    case "$OS_ID" in
        debian|ubuntu|raspbian|linuxmint)
            apt-get update -qq
            apt-get install -y -qq dnsmasq iptables jq git curl wget golang-go
            ;;
        rhel|centos|fedora|rocky|almalinux|amzn)
            if command -v dnf &>/dev/null; then
                dnf install -y dnsmasq iptables jq git curl wget golang
            else
                yum install -y epel-release
                yum install -y dnsmasq iptables jq git curl wget golang
            fi
            ;;
        alpine)
            apk add --no-cache dnsmasq iptables jq git curl wget go
            ;;
        opensuse*|sles)
            zypper install -y dnsmasq iptables jq git curl wget go
            ;;
        arch|manjaro)
            pacman -S --noconfirm dnsmasq iptables jq git curl wget go
            ;;
        *)
            err "Unsupported OS: $OS_ID"
            warn "Attempting to continue — you may need to install deps manually."
            ;;
    esac

    # Ensure Go is on PATH if installed to a non-standard location
    export PATH="$PATH:/usr/local/go/bin:$(go env GOPATH 2>/dev/null)/bin"
    if ! command -v go &>/dev/null; then
        err "Go not found after install. Please install Go manually."
        exit 1
    fi
    log "Dependencies installed   Go: $(go version | awk '{print $3}')"
}

#==============================================================================
#  INTERACTIVE CONFIGURATION
#==============================================================================

# list_interfaces prints available physical/virtual interfaces with IPs.
list_interfaces() {
    echo ""
    echo "  Available network interfaces:"
    ip -o addr show 2>/dev/null | awk '/inet / && $2 != "lo" {
        split($2, iface, "@"); name=iface[1]; ip=$4;
        state=$(NF); gsub(/state /, "", state);
        printf "    %-12s  %-18s  %s\n", name, ip, state
    }' || true
}

# detect_defaults uses routing info to guess the primary interface.
detect_defaults() {
    IFACE_DEFAULT=$(ip route get 1.1.1.1 2>/dev/null | awk '{print $5; exit}' | sed 's/@.*//' || true)
    [ -z "$IFACE_DEFAULT" ] && IFACE_DEFAULT="eth0"

    GATEWAY_DEFAULT=$(ip route get 1.1.1.1 2>/dev/null | awk '{print $3; exit}' || true)

    DNS_DEFAULT=$( (grep '^nameserver' /etc/resolv.conf 2>/dev/null || true) | awk '{print $2}' | tr '\n' ',' | sed 's/,$//')
    [ -z "$DNS_DEFAULT" ] && DNS_DEFAULT="1.1.1.1,8.8.8.8"

    # Try to derive subnet from the selected interface's IP
    local iface_ip iface_cidr
    iface_ip=$(ip -o addr show "$IFACE_DEFAULT" 2>/dev/null | awk '/inet / {print $4; exit}' || true)
    iface_cidr="${iface_ip#*/}"
    case "$iface_cidr" in
        24) SUBNET_MASK="255.255.255.0" ;;
        16) SUBNET_MASK="255.255.0.0"   ;;
        8)  SUBNET_MASK="255.0.0.0"     ;;
        *)  SUBNET_MASK="255.255.255.0" ;;
    esac
}

# validate_interface checks the chosen interface exists and is UP.
validate_interface() {
    local iface="$1"
    if ! ip link show "$iface" >/dev/null 2>&1; then
        err "Interface '$iface' does not exist."
        return 1
    fi
    if ! ip link show "$iface" 2>/dev/null | grep -q "state UP"; then
        warn "Interface '$iface' is DOWN. DHCP won't work until it's brought up."
    fi
    return 0
}

prompt_config() {
    echo ""
    echo -e "${BOLD}─────────────────────────────────────────${NC}"
    echo -e "${BOLD}  Network Interface${NC}"
    echo -e "${BOLD}─────────────────────────────────────────${NC}"

    set +eo pipefail
    detect_defaults
    set -eo pipefail

    # Show interfaces + let user choose
    list_interfaces

    while true; do
        echo ""
        read -rp "  DHCP interface [$IFACE_DEFAULT]: " IFACE || true
        IFACE="${IFACE:-$IFACE_DEFAULT}"
        if validate_interface "$IFACE"; then break; fi
    done

    # Detect gateway from the chosen interface if not already set
    if [ -z "$GATEWAY_DEFAULT" ]; then
        GATEWAY_DEFAULT="10.2.0.10"
    fi

