set -euo pipefail
APP=/opt/infisical
cd "$APP"
echo '== patch compose to local docker bind 18080 =='
python3 - <<'PY'
from pathlib import Path
import re
p=Path('/opt/infisical/docker-compose.prod.yml')
s=p.read_text()
s=re.sub(r'-\s*"?(?:[0-9.]+:)?8088:8080"?', '- "127.0.0.1:18080:8080"', s)
s=re.sub(r'-\s*"?127\.0\.0\.1:18080:8080"?', '- "127.0.0.1:18080:8080"', s)
p.write_text(s)
PY
grep -A4 'ports:' docker-compose.prod.yml || true
echo '== install python tcp proxy =='
cat > /opt/infisical/bin/tcp-proxy.py <<'PY'
#!/usr/bin/env python3
import socket, threading, select, sys
LISTEN_HOST='0.0.0.0'; LISTEN_PORT=8088
TARGET_HOST='127.0.0.1'; TARGET_PORT=18080

def pipe(a,b):
    sockets=[a,b]
    try:
        while True:
            r,_,_=select.select(sockets,[],[],300)
            if not r: break
            for s in r:
                data=s.recv(65536)
                if not data: return
                (b if s is a else a).sendall(data)
    except Exception:
        pass
    finally:
        for s in sockets:
            try: s.close()
            except Exception: pass

def main():
    srv=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    srv.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
    srv.bind((LISTEN_HOST, LISTEN_PORT))
    srv.listen(128)
    print(f'proxy listening {LISTEN_HOST}:{LISTEN_PORT} -> {TARGET_HOST}:{TARGET_PORT}', flush=True)
    while True:
        c,addr=srv.accept()
        try:
            t=socket.create_connection((TARGET_HOST,TARGET_PORT), timeout=10)
        except Exception:
            c.close(); continue
        threading.Thread(target=pipe,args=(c,t),daemon=True).start()
if __name__ == '__main__': main()
PY
chmod 755 /opt/infisical/bin/tcp-proxy.py
cat > /etc/systemd/system/infisical-wsl-proxy.service <<'UNIT'
[Unit]
Description=Infisical WSL TCP proxy 8088 to Docker localhost 18080
After=docker.service network-online.target
Requires=docker.service

[Service]
Type=simple
ExecStart=/usr/bin/python3 /opt/infisical/bin/tcp-proxy.py
Restart=always
RestartSec=2

[Install]
WantedBy=multi-user.target
UNIT
systemctl daemon-reload
systemctl enable infisical-wsl-proxy.service >/dev/null
echo '== restart compose and proxy =='
systemctl stop infisical-wsl-proxy.service 2>/dev/null || true
docker compose -f docker-compose.prod.yml up -d --force-recreate infisical
for i in $(seq 1 40); do
  if curl -fsS --max-time 5 http://127.0.0.1:18080/api/status >/dev/null; then break; fi
  sleep 3
  [ "$i" = 40 ] && { docker compose -f docker-compose.prod.yml ps; docker logs --tail 80 infisical-app; exit 1; }
done
systemctl start infisical-wsl-proxy.service
sleep 2
echo '== verify WSL proxy =='
systemctl is-active infisical-wsl-proxy.service
curl -fsS --max-time 5 http://127.0.0.1:8088/api/status && echo
WSLIP=$(ip -4 addr show eth0 | awk '/inet /{sub(/\/.*$/,"",$2); print $2; exit}')
curl -fsS --max-time 5 "http://$WSLIP:8088/api/status" && echo
echo "wsl_ip=$WSLIP"
ss -ltnp | grep -E '8088|18080' || true