__VM100_HOST__
2026-07-10T12:51:22+00:00
1195.05 1184.95

__WG_PAID_RUNTIME__
wg_peer_count=5
wg_allowed_ip_count=5
KEYMASK	10.253.1.10/32
KEYMASK	10.253.1.11/32
KEYMASK	10.253.1.12/32
KEYMASK	10.253.1.13/32
KEYMASK	10.253.1.14/32
uci_peer_sections=0

__SELECTOR_AND_CONTROLLER__
selector_sha=2db1a0c46c1b93d9ede5f560d2d00db2dad3283adbc8f6ca6b0434ab695d8460
selector_rows=5
line_10=10.253.1.10 cs1 canary_vpn3
line_11=10.253.1.11 cs2 canary_vpn4
line_12=10.253.1.12 cs3 canary_vpn5
line_13=10.253.1.13 cs4 canary_vpn1
line_14=10.253.1.14 cs5 canary_vpn2
ctrl_is_v7=true
ctrl_enabled=true
ctrl_running=true
ctrl_conf_mode=MODE=--commit
state_exists=true
state_schema=schema=router-wgpay-egress-local-state-v2
state_rows=rows=5

__INITD_RELEVANT__
-rwxr-xr-x    1 root     root           429 Jul  9 13:55 router-egress-activity
-rwxr-xr-x    1 root     root           233 Jul  8 12:28 router-wgpay-canary
-rwxr-xr-x    1 root     root           333 Jul 10 11:59 router-wgpay-egress-local
### INIT /etc/init.d/router-wgpay-canary
#!/bin/sh /etc/rc.common

START=99
STOP=10

start() {
  KEYMASK-wgpay-canary-apply.sh start
}

stop() {
  KEYMASK-wgpay-canary-apply.sh stop
}

restart() {
  stop
  start
}

reload_service() {
  start
}
enabled=true
### INIT /etc/init.d/router-wgpay-egress-local
#!/bin/sh /etc/rc.common

START=99
STOP=10
USE_PROCD=1

PROG="KEYMASK-wgpay-egress-local-loop.sh"

start_service() {
  procd_open_instance
  procd_set_param command "$PROG"
  procd_set_param respawn 3600 5 5
  procd_set_param stdout 0
  procd_set_param stderr 0
  procd_close_instance
}

stop_service() {
  return 0
}
enabled=true
### INIT /etc/init.d/sysntpd
#!/bin/sh /etc/rc.common
# Copyright (C) 2011 OpenWrt.org

START=98

USE_PROCD=1
PROG=/usr/sbin/ntpd
HOTPLUG_KEYMASK-hotplug

get_dhcp_ntp_servers() {
	local interfaces="$1"
	local filter="*"
	local interface ntpservers ntpserver

	for interface in $interfaces; do
		[ "$filter" = "*" ] && filter="@.interface='$interface'" || filter="$filter,@.interface='$interface'"
	done

	ntpservers=$(ubus call network.interface dump | jsonfilter -e "@.interface[$filter]['data']['ntpserver']")

	for ntpserver in $ntpservers; do
		local duplicate=0
		local entry
		for entry in $server; do
			[ "$ntpserver" = "$entry" ] && duplicate=1
		done
		[ "$duplicate" = 0 ] && server="$server $ntpserver"
	done
}

validate_ntp_section() {
	uci_load_validate system timeserver "$1" "$2" \
		'dhcp_interface:list(string)' \
		'enable_server:bool:0' \
		'enabled:bool:1' \
		'interface:string' \
		'server:list(host)' \
		'use_dhcp:bool:1'
}

start_ntpd_instance() {
	local peer

	[ "$2" = 0 ] || {
		echo "validation failed"
		return 1
	}

	[ $enabled = 0 ] && return

	[ $use_dhcp = 1 ] && get_dhcp_ntp_servers "$dhcp_interface"

