#!/bin/sh

SCRIPT="AdGuard-Home-Setup"
MIN_VER="v0.107.10"
SCHEMA_VER="14"

usage() {
cat <<EOH
Installs AdGuard Home and replaces dnsmasq for DNS and DHCP.

Usage: agh-setup [options]

options:
 -n username       The AdGuard Home web user name.
                      If not specified, the user name defaults to: root
 -p password       The plain text AdGuard Home web password. The password will be
                      hashed by calling https://bcrypt.org/api/generate-hash.json
 -h 'hash'         The Bcrypt password hash representing the AdGuard Home web
                      password. If not specified and -p is also not specifed, the
                      password defaults to: agh-admin
                      The hash value MUST be specified within single quotes.
                      You can generate the hash using an online generator, such as:
                        - https://bcrypt.org/
                        - https://www.appdevtools.com/bcrypt-generator
                        - https://wtools.io/bcrypt-generator-online
                      If you supply a password hash, you should use the -p option
                      to specify the matching password, so that AdGuard Home status
                      can be checked post-installation, and any static leases
                      currently defined in dnsmasq can be loaded into AdGuard Home.
 -d                Do NOT enable the AdGuard Home DHCP server.
                      This will continue to use dnsmasq for DHCP, at the expense
                      of some additional RAM. (See also -k)
 -e                Install AdGuard Home on USB rather than INTERNAL storage.
                      This is the default if the local filesystem is jffs2, because 
                      AdGuard Home is INCOMPATIBLE with jffs2.
 -k                Keep dnsmasq as the primary DNS Server on port 53 and use 
                      AdGuard Home as the only upstream DNS Server.
                      Implies the -d option.
 -i                Install AdGuard Home on INTERNAL storage rather than USB.
                      This is the default if the local filesystem is NOT jffs2. If
                      the local filesystem is jffs, then this option will create 
                      the working directory on tmpfs, which is cleared on reboot. 
                      However, this script will set up a cron sync job, so that the 
                      most you should lose will be the events and changes in the 
                      last minute before an unexpected system reboot.
 -v 'version'      The version of AdGuard Home to be installed (e.g. $MIN_VER).
                     The default is the latest version, and the minimum version is
                     $MIN_VER. Ignored if -xg or -xx specified.
 -x c|g|s|u|y|x    Exclude features:
                     -xc  Do not update System CA certificates
                            NOTE: If certificates are not up to date, AdGuard Home
                                  will FAIL to download filters
                     -xg  Do not get the latest version of AdGuard Home if it has
                            already been downloaded
                     -xs  Do not enable scheduled update of AdGuard Home
                     -xu  Do not download utility scripts (Implies -xs)
                     -xx  Same as -xc -xg -xs -xu
                     -xy  Do not replace an existing AdGuard Home Configuration
                            file (no effect if the .yaml file does not exist)
 -s                Skips the free memory check.
                      If there is not enough free memory, the installation will be
                      aborted. Use this option to install anyway.
 -r                Removes AdGuard Home and re-enables dnsmasq.
 -u                Uninstalls AdGuard Home (but does not remove it) and re-enables
                      dnsmasq.

NOTE: The -r and -u options are mutually exclusive. If both are specified, the
      LAST specified will take precedence. If either is specified, all other
      options are ignored.

EOH
exit
}

GREEN='\033[1;32m'
ORANGE='\033[0;33m'
RED='\033[0;31m'
NC='\033[0m' # No Color

DFLT_PSWD='agh-admin'
DFLT_HASH='$2a$10$NYfg4LYdisfCFeuhd5k25OFOvY/8HxFMEon1xaiSBkdXzeclmJUzq'
USERNAME='root'
PASSWORD="$DFLT_PSWD"
PWD_HASH="$DFLT_HASH"
CA_CERT=Y
DEL_AGH=Y
AGH_DHCP=true
AGH_PORT=53
AGH_VER=""
KEEP_DNSMASQ=N
DOWNLOAD=Y
SCHEDULED=Y
UTILITIES=Y
REMOVE=N
OVERWRITE=Y
SKIP_MEM_CHK=N
INSTALL_ROOT="/root"
OVERLAY_FS="$(mount | grep '/overlay type' | cut -d' ' -f5)"
if [ -z "$OVERLAY_FS" ]; then
  echo -e "${RED}[$SCRIPT] Failed to determine /overlay filesystem type! Aborting...${NC}"
  exit 2
elif [ $OVERLAY_FS = jffs2 ]; then
  EXTERNAL=Y
  QUERYLOG_INTERVAL=2160h
else
  EXTERNAL=N
  QUERYLOG_INTERVAL=24h
fi

while getopts :deih:kn:p:rsuv:x: option; do
 case "${option}" in
  d)  AGH_DHCP=false;;
  e)  EXTERNAL=Y;QUERYLOG_INTERVAL=2160h;;
  i)  EXTERNAL=N;QUERYLOG_INTERVAL=24h;;
  h)  PWD_HASH="$OPTARG";;
  k)  KEEP_DNSMASQ=Y;AGH_DHCP=false;AGH_PORT=53535;;
  n)  USERNAME="$OPTARG";;
  p)  PASSWORD="$OPTARG";;
  r)  REMOVE=Y;DEL_AGH=Y;;
  s)  SKIP_MEM_CHK=Y;;
  u)  REMOVE=Y;DEL_AGH=N;;
  v)  AGH_VER="$OPTARG";;
  x)  case "$OPTARG" in
        c)  CA_CERT=N;;
        g)  DOWNLOAD=N;;
        s)  SCHEDULED=N;;
        u)  UTILITIES=N;SCHEDULED=N;;
        y)  OVERWRITE=N;;
        x)  CA_CERT=N;DOWNLOAD=N;SCHEDULED=N;UTILITIES=N;;
        *)  echo -e "${RED}[$SCRIPT] Unknown -x$OPTARG option! Aborting...${NC}"; exit 2;;
      esac;;
  *)  usage;;
 esac
done
shift $((OPTIND-1))

