#!/bin/bash
set -u

STROKE="/usr/libexec/strongswan/stroke"
STATE_FILE="/run/eg334s-vti-health.active"

systemctl stop eg334s-vti-health.service
if timeout 45 "$STROKE" up eg334s-team2-vpn1-tunnel1 >/dev/null 2>&1; then
  "$STROKE" down eg334s-team2-vpn1-tunnel2 >/dev/null 2>&1 || true
  while ip route del 10.1.0.0/16 2>/dev/null; do :; done
  ip route add 10.1.0.0/16 dev vti1 metric 100
  printf '%s\n' primary > "$STATE_FILE"
  chmod 600 "$STATE_FILE"
  logger -t eg334s-vti-health "controlled failback to primary completed"
else
  logger -t eg334s-vti-health "primary failback failed; retaining secondary"
fi
systemctl start eg334s-vti-health.service