set -euo pipefail
export DEBIAN_FRONTEND=noninteractive

echo '== install socat =='
if ! command -v socat >/dev/null 2>&1; then
  apt-get update
  apt-get install -y socat
fi
socat -V | head -1 || true

echo '== backup old service =='
if [ -f /etc/systemd/system/infisical-wsl-proxy.service ]; then
  cp -a /etc/systemd/system/infisical-wsl-proxy.service "/etc/systemd/system/infisical-wsl-proxy.service.bak-$(date +%Y%m%d-%H%M%S)"
fi

cat > /etc/systemd/system/infisical-wsl-proxy.service <<'UNIT'
[Unit]
Description=Infisical WSL TCP proxy 8088 to Docker localhost 18080 via socat
After=docker.service network-online.target
Requires=docker.service

[Service]
Type=simple
ExecStart=/usr/bin/socat TCP-LISTEN:8088,fork,reuseaddr,bind=0.0.0.0 TCP:127.0.0.1:18080
Restart=always
RestartSec=2

[Install]
WantedBy=multi-user.target
UNIT

systemctl daemon-reload
systemctl enable infisical-wsl-proxy.service >/dev/null
systemctl restart infisical-wsl-proxy.service
sleep 2

echo '== service status =='
systemctl is-active infisical-wsl-proxy.service
systemctl status infisical-wsl-proxy.service --no-pager -l | sed -n '1,18p'

echo '== WSL health checks =='
for url in http://127.0.0.1:18080/api/status http://127.0.0.1:8088/api/status; do
  echo "url=$url"
  curl -fsS --max-time 8 "$url" && echo
done
WSLIP=$(ip -4 addr show eth0 | awk '/inet /{sub(/\/.*$/,"",$2); print $2; exit}')
echo "wsl_ip=$WSLIP"
curl -fsS --max-time 8 "http://$WSLIP:8088/api/status" && echo

echo '== listeners =='
ss -ltnp | grep -E '8088|18080' || true