if [ -n "$AGH_VER" ]; then
  if ! echo $AGH_VER | grep -qE '^v[0-9]+\.[0-9]+\.[0-9]+(-b\.[0-9]+)?$'; then
    echo -e "${RED}[$SCRIPT] Invalid version number for -v option! Aborting...${NC}"
    exit 2
  fi
  set -- $(echo $AGH_VER | cut -c2- | tr '.' ' ');REQ_MAJOR=$1;REQ_MINOR=$2;REQ_POINT=$3
  set -- $(echo $MIN_VER | cut -c2- | tr '.' ' ');MIN_MAJOR=$1;MIN_MINOR=$2;MIN_POINT=$3
  VER_OK=Y
  if [ $REQ_MAJOR -lt $MIN_MAJOR ]; then
    VER_OK=N
  elif [ $REQ_MAJOR -eq $MIN_MAJOR ]; then
    if [ $REQ_MINOR -lt $MIN_MINOR ]; then
      VER_OK=N
    elif [ $REQ_MINOR -eq $MIN_MINOR ]; then
      if [ $REQ_POINT -lt $MIN_POINT ]; then
        VER_OK=N
      fi
    fi
  fi
  if [ $VER_OK = N ]; then
    echo -e "${RED}[$SCRIPT] Requested version must be greater than or equal to ${MIN_VER}! Aborting...${NC}"
    exit 2
  fi
fi

IPv4=$(ip -o a | grep -E '^[0-9]*: br-lan * inet ' | tr -s ' ' | cut -d' ' -f4 | cut -d/ -f1)
IPv6=$(ip -o a | grep -v -E '^[0-9]*: (lo|if|wl|br-lan)' | grep ' inet6 ' | tr -s ' ' | cut -d' ' -f4 | grep -v '^fe' | cut -d/ -f1 | xargs)

configure_dnmasq() {
  local DNSMASQ="$1"
  local DHCP_SERVER=""
  local PEER_DNS=""
  local LOCAL_USE=""
  local DNS_PORT=""
  local WAN_MODE="$(uci -q get network.config.wan_mode)"
  local APPLY_NETWORK=0

  if [ "$DNSMASQ" = "enable" ]; then
    PEER_DNS="1"
    LOCAL_USE="1"
    DNS_PORT="53"
    if [ "$WAN_MODE" = "bridge" ]; then
      DHCP_SERVER="disabled"
    else
      DHCP_SERVER="server"
    fi
  else
    PEER_DNS="0"
    if [ $AGH_DHCP = true ]; then
      LOCAL_USE="0"
      DNS_PORT="0"
      DHCP_SERVER="disabled"
    else
      LOCAL_USE="1"
      if [ $KEEP_DNSMASQ = N ]; then
        DNS_PORT="0"
      else
        DNS_PORT="53"
      fi
      DHCP_SERVER="server"
    fi
  fi

  if [ "$(uci -q get network.wan)" = "interface" ]; then
    echo -e "${GREEN}[$SCRIPT] Configuring IPv4 WAN DNS...${NC}"
    uci -q set network.wan.peerdns="$PEER_DNS"
    uci -q delete network.wan.dns
    APPLY_NETWORK=1
  fi
  if [ "$(uci -q get network.wwan)" = "interface" ]; then
    echo -e "${GREEN}[$SCRIPT] Configuring WWAN DNS...${NC}"
    uci -q set network.wwan.peerdns="$PEER_DNS"
    APPLY_NETWORK=1
  fi
  if [ "$(uci -q get network.wan6)" = "interface" -a -n "$IPv6" ]; then
    echo -e "${GREEN}[$SCRIPT] Configuring IPv6 WAN DNS...${NC}"
    uci -q set network.wan6.peerdns="$PEER_DNS"
    APPLY_NETWORK=1
  fi

  if [ $APPLY_NETWORK = 1 ]; then
    echo -e "${GREEN}[$SCRIPT] Applying network changes...${NC}"
    uci commit network
    /etc/init.d/network reload >/dev/null 2>&1
  fi

  echo -e "${GREEN}[$SCRIPT] Configuring dnsmasq...${NC}"
  /etc/init.d/dnsmasq stop
  uci set dhcp.lan.dhcpv4="$DHCP_SERVER"
  uci set dhcp.lan.dhcpv6="$DHCP_SERVER"
  uci set dhcp.lan.ra="$DHCP_SERVER"
  for i in 0 1; do
    if [ -n "$(uci -q get dhcp.@dnsmasq[$i])" ]; then
      uci -q set dhcp.@dnsmasq[$i].localuse="$LOCAL_USE"
      uci -q set dhcp.@dnsmasq[$i].port="$DNS_PORT"
      if [ "$DNSMASQ" = "enable" ]; then
        uci -q delete dhcp.@dnsmasq[$i].cachesize
        uci -q del_list dhcp.@dnsmasq[$i].server="127.0.0.1#$AGH_PORT"
      elif [ $KEEP_DNSMASQ = Y ]; then
        uci -q set dhcp.@dnsmasq[$i].cachesize='0'
        uci -q delete dhcp.@dnsmasq[$i].server
        uci -q add_list dhcp.@dnsmasq[$i].server="127.0.0.1#$AGH_PORT"
      fi
    fi
  done
  uci commit dhcp
  # Have to restart even if disabling to apply changes to transformer
  /etc/init.d/dnsmasq start
  if [ "$DNSMASQ" = "enable" ]; then
    /etc/init.d/dnsmasq enable
    echo -e "[$SCRIPT] dnsmasq enabled and restarted${NC}"