    # DHCP range
    echo ""
    echo -e "${BOLD}─────────────────────────────────────────${NC}"
    echo -e "${BOLD}  DHCP Range${NC}"
    echo -e "${BOLD}─────────────────────────────────────────${NC}"

    read -rp "  Start IP   [10.2.0.100]: " RANGE_START || true
    RANGE_START="${RANGE_START:-10.2.0.100}"
    read -rp "  End IP     [10.2.0.150]: " RANGE_END || true
    RANGE_END="${RANGE_END:-10.2.0.150}"
    read -rp "  Subnet mask [$SUBNET_MASK]: " NETMASK || true
    NETMASK="${NETMASK:-$SUBNET_MASK}"
    read -rp "  Lease time  [12h]: " LEASE_TIME || true
    LEASE_TIME="${LEASE_TIME:-12h}"

    # Gateway & DNS
    echo ""
    echo -e "${BOLD}─────────────────────────────────────────${NC}"
    echo -e "${BOLD}  Gateway & DNS${NC}"
    echo -e "${BOLD}─────────────────────────────────────────${NC}"
    read -rp "  Gateway IP  [$GATEWAY_DEFAULT]: " GATEWAY_IP || true
    GATEWAY_IP="${GATEWAY_IP:-$GATEWAY_DEFAULT}"
    read -rp "  DNS servers (comma-separated) [$DNS_DEFAULT]: " DNS_SERVERS || true
    DNS_SERVERS="${DNS_SERVERS:-$DNS_DEFAULT}"

    # Save for reference
    cat > "$CONFIG_SAVE" << EOF
# DHCP Setup Configuration — saved $(date)
IFACE="$IFACE"
RANGE_START="$RANGE_START"
RANGE_END="$RANGE_END"
NETMASK="$NETMASK"
LEASE_TIME="$LEASE_TIME"
GATEWAY_IP="$GATEWAY_IP"
DNS_SERVERS="$DNS_SERVERS"
EOF
    log "Configuration saved to $CONFIG_SAVE"
}

show_config_summary() {
    echo ""
    echo -e "${BOLD}─────────────────────────────────────────${NC}"
    echo -e "${BOLD}  Configuration Summary${NC}"
    echo -e "${BOLD}─────────────────────────────────────────${NC}"
    echo "  Interface:     $IFACE"
    echo "  DHCP Range:    $RANGE_START - $RANGE_END / $NETMASK"
    echo "  Lease time:    $LEASE_TIME"
    echo "  Gateway:       $GATEWAY_IP"
    echo "  DNS:           $DNS_SERVERS"
    echo "  Zoraxy mode:   ${ZORAXY_MODE:-detecting...}"
    echo "  Config dir:    ${ZORAXY_CONF_DIR:-detecting...}"
    echo -e "${BOLD}─────────────────────────────────────────${NC}"
    echo ""
}

#==============================================================================
#  DNSMASQ + NAT SETUP
#==============================================================================

setup_dnsmasq() {
    local dhcp_conf_dir="$ZORAXY_CONF_DIR/dhcp"
    local dhcp_conf_file="$dhcp_conf_dir/dnsmasq.conf"
    local dhcp_leases_file="$dhcp_conf_dir/dnsmasq.leases"

    log "Setting up dnsmasq..."

    # Create dhcp config directory inside Zoraxy's conf
    mkdir -p "$dhcp_conf_dir"

    # Write the DHCP configuration
    cat > "$dhcp_conf_file" << EOF
# Zoraxy DHCP Server Configuration
# Managed by: install.sh — regenerated on re-run

# Bind to the DHCP interface
interface=$IFACE

# DHCP range
dhcp-range=$RANGE_START,$RANGE_END,$NETMASK,$LEASE_TIME

# Gateway
dhcp-option=3,$GATEWAY_IP

# DNS servers
EOF

    # Add each DNS server as a separate dhcp-option line
    IFS=',' read -ra DNS_ARRAY <<< "$DNS_SERVERS"
    for dns in "${DNS_ARRAY[@]}"; do
        echo "dhcp-option=6,$dns" >> "$dhcp_conf_file"
    done

    # Lease file location
    echo "" >> "$dhcp_conf_file"
    echo "dhcp-leasefile=$dhcp_leases_file" >> "$dhcp_conf_file"

    # Create empty lease file if not present
    touch "$dhcp_leases_file"

    # Make main dnsmasq.conf include our config
    if [ -f /etc/dnsmasq.conf ]; then
        # Backup original
        if [ ! -f /etc/dnsmasq.conf.bak ]; then
            cp /etc/dnsmasq.conf /etc/dnsmasq.conf.bak
            log "Backed up original dnsmasq.conf → /etc/dnsmasq.conf.bak"
        fi
    fi

    # Write a clean main config that includes our DHCP config
    cat > /etc/dnsmasq.conf << EOF
# Main dnsmasq configuration
# DHCP config managed by Zoraxy dhcp-lease-manager plugin
conf-file=$dhcp_conf_file
EOF

    log "dnsmasq configured   conf: $dhcp_conf_file"
}

setup_nat_routing() {
    log "Setting up NAT / IP forwarding..."