	[ -z "$server" -a "$enable_server" = "0" ] && return

	procd_open_instance
	procd_set_param command "$PROG" -n -N
	if [ "$enable_server" = "1" ]; then
		procd_append_param command -l
		[ -n "$interface" ] && {
			local ifname

			network_get_device ifname "$interface" || \
				ifname="$interface"
			procd_append_param command -I "$ifname"
			procd_append_param netdev "$ifname"
		}
	fi
	[ -x "$HOTPLUG_SCRIPT" ] && procd_append_param command -S "$HOTPLUG_SCRIPT"
	for peer in $server; do
		procd_append_param command -p $peer
	done
	procd_set_param respawn
	[ -x /sbin/ujail -a -e KEYMASK.json ] && {
		procd_add_jail ntpd ubus
		procd_add_jail_mount "$HOTPLUG_SCRIPT"
		procd_add_jail_mount "KEYMASK.sh"
		procd_add_jail_mount "/usr/bin/env"
		procd_add_jail_mount "/usr/bin/jshn"
		procd_add_jail_mount "/bin/ubus"
		procd_set_param capabilities KEYMASK.json
		procd_set_param user ntp
		procd_set_param group ntp
		procd_set_param no_new_privs 1
	}
	procd_close_instance
}

start_service() {
	. KEYMASK.sh
	validate_ntp_section ntp start_ntpd_instance
}

service_triggers() {
	local script name use_dhcp enable_server interface

	script=$(readlink -f "$initscript")
	name=$(basename ${script:-$initscript})

	procd_add_config_trigger "config.change" "system" /etc/init.d/$name reload

	config_load system
	config_get use_dhcp ntp use_dhcp 1

	[ $use_dhcp = 1 ] && {
		local dhcp_interface
		config_get dhcp_interface ntp dhcp_interface

		if [ -n "$dhcp_interface" ]; then
			for n in $dhcp_interface; do
				procd_add_interface_trigger "interface.*" $n /etc/init.d/$name reload
			done
		else
			procd_add_raw_trigger "interface.*" 1000 /etc/init.d/$name reload
		fi
	}

	config_get_bool enable_server ntp enable_server 0
	config_get interface ntp interface

	[ $enable_server -eq 1 ] && [ -n "$interface" ] && {
		local ifname

		network_get_device ifname "$interface" || \
			ifname="$interface"
		procd_add_interface_trigger "interface.*" "$ifname" \
			/etc/init.d/"$name" reload
	}

	procd_add_validation validate_ntp_section
}
enabled=true

__FILES_CONTAINING_WG_SET_OR_WG_PAID__
### FILE /etc/config/firewall

config defaults
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option synflood_protect '1'

config zone
	option name 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	list network 'lan'

config zone
	option name 'transit_direct'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'
	list network 'transit_direct'
	option masq '1'
	option mtu_fix '1'

config forwarding
	option src 'lan'
	option dest 'transit_direct'

config zone
	option name 'transit_vpn'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'
	list network 'transit_vpn'

config forwarding
	option src 'lan'
	option dest 'transit_vpn'

config zone
	option name 'remote_in'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	list network 'wg_remote'

config forwarding
	option src 'remote_in'
	option dest 'lan'

config forwarding
	option src 'remote_in'
	option dest 'transit_direct'

config forwarding
	option src 'remote_in'
	option dest 'transit_vpn'

config rule
	option src 'transit_direct'
	option name 'Allow-WG-Remote-In'
	list proto 'udp'
	list dest_ip '10.201.0.1'
	option dest_port '51820'
	option target 'ACCEPT'

config rule
	option name 'ALLOW_OWNER_DNS_VM100'
	option family 'ipv4'
	option src 'remote_in'
	option src_ip '10.250.1.3'
	option proto 'tcp udp'
	option dest_port '53'
	option target 'ACCEPT'

config rule
	option name 'ALLOW_OWNER_WGEASY_UI'
	option family 'ipv4'
	option src 'remote_in'
	option dest 'lan'
	option src_ip '10.250.1.3'
	option dest_ip '10.71.1.189'
	option proto 'tcp'
	option dest_port '51822'
	option target 'ACCEPT'

config rule
	option name 'BLOCK_OWNER_VM100_ROUTER'
	option family 'ipv4'
	option src 'remote_in'
	option src_ip '10.250.1.3'
	option proto 'all'
	option target 'REJECT'

config rule
	option name 'BLOCK_OWNER_VM101'
	option family 'ipv4'
	option src 'remote_in'
	option dest 'lan'
	option src_ip '10.250.1.3'
	option dest_ip '10.71.1.2'
	option proto 'all'
	option target 'REJECT'

config rule
	option name 'BLOCK_OWNER_PROXMOX'
	option family 'ipv4'
	option src 'remote_in'
	option dest 'lan'
	option src_ip '10.250.1.3'
	option dest_ip '10.71.1.222'
	option proto 'all'
	option target 'REJECT'