    echo -e "${GREEN}[$SCRIPT] Re-allocating port 443 back to nginx...${NC}"
    sed -e  's/\(#*\)\(listen *443 ssl;\)/\2/' -i /etc/nginx/nginx.conf
  else
    if [ $AGH_DHCP = true ]; then
      /etc/init.d/dnsmasq disable
      /etc/init.d/dnsmasq stop
      echo -e "[$SCRIPT] dnsmasq disabled and stopped${NC}"
    elif [ $KEEP_DNSMASQ = N ]; then
      echo -e "[$SCRIPT] dnsmasq DNS server disabled${NC}"
    else
      echo -e "[$SCRIPT] dnsmasq restarted${NC}"
    fi
    echo -e "${GREEN}[$SCRIPT] Freeing port 443...${NC}"
    sed -e 's/\( [^#]\)\(listen *443 ssl;\)/  #\2/' -i /etc/nginx/nginx.conf
  fi
  /etc/init.d/nginx restart
}

MOUNT_PATH=$(uci get mountd.mountd.path)
USB="$(ls $MOUNT_PATH | head -n1)"

if [ $REMOVE = Y ]; then
  AGH_CMD=$(grep -o -m 1 -E '/.*/AdGuardHome/AdGuardHome ' /etc/init.d/AdGuardHome 2>/dev/null)
  if [ $? -ne 0 ]; then
    if [ -e /root/AdGuardHome/AdGuardHome ]; then
      AGH_CMD="/root/AdGuardHome/AdGuardHome"
    elif [ -e ${MOUNT_PATH}${USB}/AdGuardHome/AdGuardHome ]; then
      AGH_CMD="${MOUNT_PATH}${USB}/AdGuardHome/AdGuardHome"
    else
      echo -e "${RED}[$SCRIPT] AdGuard Home installation not found! Aborting...${NC}"
      exit 1
    fi
  fi

  echo -e "${GREEN}[$SCRIPT] Uninstalling AdGuard Home...${NC}"
  $AGH_CMD -s stop
  $AGH_CMD -s uninstall
  if [ -e /etc/init.d/AdGuardHome ]; then
    /etc/init.d/AdGuardHome stop
    /etc/init.d/AdGuardHome disable
    rm /etc/init.d/AdGuardHome
  fi

  configure_dnmasq enable

  if [ $DEL_AGH = Y ]; then
    echo -e "${GREEN}[$SCRIPT] Deleting AdGuard Home installation...${NC}"
    rm -rf $(dirname $AGH_CMD)
    [ -n "$(echo $AGH_CMD | grep -E '^/root')" ] && rm -rf /tmp/data /tmp/AdGuardHome.yaml leases.db 2>/dev/null
  fi

  if [ -e /etc/init.d/sync-adguard-home-data ]; then
    echo -e "${GREEN}[$SCRIPT] Removing data directory sync hack...${NC}"
    /etc/init.d/sync-adguard-home-data uninstall
    rm /etc/init.d/sync-adguard-home-data
  fi

  if [ -e /etc/hotplug.d/mount/00-adguardhome ]; then
    echo -e "${GREEN}[$SCRIPT] Removing USB mount hotplug...${NC}"
    rm /etc/hotplug.d/mount/00-adguardhome
  fi

  grep -q "agh-update" /etc/crontabs/root
  if [ $? -eq 0 ]; then
    echo -e "${GREEN}[$SCRIPT] Removing scheduled AdGuard Home update...${NC}"
    sed -e "/agh-update/d" -i /etc/crontabs/root
  fi

  grep -q "agh-lists-update" /etc/crontabs/root
  if [ $? -eq 0 ]; then
    echo -e "${GREEN}[$SCRIPT] Removing scheduled block list update...${NC}"
    sed -e "/agh-lists-update/d" -i /etc/crontabs/root
  fi

  echo -e "${GREEN}[$SCRIPT] Done${NC}"
  exit
fi

if [ -e /etc/init.d/AdGuardHome ]; then
  echo -e "${RED}[$SCRIPT] Existing AdGuard Home installation found! Aborting...${NC}"
  exit 2
fi

if [ \( "$DFLT_HASH" = "$PWD_HASH" -a "$DFLT_PSWD" != "$PASSWORD" \) ]; then
  PWD_HASH=""
fi
if [ \( "$DFLT_HASH" != "$PWD_HASH" -a "$DFLT_PSWD" = "$PASSWORD" \) ]; then
  echo -e "${RED}[$SCRIPT] You need to specify -p when you specify -h, so that AdGuard Home status can be checked post-installation.${NC}"
  exit 2
fi
if [ -z "$PWD_HASH" ]; then
  if [ -z "$PASSWORD" ]; then
    echo -e "${RED}[$SCRIPT] No password hash specified! Aborting...${NC}"
    exit 2
  fi
else
  echo "$PWD_HASH" | grep -q -E '^\$2[a-z]\$[0-9][0-9]\$'
  if [ $? -ne 0 ];then
    echo -e "${RED}[$SCRIPT] Password hash missing or incorrect! Make sure you use 10 Rounds when generating the hash. Aborting...${NC}"
    exit 2
  fi
fi