    # Enable IP forwarding
    if ! grep -q '^net.ipv4.ip_forward=1' /etc/sysctl.conf 2>/dev/null; then
        echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf
    fi
    sysctl -w net.ipv4.ip_forward=1 >/dev/null 2>&1

    # Routing script
    cat > /usr/local/sbin/zoraxy-dhcp-routing << 'ROUTING_EOF'
#!/bin/bash
# Gateway NAT — managed by Zoraxy DHCP installer
iptables -t nat -C POSTROUTING -o eth0 -j MASQUERADE 2>/dev/null || \
    iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
ROUTING_EOF
    chmod +x /usr/local/sbin/zoraxy-dhcp-routing

    # systemd oneshot service
    cat > /etc/systemd/system/zoraxy-dhcp-routing.service << EOF
[Unit]
Description=Zoraxy DHCP NAT Routing
After=network-pre.target
Before=network.target

[Service]
Type=oneshot
ExecStart=/usr/local/sbin/zoraxy-dhcp-routing
RemainAfterExit=yes

[Install]
WantedBy=multi-user.target
EOF

    systemctl daemon-reload
    systemctl enable zoraxy-dhcp-routing 2>/dev/null || true
    systemctl start zoraxy-dhcp-routing 2>/dev/null || true
    log "NAT routing service installed"

    # Start/enable dnsmasq
    systemctl enable dnsmasq 2>/dev/null || true
    systemctl restart dnsmasq 2>/dev/null || service dnsmasq restart 2>/dev/null || true
    log "dnsmasq restarted"
}

#==============================================================================
#  ZORAXY DETECTION
#==============================================================================

detect_zoraxy() {
    echo ""
    log "Detecting Zoraxy installation..."

    # --- Check Docker ---
    if command -v docker &>/dev/null && docker info &>/dev/null 2>&1; then
        local zoraxy_container
        zoraxy_container=$(docker ps --format '{{.Names}} {{.Image}}' 2>/dev/null | grep -i zoraxy | head -1 | awk '{print $1}' || true)
        if [ -n "$zoraxy_container" ]; then
            ZORAXY_MODE="docker"
            info "Found Zoraxy in Docker container: ${BOLD}$zoraxy_container${NC}"

            # Find the config mount
            ZORAXY_CONF_DIR=$(docker inspect "$zoraxy_container" --format '{{range .Mounts}}{{if eq .Destination "/opt/zoraxy/conf"}}{{.Source}}{{end}}{{end}}' 2>/dev/null)

            # Try plugin dir as well (may be a subpath of conf or separate mount)
            local plugin_mount
            plugin_mount=$(docker inspect "$zoraxy_container" --format '{{range .Mounts}}{{if eq .Destination "/opt/zoraxy/plugins"}}{{.Source}}{{end}}{{end}}' 2>/dev/null)

            if [ -n "$plugin_mount" ]; then
                ZORAXY_PLUGIN_DIR="$plugin_mount"
            elif [ -n "$ZORAXY_CONF_DIR" ]; then
                ZORAXY_PLUGIN_DIR="$ZORAXY_CONF_DIR/../plugins"
                mkdir -p "$ZORAXY_PLUGIN_DIR"
            fi

            if [ -z "$ZORAXY_CONF_DIR" ]; then
                warn "Could not detect Zoraxy config mount in container."
                warn "You may need to manually configure the plugin path."
                read -rp "  Enter Zoraxy conf directory on host: " ZORAXY_CONF_DIR || true
            fi

            return 0
        fi
    fi

    # --- Check Bare Metal ---
    if systemctl is-active --quiet zoraxy 2>/dev/null; then
        ZORAXY_MODE="baremetal"
        info "Found active Zoraxy service (systemd)"
    elif [ -f /opt/zoraxy/zoraxy ] && [ -x /opt/zoraxy/zoraxy ]; then
        ZORAXY_MODE="baremetal"
        info "Found Zoraxy binary at /opt/zoraxy/zoraxy"
    elif pgrep -f zoraxy >/dev/null 2>&1; then
        ZORAXY_MODE="baremetal"
        info "Found running Zoraxy process"
    fi

    if [ "$ZORAXY_MODE" = "baremetal" ]; then
        ZORAXY_CONF_DIR="/opt/zoraxy/conf"
        ZORAXY_PLUGIN_DIR="/opt/zoraxy/plugins"
        return 0
    fi