config rule
	option name 'BLOCK_OWNER_VM103_EXCEPT_UI'
	option family 'ipv4'
	option src 'remote_in'
	option dest 'lan'
	option src_ip '10.250.1.3'
	option dest_ip '10.71.1.189'
	option proto 'all'
	option target 'REJECT'

config zone 'wg_paid'
	option name 'wg_paid'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'
	list network 'wg_paid'

config forwarding 'wg_paid_to_transit_direct'
	option src 'wg_paid'
	option dest 'transit_direct'

config forwarding 'wg_paid_to_transit_vpn'
	option src 'wg_paid'
	option dest 'transit_vpn'

config rule 'allow_wg_paid_51830'
	option name 'Allow-WG-Paid-51830'
	option proto 'udp'
	option dest_port '51830'
	option target 'ACCEPT'

### FILE /etc/config/network

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option packet_steering '1'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'eth1'

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option ipaddr '10.71.100.1'
	option netmask '255.255.255.0'

config eth2 'device'

config static 'proto'

config 10.200.0.1 'ipaddr'

config interface 'transit_direct'
	option proto 'static'
	option device 'eth0'
	list ipaddr '10.201.0.1/24'
	option gateway '10.201.0.2'
	list dns '10.201.0.2'
	option metric '10'

config interface 'transit_vpn'
	option proto 'static'
	option device 'eth2'
	option ipaddr '10.200.0.1'
	option netmask '255.255.255.0'
	option gateway '10.200.0.2'
	option metric '20'

config interface 'wg_remote'
	option proto 'wireguard'
	option private_key 'KEYMASK'
	option listen_port '51820'
	list addresses '10.250.100.1/24'

config wireguard_wg_remote
	option description 'support-mgts'
	option public_key 'KEYMASK'
	option private_key 'KEYMASK'
	option allowed_ips '10.250.100.2/32'
	option route_allowed_ips '1'

config wireguard_wg_remote
	option description 'owner-mgts'
	option public_key 'KEYMASK'
	option private_key 'KEYMASK'
	option allowed_ips '10.250.100.3/32'
	option route_allowed_ips '1'

config wireguard_wg_remote
	option description 'router-ops-mgts'
	option public_key 'KEYMASK'
	option allowed_ips '10.250.100.4/32'
	option route_allowed_ips '1'

config interface 'wg_paid'
	option proto 'wireguard'
	option private_key 'KEYMASK'
	option listen_port '51830'
	list addresses '10.253.1.1/16'

config wireguard_wg_remote
	option description 'VM121 wg-access-dev direct admin'
	option public_key 'KEYMASK'
	list allowed_ips '10.250.100.121/32'
	option route_allowed_ips '1'

### FILE /etc/dropbear/authorized_keys
ssh-ed25519 KEYMASK pve-wg-paid-to-openwrt
ssh-ed25519 KEYMASK root@pve-wg-paid
ssh-ed25519 KEYMASK control-panel-mgts-vm105
ssh-ed25519 KEYMASK wg-access-agent@vm121

### FILE /etc/init.d/router-wgpay-canary
#!/bin/sh /etc/rc.common

START=99
STOP=10

start() {
  KEYMASK-wgpay-canary-apply.sh start
}

stop() {
  KEYMASK-wgpay-canary-apply.sh stop
}

restart() {
  stop
  start
}

reload_service() {
  start
}
### FILE /etc/init.d/router-wgpay-egress-local
#!/bin/sh /etc/rc.common

START=99
STOP=10
USE_PROCD=1

PROG="KEYMASK-wgpay-egress-local-loop.sh"

start_service() {
  procd_open_instance
  procd_set_param command "$PROG"
  procd_set_param respawn 3600 5 5
  procd_set_param stdout 0
  procd_set_param stderr 0
  procd_close_instance
}

stop_service() {
  return 0
}
### FILE /etc/rc.d/K10router-wgpay-canary
#!/bin/sh /etc/rc.common

START=99
STOP=10

start() {
  KEYMASK-wgpay-canary-apply.sh start
}

stop() {
  KEYMASK-wgpay-canary-apply.sh stop
}

restart() {
  stop
  start
}

reload_service() {
  start
}
### FILE /etc/rc.d/K10router-wgpay-egress-local
#!/bin/sh /etc/rc.common