if [ $EXTERNAL = Y ]; then
  if [ -z "$USB" ]; then
    echo -e "${RED}[$SCRIPT] No USB device found! Aborting...${NC}"
    exit 2
  fi
  grep $(readlink -f "${MOUNT_PATH}${USB}") /proc/mounts | grep -q noexec
  if [ $? -eq 0 ]; then
    echo -e "${RED}[$SCRIPT] USB device has been mounted with noexec option! Unable to use as install path.${NC}"
    echo -e "${ORANGE}[$SCRIPT] You can fix this by running de-telstra${NC}"
    echo -e "${RED}[$SCRIPT] Aborting...${NC}"
    exit 2
  fi
  INSTALL_ROOT="${MOUNT_PATH}${USB}"
  WORKING_DIR="${MOUNT_PATH}${USB}/AdGuardHome/data"
elif [ $OVERLAY_FS = jffs2 ]; then
  INSTALL_ROOT="/root"
  WORKING_DIR="/tmp/AdGuardHomeWork"
else 
  INSTALL_ROOT="/root"
  WORKING_DIR="/root/AdGuardHome/data"
fi
cd $INSTALL_ROOT

DOMAIN=$(uci -q get dhcp.main.domain)
if [ $? -ne 0 -o -z "$DOMAIN" ]; then
  echo -e "${ORANGE}[$SCRIPT] Failed to determine LAN domain name? Defaulting to gateway${NC}"
  DOMAIN="gateway"
fi

if [ $CA_CERT = Y ]; then
  echo -e "${GREEN}[$SCRIPT] Downloading latest version of update-ca-certificates...${NC}"
  curl -kL -o /tmp/update-ca-certificates https://raw.githubusercontent.com/seud0nym/tch-gui-unhide/master/utilities/update-ca-certificates
  if [ $? -eq 0 ]
  then
    chmod +x /tmp/update-ca-certificates
    echo "[$SCRIPT] Successfully downloaded update-ca-certificates."
  else
    echo -e "${RED}[$SCRIPT] Failed to download update-ca-certificates! Aborting...${NC}"
    exit 2
  fi
  echo -e "${GREEN}[$SCRIPT] Running update-ca-certificates...${NC}"
  sh /tmp/update-ca-certificates -v
  rm /tmp/update-ca-certificates
fi

if [ $EXTERNAL = N -a $OVERLAY_FS = jffs2 ]; then
  if which rsync > /dev/null; then
    echo -e "${GREEN}[$SCRIPT] rsync command found${NC}"
  else
    echo -e "${GREEN}[$SCRIPT] Installing on jffs2 internal storage requires the rsync backup hack...${NC}"
    if ! sed -e '/^#/d' /etc/opkg/customfeeds.conf | grep 'BoLaMN\|macoers\|tch-static'; then
      echo -e "${RED}[$SCRIPT] ERROR! opkg is not configured!${NC}"
      echo -e "${ORANGE}[$SCRIPT]        You need to run ${NC}./de-telstra -o${ORANGE} or configure manually.${NC}"
      echo -e "${RED}[$SCRIPT]        Aborting...${NC}"
      exit 2
    fi

    echo -e "${GREEN}[$SCRIPT] Updating package lists...${NC}"
    opkg update

    echo -e "${GREEN}[$SCRIPT] Installing required rsync package...${NC}"
    opkg install rsync
    if [ $? -ne 0 ]; then
      echo -e "${ORANGE}[$SCRIPT] WARNING! Failed to install rsync. Attempting to install rsync-static...${NC}"
      opkg install rsync-static
      if [ $? -ne 0 ]; then
        echo -e "${RED}[$SCRIPT] ERROR! Failed to install required rsync package. Aborting...${NC}"
        exit 2
      fi
    fi
  fi
fi

if [ -z "$PWD_HASH" -a -n "$PASSWORD" ]; then
  echo -e "${GREEN}[$SCRIPT] Generating password hash...${NC}"
  JSON=$(curl -skLX POST --data "password=$PASSWORD&cost=10" https://bcrypt.org/api/generate-hash.json)
  JSON_RC=$?
  if [ $JSON_RC -eq 6 ]; then
    HASHD_OK="0"
    HASH_MSG="curl: (6) Could not resolve host: bcrypt.org"
  elif [ $JSON_RC -ne 0 ]; then
    HASHD_OK="0"
    HASH_MSG="curl: ($JSON_RC) Failed to generate hash from bcrypt.org"
  else
    . /usr/share/libubox/jshn.sh
    json_load "$JSON"
    json_get_var HASHD_OK ok
    json_get_var CHCK_PWD password
    json_get_var NEW_HASH hash
    json_get_var HASH_MSG msg
  fi
  if [ "$HASHD_OK" = "1" ]; then
    if [ "$CHCK_PWD" = "$PASSWORD" ]; then
      PWD_HASH="$NEW_HASH"
    else
      echo -e "${RED}[$SCRIPT] Returned password ($CHCK_PWD) is not the same as the sent password ($PASSWORD)??? Aborting...${NC}"
      exit 2
    fi
  else
    echo -e "${RED}[$SCRIPT] Password hash failed with message: ${NC}${HASH_MSG}${RED} Aborting...${NC}"
    exit 2
  fi
fi