    # --- Not Found — ask user ---
    echo ""
    warn "No existing Zoraxy installation detected."
    echo ""
    echo "  Options:"
    echo "    [1] Fresh install — I'll install Zoraxy for you"
    echo "    [2] Provide path — Zoraxy is installed at a custom location"
    echo "    [3] Skip — I'll handle Zoraxy/plugin setup myself"
    echo ""

    local choice
    while true; do
        read -rp "  Choose [1]: " choice || true
        choice="${choice:-1}"
        case "$choice" in
            1)
                ZORAXY_MODE="fresh"
                install_zoraxy_fresh
                ZORAXY_CONF_DIR="/opt/zoraxy/conf"
                ZORAXY_PLUGIN_DIR="/opt/zoraxy/plugins"
                break
                ;;
            2)
                ZORAXY_MODE="custom"
                read -rp "  Zoraxy conf directory: " ZORAXY_CONF_DIR || true
                read -rp "  Zoraxy plugins directory: " ZORAXY_PLUGIN_DIR || true
                break
                ;;
            3)
                ZORAXY_MODE="skip"
                warn "Plugin installation skipped."
                warn "Run this script again after Zoraxy is set up."
                exit 0
                ;;
            *) warn "Invalid choice. Enter 1, 2, or 3." ;;
        esac
    done
}

#==============================================================================
#  FRESH ZORAXY INSTALL
#==============================================================================

install_zoraxy_fresh() {
    log "Installing Zoraxy (fresh install)..."

    local arch; arch=$(uname -m)
    local binary
    case "$arch" in
        x86_64)  binary="zoraxy_linux_amd64" ;;
        aarch64) binary="zoraxy_linux_arm64" ;;
        armv7l)  binary="zoraxy_linux_arm" ;;
        *) err "Unsupported architecture: $arch"; exit 1 ;;
    esac

    info "Architecture: $arch → $binary"

    # Download latest release
    local latest_url
    latest_url=$(curl -s https://api.github.com/repos/tobychui/zoraxy/releases/latest \
        | jq -r ".assets[] | select(.name | contains(\"$binary\")) | .browser_download_url" 2>/dev/null || true)

    if [ -z "$latest_url" ] || [ "$latest_url" = "null" ]; then
        err "Failed to fetch Zoraxy download URL. Check your internet connection."
        exit 1
    fi

    # Create directories
    mkdir -p /opt/zoraxy/conf /opt/zoraxy/plugins /opt/zoraxy/logs

    # Download and install
    log "Downloading Zoraxy..."
    curl -sSL -o /tmp/zoraxy "$latest_url"
    mv /tmp/zoraxy /opt/zoraxy/zoraxy
    chmod +x /opt/zoraxy/zoraxy

    # Create system user
    if ! id zoraxy &>/dev/null; then
        useradd --system --no-create-home --shell /usr/sbin/nologin zoraxy
    fi
    chown -R zoraxy:zoraxy /opt/zoraxy

    # systemd service
    cat > /etc/systemd/system/zoraxy.service << 'ZORAXY_SVC'
[Unit]
Description=Zoraxy Reverse Proxy
After=network.target

[Service]
Type=simple
User=zoraxy
Group=zoraxy
WorkingDirectory=/opt/zoraxy
ExecStart=/opt/zoraxy/zoraxy -plugin=/opt/zoraxy/plugins
Restart=on-failure
RestartSec=5

# Security hardening
ProtectSystem=full
PrivateTmp=true

# Capabilities: bind low ports + talk to systemd for plugin reloads
CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_SYS_ADMIN
AmbientCapabilities=CAP_NET_BIND_SERVICE CAP_SYS_ADMIN

[Install]
WantedBy=multi-user.target
ZORAXY_SVC

    systemctl daemon-reload
    systemctl enable zoraxy
    systemctl start zoraxy

    sleep 2
    if systemctl is-active --quiet zoraxy; then
        log "Zoraxy installed and running."
    else
        err "Zoraxy service failed to start. Check: journalctl -u zoraxy -e"
    fi
}

