# Technitium DNS Blocklist Updater for DNS1 (Windows)
# Run as a scheduled task — pulls malware domains + Israeli IPs from shared-bans repo
# and tells Technitium to reload its blocklists.
#
# Requires:
#   - Technitium DNS API token set as TECHNIITIUM_DNS_TOKEN (env var or vault)
#   - Git repo checked out somewhere (C:\shared-bans)
#   - TASK_TOKEN set in vault
#
# Schedule: Daily at 3 AM + on-demand via Hermes cron

param(
    [string]$TaskToken = $env:TASK_TOKEN
)

$ErrorActionPreference = "SilentlyContinue"

# Config
$RepoDir = "C:\shared-bans"
$TechnitiumBase = "http://localhost:5380"
$LogFile = "C:\shared-bans\logs\technitium-update.log"
$Token = $env:TECHNITIUM_DNS_TOKEN

function Write-Log {
    param([string]$Msg)
    $ts = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
    "$ts $Msg" | Out-File -Append -FilePath $LogFile -Encoding UTF8
}

# ── Auth check ──────────────────────────────────────────────────────────────
if (-not $Token) {
    Write-Log "ERROR: TECHNITIUM_DNS_TOKEN env var not set"
    exit 1
}

# ── Pull latest from repo ────────────────────────────────────────────────────
Set-Location $RepoDir
git fetch origin main
$changed = git reset --hard origin/main 2>&1
Write-Log "Git pull: $changed"

# ── Count entries we're about to feed ───────────────────────────────────────
$malwareCount = (Get-Content "$RepoDir\static\malware-domains.txt" | Measure-Object -Line).Lines
$israelCount  = (Get-Content "$RepoDir\static\israel-hosts.txt" | Measure-Object -Line).Lines
Write-Log "Malware domains: $malwareCount | Israeli hosts: $israelCount"

# ── Build the combined blockListUrls list ────────────────────────────────────
# Technitium supports file:// URLs on Windows (v13+)
$Urls = @(
    "file:///$RepoDir/static/malware-domains.txt",
    "file:///$RepoDir/static/israel-hosts.txt"
)

# ── Get current settings to preserve everything else ─────────────────────────
$current = Invoke-RestMethod -Uri "$TechnitiumBase/api/settings/get" `
    -Headers @{ Authorization = "Bearer $Token" } `
    -UseBasicParsing

$currentBlockLists = $current.response.blockListUrls
Write-Log "Current blockListUrls: $currentBlockLists"

# ── Update DNS settings with new block list URLs ────────────────────────────
$body = @{
    blockListUrls = ($Urls -join ",")
} | ConvertTo-Json -Compress

$resp = Invoke-RestMethod -Uri "$TechnitiumBase/api/settings/set" `
    -Method POST `
    -Headers @{ Authorization = "Bearer $Token"; "Content-Type" = "application/json" } `
    -Body $body `
    -UseBasicParsing

if ($resp.status -eq "ok") {
    Write-Log "Settings updated OK"
} else {
    Write-Log "ERROR setting blockListUrls: $($resp | ConvertTo-Json -Compress)"
    exit 1
}

# ── Force block list reload ──────────────────────────────────────────────────
$force = Invoke-RestMethod -Uri "$TechnitiumBase/api/settings/forceUpdateBlockLists" `
    -Headers @{ Authorization = "Bearer $Token" } `
    -UseBasicParsing

Write-Log "ForceUpdateBlockLists: $($force | ConvertTo-Json -Compress)"
Write-Log "Done at $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')"