if [ $DOWNLOAD = Y -o ! -d AdGuardHome ]; then
  if [ -z "$AGH_VER" ]; then
    echo -e "${GREEN}[$SCRIPT] Downloading latest release of AdGuard Home...${NC}"
    AGH_URL="https://static.adguard.com/adguardhome/release/AdGuardHome_linux_arm"
  else
    echo -e "${GREEN}[$SCRIPT] Downloading release $AGH_VER of AdGuard Home...${NC}"
    AGH_URL="https://github.com/AdguardTeam/AdGuardHome/releases/download/$AGH_VER/AdGuardHome_linux_arm"
  fi
  case "$(uname -m)" in
    aarch64)  ARCH="64";;
    armv7l)   ARCH="v5";;
    *)        echo -e "${RED}[$SCRIPT] Unable to handle $(uname -m) archictecture! Aborting...${NC}"; exit 2;;
  esac
  AGH_URL="${AGH_URL}${ARCH}.tar.gz"
  curl -kL $AGH_URL | tar -xzf -
  if [ $? -ne 0 ]; then
    echo -e "${RED}[$SCRIPT] Failed to download AdGuard Home! Aborting...${NC}"
    exit 2
  fi
fi

[ ! -d $WORKING_DIR ] && mkdir -p $WORKING_DIR

echo -e "${GREEN}[$SCRIPT] Disabling dnsmasq to free up RAM and port 53...${NC}"
configure_dnmasq disable

RAM_FREE=$(free | grep buffers: | tr -s ' ' | cut -d' ' -f4)
if [ -z "$RAM_FREE" ];then
  RAM_FREE=$(free | grep Mem: | tr -s ' ' | cut -d' ' -f7)
fi
echo -e "[$SCRIPT] Reported Free RAM = ${RAM_FREE}KB"
if [ $SKIP_MEM_CHK = N -a $RAM_FREE -lt 40000 ];then
  echo -e "${RED}[$SCRIPT] Insufficient free RAM! You need to shut down unnecessary services to free memory${NC}"
  echo -e "${ORANGE}[$SCRIPT] (Re-run with the -s option to skip this check.)${NC}"
  echo -e "[$SCRIPT] Re-enabling dnsmasq...${NC}"
  configure_dnmasq enable
  echo -e "${RED}[$SCRIPT] Aborting...${NC}"
  exit 2
fi

echo -e "${GREEN}[$SCRIPT] Extracting IP addresses from current configuration...${NC}"
DHCP_SETTINGS=$(lua -e '
  proxy = require("datamodel")
  values = proxy.get(
    "rpc.network.interface.@lan.ipaddr",
    "rpc.network.interface.@lan.ipmask",
    "uci.dhcp.dhcp.@lan.start",
    "uci.dhcp.dhcp.@lan.limit",
    "rpc.network.interface.@lan.ip6prefix_assignment",
    "uci.dhcp.dhcp.@lan.leasetime"
  )
  prefix = string.match(values[1].value,"^(%d+%.%d+%.%d+%.)")
  if prefix then
    ipstart = prefix..values[3].value
    ipend = prefix..values[4].value
  end
  cidr = tonumber(values[2].value)
  mask = ""
  for i=1,4 do
    mask = mask .. tostring(256 - 2^(8 - math.min(8, cidr)))
    if (i < 4) then
      mask = mask .. "."
    end
    cidr = math.max(0, cidr - 8)
  end
  ipv6start = string.match(values[5].value or "", "(.*)/(%d+)")
  time,precision = string.match(values[6].value, "^(%d+)([wdhms])$")
  if not precision then
    time = 3600
  elseif precision == "w" then
    time = time * 604800
  elseif precision == "d" then
    time = time * 86400
  elseif precision == "h" then
    time = time * 3600
  elseif precision == "m" then
    time = time * 60
  end
  print(values[1].value,mask,ipstart,ipend,time,ipv6start)
')
shift $#
set -- $DHCP_SETTINGS
GATEWAY=$1
NETMASK=$2
DHCPv4_START=$(echo "$3" | sed -e 's/nil/""/')
DHCPv4_END=$(echo "$4" | sed -e 's/nil/""/')
LEASE_TIME=$(echo "$5" | sed -e 's/nil/""/')
if [ "$6" = "nil" ]; then
  DHCPv6_START='""'
  SLAAC="false"
else
  DHCPv6_START="$(echo $6 | sed -e 's/:$/:1/')"
  SLAAC="true"
fi
LOCAL_DOMAIN="$(uci get dhcp.@dnsmasq[0].domain)"