#==============================================================================
#  PLUGIN INSTALLATION
#==============================================================================

install_plugin() {
    log "Installing dhcp-lease-manager plugin..."

    local plugin_dir="$ZORAXY_PLUGIN_DIR/dhcp-lease-manager"

    # Clone / pull the plugin repo
    if [ -d "$plugin_dir/.git" ]; then
        info "Plugin repo exists, pulling latest..."
        git -C "$plugin_dir" pull origin main 2>/dev/null || true
    else
        mkdir -p "$(dirname "$plugin_dir")"
        git clone "$PLUGIN_REPO" "$plugin_dir" 2>/dev/null || {
            err "Failed to clone plugin repo: $PLUGIN_REPO"
            exit 1
        }
    fi

    # Build the plugin
    info "Building plugin binary..."
    (cd "$plugin_dir" && go build -buildvcs=false -o dhcp-lease-manager .) || {
        err "Plugin build failed. Check Go installation."
        exit 1
    }

    # Ensure plugin has correct ownership
    if id zoraxy &>/dev/null; then
        chown -R zoraxy:zoraxy "$plugin_dir"
    fi

    # --- Permissions: group-based access ---
    log "Setting up permissions..."

    local group="dnsmasq-edit"
    local conf_file="$ZORAXY_CONF_DIR/dhcp/dnsmasq.conf"
    local leases_file="$ZORAXY_CONF_DIR/dhcp/dnsmasq.leases"

    # Create group
    getent group "$group" >/dev/null || groupadd "$group"

    # Add zoraxy user to group (if it exists)
    if id zoraxy &>/dev/null && ! groups zoraxy 2>/dev/null | grep -qw "$group"; then
        usermod -a -G "$group" zoraxy
    fi

    # Set group ownership on dhcp files
    chgrp -R "$group" "$ZORAXY_CONF_DIR/dhcp" 2>/dev/null || true
    chmod -R g+rw "$ZORAXY_CONF_DIR/dhcp" 2>/dev/null || true

    # Set group on plugin binary dir
    chgrp -R "$group" "$plugin_dir" 2>/dev/null || true

    # Note: reload uses Linux capabilities (CAP_SYS_ADMIN), not sudo.
    # The Zoraxy systemd service must include:
    #   CapabilityBoundingSet=CAP_SYS_ADMIN
    #   AmbientCapabilities=CAP_SYS_ADMIN
    # (already configured by this installer).

    log "Plugin installed at: $plugin_dir"
}

#==============================================================================
#  VERIFICATION
#==============================================================================

verify() {
    echo ""
    echo -e "${BOLD}─────────────────────────────────────────${NC}"
    echo -e "${BOLD}  Verification${NC}"
    echo -e "${BOLD}─────────────────────────────────────────${NC}"

    # dnsmasq
    if systemctl is-active --quiet dnsmasq 2>/dev/null; then
        log "dnsmasq:   ${GREEN}running${NC}"
    elif service dnsmasq status &>/dev/null; then
        log "dnsmasq:   ${GREEN}running${NC}"
    else
        warn "dnsmasq:   ${RED}not running${NC} — check: systemctl status dnsmasq"
    fi

    # Plugin binary
    if [ -x "$ZORAXY_PLUGIN_DIR/dhcp-lease-manager/dhcp-lease-manager" ]; then
        log "plugin:    ${GREEN}built${NC}"
    else
        warn "plugin:    ${RED}missing${NC}"
    fi

    # IP forwarding
    if [ "$(cat /proc/sys/net/ipv4/ip_forward)" = "1" ]; then
        log "forward:   ${GREEN}enabled${NC}"
    else
        warn "forward:   ${RED}disabled${NC}"
    fi
}

#==============================================================================
#  REMOVE / UNINSTALL
#==============================================================================

remove_all() {
    echo -e "${YELLOW}========================================${NC}"
    echo -e "${YELLOW}   Removing Zoraxy DHCP Setup${NC}"
    echo -e "${YELLOW}========================================${NC}"
    echo ""

    # Stop services
    log "Stopping services..."
    systemctl stop dnsmasq 2>/dev/null || service dnsmasq stop 2>/dev/null || true
    systemctl disable dnsmasq 2>/dev/null || true
    systemctl stop zoraxy-dhcp-routing 2>/dev/null || true
    systemctl disable zoraxy-dhcp-routing 2>/dev/null || true
    systemctl stop gateway-routing 2>/dev/null || true
    systemctl disable gateway-routing 2>/dev/null || true

