#!/bin/bash
# pqgw-imagine-rpc2.sh (PE rpc2; fisierele vin in /root/pqgw-imagine: pqgw.tar din `git archive HEAD` + pqgw-sonda.mjs):
# masoara ce README-ul gateway-ului numeste NEMASURAT: imaginea Docker se construieste, PORNESTE, poarta OpenSSL >= 3.5, si un client
# care ofera NUMAI X25519MLKEM768 face handshake, iar unul clasic e REFUZAT in modul hybrid-only (controlul negativ). Totul pe 127.0.0.1,
# port 8444, container si imagine sterse la sfarsit (nimic ramane armat). RPC-ul local e cronometrat inainte si dupa.
set -u
D=/root/pqgw-imagine; cd "$D" || exit 2
N=/opt/node24/bin/node
rpc() { local t0=$(date +%s%N); curl -s -m 5 -H 'content-type: application/json' -d '{"jsonrpc":"2.0","id":1,"method":"eth_blockNumber","params":[]}' http://127.0.0.1:8545 | grep -o '"result":"0x[0-9a-f]*"' | head -1; echo " ($(( ($(date +%s%N) - t0) / 1000000 )) ms)"; }
echo "== RPC inainte: $(rpc)"
rm -rf src && mkdir -p src certs && tar -xf pqgw.tar -C src && ls -la src/cloud-gateway/pq-gateway | sed -n '2,5p'
sha256sum src/cloud-gateway/pq-gateway/pq-gateway.mjs src/cloud-gateway/pq-gateway/Dockerfile | cut -c1-16,66-
echo "== docker build"; t0=$(date +%s); docker build -q -t aere-pq-gateway:proba src/cloud-gateway/pq-gateway > build.log 2>&1; c=$?; echo "build cod=$c in $(( $(date +%s) - t0 )) s; $(tail -1 build.log | cut -c1-100)"
[ $c -eq 0 ] || { tail -20 build.log; exit 1; }
docker image inspect aere-pq-gateway:proba --format 'imagine: {{.Id}} {{.Size}} octeti, {{.Os}}/{{.Architecture}}, user={{.Config.User}}'
echo "== certificat de proba (EC P-256, autosemnat, citibil de uid 1000)"
openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:prime256v1 -nodes -keyout certs/privkey.pem -out certs/fullchain.pem -days 2 -subj '/CN=proba.local' > /dev/null 2>&1 && chmod 644 certs/privkey.pem certs/fullchain.pem && echo "cert ok"
echo "== upstream de proba (python http.server pe 127.0.0.1:8081)"; (cd certs && nohup python3 -m http.server 8081 --bind 127.0.0.1 > /dev/null 2>&1 & echo $! > ../upstream.pid); sleep 1
docker rm -f pqgw-proba > /dev/null 2>&1
echo "== pornire: hybrid-only"
docker run -d --name pqgw-proba --network host -e AERE_PQGW_LISTEN=127.0.0.1:8444 -e AERE_PQGW_MODE=hybrid-only -e AERE_PQGW_UPSTREAM=http://127.0.0.1:8081 -v "$D/certs:/etc/aere-pq-gateway:ro" aere-pq-gateway:proba > /dev/null; sleep 3
docker ps --filter name=pqgw-proba --format 'container: {{.Status}}'
echo "-- jurnal (randul listening cu OpenSSL)"; docker logs pqgw-proba 2>&1 | head -5 | cut -c1-220
echo "-- sonda hibrid singur (trebuie ok)"; $N pqgw-sonda.mjs 127.0.0.1 8444 X25519MLKEM768; echo "cod=$?"
echo "-- sonda clasic singur in hybrid-only (CONTROL NEGATIV: trebuie refuzat)"; $N pqgw-sonda.mjs 127.0.0.1 8444 X25519; echo "cod=$?"
echo "-- o cerere HTTP prin gateway (hibrid) spre upstream"; curl -sk -m 8 --curves X25519MLKEM768 --tlsv1.3 https://127.0.0.1:8444/ -o /dev/null -w 'http=%{http_code} ssl=%{ssl_verify_result} tls=%{tls_version}\n' 2>&1 | head -1 || true
echo "== repornire: hybrid-preferred (clasicul trebuie sa mearga, hibridul preferat)"
docker rm -f pqgw-proba > /dev/null 2>&1
docker run -d --name pqgw-proba --network host -e AERE_PQGW_LISTEN=127.0.0.1:8444 -e AERE_PQGW_MODE=hybrid-preferred -e AERE_PQGW_UPSTREAM=http://127.0.0.1:8081 -v "$D/certs:/etc/aere-pq-gateway:ro" aere-pq-gateway:proba > /dev/null; sleep 3
echo "-- sonda clasic singur in hybrid-preferred (trebuie ok)"; $N pqgw-sonda.mjs 127.0.0.1 8444 X25519; echo "cod=$?"
echo "-- sonda hibrid+clasic in hybrid-preferred (trebuie ok)"; $N pqgw-sonda.mjs 127.0.0.1 8444 X25519MLKEM768:X25519; echo "cod=$?"
docker logs pqgw-proba 2>&1 | tail -4 | cut -c1-220
echo "== curatenie"; docker rm -f pqgw-proba > /dev/null 2>&1; docker rmi aere-pq-gateway:proba > /dev/null 2>&1 && echo "imaginea stearsa"; kill "$(cat upstream.pid)" 2>/dev/null; rm -rf certs upstream.pid; docker ps --filter name=pqgw --format '{{.Names}}' | grep -c . | sed 's/^/containere pqgw ramase: /'
echo "== RPC dupa: $(rpc)"