if [ $OVERWRITE = Y -o ! -e $INSTALL_ROOT/AdGuardHome/AdGuardHome.yaml ]; then
  echo -e "${GREEN}[$SCRIPT] Configuring AdGuard Home...${NC}"
  echo "[$SCRIPT] IP=$GATEWAY MASK=$NETMASK DHCP=$AGH_DHCP (DHCPv4=$DHCPv4_START->$DHCPv4_END DHCPv6=$DHCPv6_START SLAAC=$SLAAC)"
  cat <<YAML_END >$INSTALL_ROOT/AdGuardHome/AdGuardHome.yaml
bind_host: $GATEWAY
bind_port: 8008
beta_bind_port: 0
users:
  - name: $USERNAME
    password: $PWD_HASH
auth_attempts: 5
block_auth_min: 15
http_proxy: ""
language: ""
rlimit_nofile: 0
debug_pprof: false
web_session_ttl: 720
dns:
  bind_hosts:
    - 0.0.0.0
  port: $AGH_PORT
  statistics_interval: 1
  querylog_enabled: false
  querylog_file_enabled: true
  querylog_interval: $QUERYLOG_INTERVAL
  querylog_size_memory: 1000
  anonymize_client_ip: false
  protection_enabled: true
  blocking_mode: default
  blocking_ipv4: ""
  blocking_ipv6: ""
  blocked_response_ttl: 10
  parental_block_host: family-block.dns.adguard.com
  safebrowsing_block_host: standard-block.dns.adguard.com
  ratelimit: 20
  ratelimit_whitelist: []
  refuse_any: true
  upstream_dns:
    - tls://1dot1dot1dot1.cloudflare-dns.com
    - tls://dns10.quad9.net
    - tls://dns.google
    - quic://unfiltered.adguard-dns.com
  upstream_dns_file: ""
  bootstrap_dns:
    - 9.9.9.10
    - 149.112.112.10
    - 2620:fe::10
    - 2620:fe::fe:10
  all_servers: false
  fastest_addr: false
  allowed_clients: []
  disallowed_clients: []
  blocked_hosts:
    - version.bind
    - id.server
    - hostname.bind
  cache_size: 4194304
  cache_ttl_min: 0
  cache_ttl_max: 0
  bogus_nxdomain: []
  aaaa_disabled: false
  enable_dnssec: false
  edns_client_subnet: false
  max_goroutines: 300
  ipset: []
  filtering_enabled: true
  filters_update_interval: 24
  parental_enabled: false
  safesearch_enabled: false
  safebrowsing_enabled: false
  safebrowsing_cache_size: 1048576
  safesearch_cache_size: 1048576
  parental_cache_size: 1048576
  cache_time: 30
  rewrites: []
  blocked_services: []
  local_domain_name: $DOMAIN
  resolve_clients: true
  local_ptr_upstreams: []
tls:
  enabled: false
  server_name: ""
  force_https: false
  port_https: 443
  port_dns_over_tls: 853
  port_dns_over_quic: 784
  port_dnscrypt: 0
  dnscrypt_config_file: ""
  allow_unencrypted_doh: false
  strict_sni_check: false
  certificate_chain: ""
  private_key: ""
  certificate_path: ""
  private_key_path: ""
filters:
  - enabled: true
    url: https://adguardteam.github.io/AdGuardSDNSFilter/Filters/filter.txt
    name: AdGuard DNS filter
    id: 1
  - enabled: true
    url: https://adaway.org/hosts.txt
    name: AdAway Default Blocklist
    id: 2
  - enabled: false
    url: https://www.malwaredomainlist.com/hostslist/hosts.txt
    name: MalwareDomainList.com Hosts List
    id: 4
  - enabled: false
    url: https://someonewhocares.org/hosts/zero/hosts
    name: Dan Pollock's List
    id: 1626696441
  - enabled: false
    url: https://raw.githubusercontent.com/Perflyst/PiHoleBlocklist/master/SmartTV-AGH.txt
    name: Perflyst and Dandelion Sprout's Smart-TV Blocklist
    id: 1626696443
  - enabled: false
    url: https://pgl.yoyo.org/adservers/serverlist.php?hostformat=adblockplus&showintro=1&mimetype=plaintext
    name: Peter Lowe's List
    id: 1626696444
  - enabled: false
    url: https://raw.githubusercontent.com/crazy-max/WindowsSpyBlocker/master/data/hosts/spy.txt
    name: WindowsSpyBlocker - Hosts spy rules
    id: 1626696445
  - enabled: false
    url: https://www.github.developerdan.com/hosts/lists/ads-and-tracking-extended.txt
    name: Developer Dan's Ads and Tracking List
    id: 1626696453
  - enabled: false
    url: https://v.firebog.net/hosts/static/w3kbl.txt
    name: WaLLy3K's Blacklist
    id: 1626696456
  - enabled: false
    url: https://raw.githubusercontent.com/anudeepND/blacklist/master/adservers.txt
    name: Anudeep ND's Blacklist
    id: 1626696458
  - enabled: false
    url: https://raw.githubusercontent.com/bigdargon/hostsVN/master/hosts
    name: hostsVN
    id: 1626696462
  - enabled: false
    url: https://v.firebog.net/hosts/Easyprivacy.txt
    name: Easyprivacy
    id: 1626696463
  - enabled: false
    url: https://raw.githubusercontent.com/FadeMind/hosts.extras/master/add.Risk/hosts
    name: Fademind's Risky Hosts
    id: 1626696475
  - enabled: false
    url: https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts
    name: Steven Black Hosts List
    id: 1626916178
whitelist_filters:
  - enabled: false
    url: https://raw.githubusercontent.com/anudeepND/whitelist/master/domains/whitelist.txt
    name: anudeepND's Curated Whitelist
    id: 1626696452
user_rules: []
dhcp:
  enabled: $AGH_DHCP
  interface_name: br-lan
  local_domain_name: $LOCAL_DOMAIN
  dhcpv4:
    gateway_ip: $GATEWAY
    subnet_mask: $NETMASK
    range_start: $DHCPv4_START
    range_end: $DHCPv4_END
    lease_duration: $LEASE_TIME
    icmp_timeout_msec: 1000
    options: []
  dhcpv6:
    range_start: $DHCPv6_START
    lease_duration: $LEASE_TIME
    ra_slaac_only: false
    ra_allow_slaac: $SLAAC
log_compress: false
log_localtime: false
log_max_backups: 0
log_max_size: 100
log_max_age: 3
log_file: ""
verbose: false
schema_version: $SCHEMA_VER
YAML_END
  [ $AGH_DHCP = false ] && sed \
    -e  "/upstream_dns:/a\    - '[/$LOCAL_DOMAIN/]127.0.0.1:53835'" \
    -e "s/local_ptr_upstreams: \[\]/local_ptr_upstreams:/" \
    -e  "/local_ptr_upstreams:/a\    - 127.0.0.1:53835" \
    -e  "/local_ptr_upstreams:/i\  use_private_ptr_resolvers: true" \
    -i $INSTALL_ROOT/AdGuardHome/AdGuardHome.yaml
else
  echo -e "${ORANGE}[$SCRIPT] Existing AdGuard Home configuration NOT overwritten${NC}"
fi