START=99
STOP=10
USE_PROCD=1

PROG="KEYMASK-wgpay-egress-local-loop.sh"

start_service() {
  procd_open_instance
  procd_set_param command "$PROG"
  procd_set_param respawn 3600 5 5
  procd_set_param stdout 0
  procd_set_param stderr 0
  procd_close_instance
}

stop_service() {
  return 0
}
### FILE /etc/rc.d/S99router-wgpay-canary
#!/bin/sh /etc/rc.common

START=99
STOP=10

start() {
  KEYMASK-wgpay-canary-apply.sh start
}

stop() {
  KEYMASK-wgpay-canary-apply.sh stop
}

restart() {
  stop
  start
}

reload_service() {
  start
}
### FILE /etc/rc.d/S99router-wgpay-egress-local
#!/bin/sh /etc/rc.common

START=99
STOP=10
USE_PROCD=1

PROG="KEYMASK-wgpay-egress-local-loop.sh"

start_service() {
  procd_open_instance
  procd_set_param command "$PROG"
  procd_set_param respawn 3600 5 5
  procd_set_param stdout 0
  procd_set_param stderr 0
  procd_close_instance
}

stop_service() {
  return 0
}
### FILE /etc/router-egress-activity/router_egress_activity.nft
# Generated by STEP_044H5. Managed file; do not edit manually.
table inet router_egress_activity {
    counter peer_10_253_1_10_out_vpn { }
    counter peer_10_253_1_10_in_vpn { }
    counter peer_10_253_1_11_out_vpn { }
    counter peer_10_253_1_11_in_vpn { }
    counter peer_10_253_1_12_out_vpn { }
    counter peer_10_253_1_12_in_vpn { }
    counter peer_10_253_1_13_out_vpn { }
    counter peer_10_253_1_13_in_vpn { }
    counter peer_10_253_1_14_out_vpn { }
    counter peer_10_253_1_14_in_vpn { }

    chain forward_activity {
        type filter hook forward priority 0; policy accept;
        iifname "wg_paid" oifname "eth2" ip saddr 10.253.1.10/32 counter name peer_10_253_1_10_out_vpn comment "activity_out 10.253.1.10/32 cs1 cs1_vpn3"
        iifname "eth2" oifname "wg_paid" ip daddr 10.253.1.10/32 counter name peer_10_253_1_10_in_vpn comment "activity_in 10.253.1.10/32 cs1 cs1_vpn3"
        iifname "wg_paid" oifname "eth2" ip saddr 10.253.1.11/32 counter name peer_10_253_1_11_out_vpn comment "activity_out 10.253.1.11/32 cs2 cs2_vpn4"
        iifname "eth2" oifname "wg_paid" ip daddr 10.253.1.11/32 counter name peer_10_253_1_11_in_vpn comment "activity_in 10.253.1.11/32 cs2 cs2_vpn4"
        iifname "wg_paid" oifname "eth2" ip saddr 10.253.1.12/32 counter name peer_10_253_1_12_out_vpn comment "activity_out 10.253.1.12/32 cs3 cs3_vpn5"
        iifname "eth2" oifname "wg_paid" ip daddr 10.253.1.12/32 counter name peer_10_253_1_12_in_vpn comment "activity_in 10.253.1.12/32 cs3 cs3_vpn5"
        iifname "wg_paid" oifname "eth2" ip saddr 10.253.1.13/32 counter name peer_10_253_1_13_out_vpn comment "activity_out 10.253.1.13/32 cs4 cs4_vpn1"
        iifname "eth2" oifname "wg_paid" ip daddr 10.253.1.13/32 counter name peer_10_253_1_13_in_vpn comment "activity_in 10.253.1.13/32 cs4 cs4_vpn1"
        iifname "wg_paid" oifname "eth2" ip saddr 10.253.1.14/32 counter name peer_10_253_1_14_out_vpn comment "activity_out 10.253.1.14/32 cs5 cs5_vpn2"
        iifname "eth2" oifname "wg_paid" ip daddr 10.253.1.14/32 counter name peer_10_253_1_14_in_vpn comment "activity_in 10.253.1.14/32 cs5 cs5_vpn2"
    }
}
### FILE /etc/router-wgpay-egress-local.conf
MODE=--commit
INTERVAL=60
LOG=/var/log/router-wgpay-egress-local.log
KEYMASK-wgpay-egress-local.sh