    # Remove packages (OS-aware)
    log "Removing dnsmasq package..."
    case "$OS_ID" in
        debian|ubuntu|raspbian|linuxmint)
            apt-get purge -y -qq dnsmasq 2>/dev/null || true ;;
        rhel|centos|fedora|rocky|almalinux|amzn)
            dnf remove -y dnsmasq 2>/dev/null || yum remove -y dnsmasq 2>/dev/null || true ;;
        alpine) apk del dnsmasq 2>/dev/null || true ;;
        opensuse*|sles) zypper remove -y dnsmasq 2>/dev/null || true ;;
        arch|manjaro) pacman -R --noconfirm dnsmasq 2>/dev/null || true ;;
    esac

    # Remove service files
    log "Removing service files..."
    rm -f /etc/systemd/system/zoraxy-dhcp-routing.service
    rm -f /etc/systemd/system/gateway-routing.service
    systemctl daemon-reload 2>/dev/null || true

    # Flush NAT rules
    log "Flushing iptables NAT rules..."
    iptables -t nat -F POSTROUTING 2>/dev/null || true

    # Remove config files
    log "Removing config files..."
    rm -rf /opt/zoraxy/conf/dhcp/ 2>/dev/null || true
    rm -f /root/.dnsmasq-setup.conf /root/routing.sh
    rm -f /etc/dnsmasq.conf /etc/dnsmasq.conf.bak
    rm -rf /etc/dnsmasq.d/ 2>/dev/null || true

    # Remove sudoers
    log "Removing sudoers rule..."
    rm -f /etc/sudoers.d/dnsmasq-edit 2>/dev/null || true

    # Remove group (only if empty)
    if getent group dnsmasq-edit >/dev/null 2>&1; then
        groupdel dnsmasq-edit 2>/dev/null || warn "Could not delete group 'dnsmasq-edit' (may have members)"
    fi

    echo ""
    echo -e "${GREEN}   ✅ Removal complete.${NC}"
    echo -e "${GREEN}   System is in a clean state — ready for fresh install.${NC}"
    echo ""
}

#==============================================================================
#  MAIN
#==============================================================================

main() {
    # --- Argument parsing ---
    if [[ "${1:-}" == "--remove" || "${1:-}" == "-r" ]]; then
        banner
        ensure_root "$@"
        detect_os
        remove_all
        exit 0
    fi

    # --- Normal install flow ---
    banner
    ensure_root "$@"
    detect_os
    install_deps
    prompt_config
    detect_zoraxy
    show_config_summary
    setup_dnsmasq
    setup_nat_routing
    install_plugin
    verify

    echo ""
    echo -e "${GREEN}========================================${NC}"
    echo -e "${GREEN}   ✅ Installation Complete!${NC}"
    echo -e "${GREEN}========================================${NC}"
    echo ""
    echo -e "  ${BOLD}DHCP Configuration${NC}"
    echo -e "    File:    $ZORAXY_CONF_DIR/dhcp/dnsmasq.conf"
    echo -e "    Leases:  $ZORAXY_CONF_DIR/dhcp/dnsmasq.leases"
    echo ""
    echo -e "  ${BOLD}Plugin${NC}"
    echo -e "    Path:    $ZORAXY_PLUGIN_DIR/dhcp-lease-manager/"
    echo -e "    UI:      /plugin.ui/dhcp-lease-manager/"

    if [ "$ZORAXY_MODE" = "docker" ]; then
        echo ""
        echo -e "  ${YELLOW}⚠ Docker detected:${NC}"
        echo -e "    You may need to restart the Zoraxy container to discover the plugin."
        echo -e "    docker restart <zoraxy-container>"
    else
        echo ""
        echo -e "  ${BOLD}Next Steps${NC}"
        echo -e "    1. Restart Zoraxy:  systemctl restart zoraxy"
        echo -e "    2. Open Zoraxy UI → Plugins → enable 'DHCP Lease Manager'"
        echo -e "    3. Access at: /plugin.ui/dhcp-lease-manager/"
    fi
    echo ""

    if [ "$ZORAXY_MODE" = "docker" ] || [ "$ZORAXY_MODE" = "baremetal" ]; then
        info "The zoraxy user may need to re-login for group changes to apply."
        info "Run:  sudo -u zoraxy newgrp dnsmasq-edit"
    fi
}

# --- Run -------------------------------------------------------------------
main "$@"