echo -e "${GREEN}[$SCRIPT] Checking AdGuard Home configuration...${NC}"
AdGuardHome/AdGuardHome --check-config -c $INSTALL_ROOT/AdGuardHome/AdGuardHome.yaml
if [ $? -ne 0 ]; then
  echo -e "${RED}[$SCRIPT] Configuration error? Restoring dnsmasq...${NC}"
  configure_dnmasq enable
  echo -e "${RED}[$SCRIPT] Aborting...${NC}"
  exit 2
fi

if [ $EXTERNAL = Y ]; then
  echo -e "${GREEN}[$SCRIPT] Configuring hotplug so that USB removal will fall back to dnsmasq...${NC}"
  cat<<"PLUG_EOF" > /etc/hotplug.d/mount/00-adguardhome
#!/bin/sh

# script triggered by mountd
# mountd provides environment variables ACTION, DEVICE, NAME
# f.e. ACTION=add DEVICE=sda1 NAME=USB-A1

adguardhome_log () {
  local msg="${1}"
  logger -t hotplug.d-mount-adguardhome "${msg}"
}

adguardhome_init () {
  adguardhome_log "Stopping AdGuard Home on $ACTION $NAME (Device $DEVICE)"
  /etc/init.d/AdGuardHome stop
}

configure_dnmasq() {
  local IPv4=$(ip -o a | grep -E '^[0-9]*: br-lan * inet ' | tr -s ' ' | cut -d' ' -f4 | cut -d/ -f1)
  local IPv6=$(ip -o a | grep -v -E '^[0-9]*: (lo|if|wl|br-lan)' | grep ' inet6 '| grep -v -E ' inet6 f[de]'  | tr -s ' ' | cut -d' ' -f4 | cut -d/ -f1 | xargs)
  local DHCP_SERVER=""
  local PEER_DNS=""
  local LOCAL_USE=""
  local DNS_PORT=""

  if [ "$1" = "enable" ]; then
    PEER_DNS="1"
    LOCAL_USE="1"
    DNS_PORT="53"
    DHCP_SERVER="server"
  else
    PEER_DNS="0"
    LOCAL_USE="0"
    if [ $AGH_DHCP = true ]; then
      DNS_PORT="0"
      DHCP_SERVER="disabled"
    else
      DNS_PORT="53835"
      DHCP_SERVER="server"
    fi
  fi

  uci set network.wan.peerdns="$PEER_DNS"
  uci -q delete network.wan.dns

  if [ -n "$IPv6" ]; then
    uci set network.wan6.peerdns="$PEER_DNS"
  fi
  uci commit network
  /etc/init.d/network reload >/dev/null 2>&1

  /etc/init.d/dnsmasq stop
  uci set dhcp.lan.dhcpv4="$DHCP_SERVER"
  uci set dhcp.lan.dhcpv6="$DHCP_SERVER"
  uci set dhcp.lan.ra="$DHCP_SERVER"
  for i in 0 1; do
    if [ -n "$(uci -q get dhcp.@dnsmasq[$i])" ]; then
      uci -q set dhcp.@dnsmasq[$i].localuse="$LOCAL_USE"
      uci -q set dhcp.@dnsmasq[$i].port="$DNS_PORT"
    fi
  done
  uci commit dhcp
  # Have to restart even if disabling to apply changes to transformer
  /etc/init.d/dnsmasq start
  /etc/init.d/dnsmasq $1
  [ "$1" = "disable" -a $AGH_DHCP = true ] && /etc/init.d/dnsmasq stop
  adguardhome_log "dnsmasq ${1}d"
}

if [ -e /etc/init.d/AdGuardHome -a -d /mnt/usb/$NAME/AdGuardHome ]; then
  adguardhome_init

  sed -e "s|/tmp/run/mountd/sd[^/]*/|/tmp/run/mountd/$DEVICE/|g" -e "s|/mnt/usb/USB-[^/]*/|/mnt/usb/$NAME/|g" -i /etc/init.d/AdGuardHome

