#############################################################
#                    scripts/update.sh                     #
#############################################################

cat > scripts/update.sh << 'EOFUPDATE'
#!/bin/bash

# VPN Gateway Update Script
# Updates the VPN Gateway installation
# Version: 1.0.0

set -e

# Colors
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m'

INSTALL_DIR="/opt/vpn-gateway"
BACKUP_DIR="/opt/vpn-gateway-backup-$(date +%Y%m%d-%H%M%S)"
GITHUB_REPO="https://github.com/yourusername/vpn-gateway"

log() {
    echo -e "${GREEN}[+]${NC} $1"
}

error() {
    echo -e "${RED}[!]${NC} $1"
    exit 1
}

warning() {
    echo -e "${YELLOW}[*]${NC} $1"
}

# Check root
if [[ $EUID -ne 0 ]]; then
    error "This script must be run as root"
fi

echo -e "${BLUE}=== VPN Gateway Update ===${NC}"
echo ""

# Check current version
if [ -f "$INSTALL_DIR/version" ]; then
    CURRENT_VERSION=$(cat "$INSTALL_DIR/version")
    log "Current version: $CURRENT_VERSION"
else
    warning "Version file not found"
    CURRENT_VERSION="unknown"
fi

# Check for updates
log "Checking for updates..."
LATEST_VERSION=$(curl -s "$GITHUB_REPO/raw/main/version" 2>/dev/null || echo "")

if [ -z "$LATEST_VERSION" ]; then
    error "Could not fetch latest version"
fi

if [ "$CURRENT_VERSION" = "$LATEST_VERSION" ]; then
    log "Already running latest version: $LATEST_VERSION"
    exit 0
fi

log "New version available: $LATEST_VERSION"
echo ""
read -p "Update to version $LATEST_VERSION? (y/N): " -n 1 -r
echo ""

if [[ ! $REPLY =~ ^[Yy]$ ]]; then
    log "Update cancelled"
    exit 0
fi

# Backup current installation
log "Creating backup at $BACKUP_DIR..."
cp -r "$INSTALL_DIR" "$BACKUP_DIR"

# Backup WireGuard configs
cp -r /etc/wireguard "$BACKUP_DIR/wireguard-configs"

# Backup iptables rules
iptables-save > "$BACKUP_DIR/iptables.rules"
ip6tables-save > "$BACKUP_DIR/ip6tables.rules"

log "Backup complete"

# Stop services
log "Stopping services..."
systemctl stop vpn-webui vpn-security-monitor 2>/dev/null || true

# Download updates
log "Downloading updates..."
cd /tmp
rm -rf vpn-gateway-update
git clone "$GITHUB_REPO" vpn-gateway-update || \
    error "Failed to download updates"

# Update backend
log "Updating backend..."
cp /tmp/vpn-gateway-update/backend/app.py "$INSTALL_DIR/app.py"

# Update frontend
log "Updating frontend..."
cp /tmp/vpn-gateway-update/frontend/index.html "$INSTALL_DIR/static/index.html"

# Update scripts
log "Updating scripts..."
cp /tmp/vpn-gateway-update/scripts/*.sh /usr/local/bin/
chmod +x /usr/local/bin/vpn-*.sh

# Update Python dependencies
log "Updating dependencies..."
source "$INSTALL_DIR/venv/bin/activate"
pip install --upgrade -r /tmp/vpn-gateway-update/backend/requirements.txt

# Update version file
echo "$LATEST_VERSION" > "$INSTALL_DIR/version"

# Restart services
log "Restarting services..."
systemctl daemon-reload
systemctl start vpn-webui vpn-security-monitor

# Cleanup
rm -rf /tmp/vpn-gateway-update

# Verify update
sleep 3
if systemctl is-active vpn-webui >/dev/null 2>&1; then
    log "Update successful!"
    log "Version $LATEST_VERSION is now running"
    echo ""
    echo -e "${GREEN}Update complete!${NC}"
    echo "Backup saved at: $BACKUP_DIR"
else
    error "Services failed to start after update!"
    echo "Restore from backup with:"
    echo "  rm -rf $INSTALL_DIR"
    echo "  mv $BACKUP_DIR $INSTALL_DIR"
    echo "  systemctl restart vpn-webui"
fi