  AGH_CMD=$(grep -o -m 1 -E '/.*/AdGuardHome/AdGuardHome ' /etc/init.d/AdGuardHome 2>/dev/null)
  echo $AGH_CMD | grep -q -E "$NAME|$DEVICE"
  if [ $? -eq 0 -a -e $AGH_CMD ]; then
    if [ "${ACTION}" == "add" ]; then
      configure_dnmasq disable
      /etc/init.d/AdGuardHome start
    elif [ "${ACTION}" == "remove" ]; then
      configure_dnmasq enable
    fi
  else
    adguardhome_log "AdGuardHome not configured for $NAME or $DEV??"
    configure_dnmasq enable
  fi
else
  adguardhome_log "/etc/init.d/AdGuardHome not found? Ignoring $ACTION $NAME"
fi
PLUG_EOF
  sed -e "1a\\\nDHCP_AGH=$AGH_DHCP" -i /etc/hotplug.d/mount/00-adguardhome
  chmod 755 /etc/hotplug.d/mount/00-adguardhome
elif [ $OVERLAY_FS = jffs2 ]; then
  echo -e "${GREEN}[$SCRIPT] Configuring rsync backup of AdGuard Home data...${NC}"
  cat <<INIT_EOF >/etc/init.d/sync-adguard-home-data
#!/bin/sh /etc/rc.common
START=40
STOP=91
EXTRA_COMMANDS="uninstall"
EXTRA_HELP="    uninstall Removes the cron job and disables this init script"
boot() {
  logger -t sync-adguard-home-data Creating sync directories
  [ ! -d /root/AdGuardHomeWork ] && { mkdir -p /root/AdGuardHomeWork; echo "This directory is automatically synced between /root/AdGuardHomeWork and $WORKING_DIR. DO NOT DELETE!">/root/AdGuardHomeWork; }
  [ ! -d $WORKING_DIR ] && mkdir -p $WORKING_DIR
  logger -t sync-adguard-home-data Restoring AdGuardHome data directory
  rsync -qa --delete /root/AdGuardHomeWork/ $WORKING_DIR/
  logger -t sync-adguard-home-data Configuring sync cron job
  sed -e "/rsync -qa --delete .*AdGuardHomeWork/d" -i /etc/crontabs/root
  echo "* * * * * rsync -qa --delete $WORKING_DIR/ /root/AdGuardHomeWork/">>/etc/crontabs/root
}
stop() {
  logger -t sync-adguard-home-data Backing up AdGuardHome data directory
  rsync -qa --delete $WORKING_DIR/ /root/AdGuardHomeWork/
}
uninstall() {
  stop
  logger -t sync-adguard-home-data Removing cron job
  sed -e "/rsync -qa --delete .*AdGuardHomeWork/d" -i /etc/crontabs/root
  /etc/init.d/cron restart
  logger -t sync-adguard-home-data Disabling
  disable
}
INIT_EOF
  chmod +x /etc/init.d/sync-adguard-home-data
  /etc/init.d/sync-adguard-home-data enable
  /etc/init.d/sync-adguard-home-data boot
  /etc/init.d/cron restart
fi

echo -e "${GREEN}[$SCRIPT] Installing AdGuard Home...${NC}"
AdGuardHome/AdGuardHome -s install -c $INSTALL_ROOT/AdGuardHome/AdGuardHome.yaml -w $WORKING_DIR

echo -en "${GREEN}[$SCRIPT] Checking AdGuard Home status"
AGH_RUNNING='false'
STATUS_CHK=0
while [ $STATUS_CHK -lt 15 ]; do
  echo -n "."
  curl -su $USERNAME:$PASSWORD http://${GATEWAY}:8008/control/status | grep -q '"running":true'
  if [ $? -eq 0 ]; then
    AGH_RUNNING='true'
    break
  else
    sleep 1s
    STATUS_CHK=$(( $STATUS_CHK + 1 ))
  fi
done
echo -e "${NC}"

if [ $AGH_RUNNING = 'true' ]; then
  if [ $AGH_DHCP = true ]; then
    echo -e "${GREEN}[$SCRIPT] Loading static leases...${NC}"
    for host in $(uci show dhcp | grep '=host$' | cut -d= -f1); do
      SLEASE_MAC="$(uci -q get $host.mac)"
      SLEASE_IP="$(uci -q get $host.ip)"
      SLEASE_NAME="$(uci -q get $host.name)"
      if [ -n "$SLEASE_IP" -a -n "$SLEASE_MAC" -a -n "$SLEASE_NAME" ]; then
        echo -e "[$SCRIPT] Loading static lease for $SLEASE_IP ($SLEASE_MAC - $SLEASE_NAME)"
        curl -u $USERNAME:$PASSWORD -X POST -H 'Content-Type: application/json' --data "{ \"mac\":\"$SLEASE_MAC\", \"ip\":\"$SLEASE_IP\", \"hostname\":\"$SLEASE_NAME\" }" http://${GATEWAY}:8008/control/dhcp/add_static_lease
      else
        echo -e "${ORANGE}[$SCRIPT] SKIPPED loading static lease - missing parameter (MAC=$SLEASE_MAC: IP=$SLEASE_IP HOST NAME=$SLEASE_NAME)${NC}"
      fi
    done
  fi

  if [ $UTILITIES = Y ]; then
    for s in agh-analyse-block-lists agh-change-password agh-lists-update agh-update; do
      echo -e "${GREEN}[$SCRIPT] Downloading utility script: $s to $INSTALL_ROOT/AdGuardHome ${NC}"
      curl -kL -o AdGuardHome/$s https://raw.githubusercontent.com/seud0nym/tch-gui-unhide/master/supplemental/adguard/$s
      chmod +x AdGuardHome/$s
    done
    if [ $SCHEDULED = Y ]; then
      grep -q agh-update /etc/crontabs/root && sed -e "/agh-update/d" -i /etc/crontabs/root
      AdGuardHome/agh-update -C
    fi
  fi

  echo -e "${GREEN}[$SCRIPT] Done. You can now access AdGuard Home on http://${GATEWAY}:8008${NC}"
else
  echo -e "${RED}[$SCRIPT] Something went wrong??? Could not connect to AdGuard Home!${NC}"
  echo -e "${RED}[$SCRIPT] Restoring dnsmasq...${NC}"
  configure_dnmasq enable
  echo -e "${RED}[$SCRIPT] Installation failed!${NC}"
fi