ROUTER_EGRESS_ALLOCATOR_ENABLED=1
ROUTER_EGRESS_REBALANCE_PAUSED=0
ROUTER_EGRESS_FORCE_MODE=off
ROUTER_EGRESS_FORCE_CLASS=
ROUTER_EGRESS_FORCE_TARGET_ID=
ROUTER_EGRESS_FORCE_REASON=
ROUTER_EGRESS_FORCE_UNTIL=
ROUTER_EGRESS_ACTIVE_MIN_PACKETS=10
ROUTER_EGRESS_ACTIVE_MIN_BYTES=16384
ROUTER_EGRESS_IDLE_SECONDS=900
ROUTER_EGRESS_REASSIGN_COOLDOWN_SECONDS=900
### FILE /etc/services
echo		7/tcp
echo		7/udp
discard		9/tcp
discard		9/udp
daytime		13/tcp
daytime		13/udp
netstat		15/tcp
chargen		19/tcp
chargen		19/udp
ftp-data	20/tcp
ftp		21/tcp
ssh		22/tcp
ssh		22/udp
telnet		23/tcp
smtp		25/tcp
time		37/tcp
time		37/udp
whois		43/tcp
domain		53/tcp
domain		53/udp
bootps		67/tcp
bootps		67/udp
bootpc		68/tcp
bootpc		68/udp
tftp		69/udp
finger		79/tcp
www		80/tcp		http
kerberos	88/tcp		kerberos5 krb5 kerberos-sec
kerberos	88/udp		kerberos5 krb5 kerberos-sec
pop3		110/tcp
pop3		110/udp
sunrpc		111/tcp		rpcbind
sunrpc		111/udp		rpcbind
auth		113/tcp		ident
sftp		115/tcp
nntp		119/tcp
ntp		123/tcp
ntp		123/udp
netbios-ns	137/tcp
netbios-ns	137/udp
netbios-dgm	138/tcp
netbios-dgm	138/udp
netbios-ssn	139/tcp
netbios-ssn	139/udp
imap2		143/tcp		imap
imap2		143/udp		imap
snmp		161/tcp
snmp		161/udp
snmp-trap	162/tcp		snmptrap
snmp-trap	162/udp		snmptrap
xdmcp		177/tcp
xdmcp		177/udp
bgp		179/tcp
bgp		179/udp
imap3		220/tcp
imap3		220/udp
ldap		389/tcp
ldap		389/udp
https		443/tcp
https		443/udp
microsoft-ds	445/tcp
microsoft-ds	445/udp
isakmp		500/tcp
isakmp		500/udp
rtsp		554/tcp
rtsp		554/udp
ipp		631/tcp
ipp		631/udp
syslog		514/udp
printer		515/tcp		spooler
dhcpv6-client	546/tcp
dhcpv6-client	546/udp
dhcpv6-server	547/tcp
dhcpv6-server	547/udp
afpovertcp	548/tcp
afpovertcp	548/udp
nntps		563/tcp		snntp
nntps		563/udp		snntp
submission	587/tcp
submission	587/udp
ldaps		636/tcp
ldaps		636/udp
tinc		655/tcp
tinc		655/udp
rsync		873/tcp
rsync		873/udp
ftps-data	989/tcp
ftps		990/tcp
imaps		993/tcp
imaps		993/udp
ircs		994/tcp
ircs		994/udp
pop3s		995/tcp
pop3s		995/udp
socks		1080/tcp
socks		1080/udp
openvpn		1194/tcp
openvpn		1194/udp
l2f		1701/tcp	l2tp
l2f		1701/udp	l2tp
radius		1812/tcp
radius		1812/udp
radius-acct	1813/tcp	radacct
radius-acct	1813/udp	radacct
nfs		2049/tcp
nfs		2049/udp
dict		2628/tcp
dict		2628/udp
gpsd		2947/tcp
gpsd		2947/udp
icpv2		3130/tcp	icp
icpv2		3130/udp	icp
mysql		3306/tcp
mysql		3306/udp
nut		3493/tcp
nut		3493/udp
distcc		3632/tcp
distcc		3632/udp
daap		3689/tcp
daap		3689/udp
svn		3690/tcp	subversion
svn		3690/udp	subversion
epmd		4369/tcp
epmd		4369/udp
iax		4569/tcp
iax		4569/udp
mtn		4691/tcp
mtn		4691/udp
munin		4949/tcp
sip		5060/tcp
sip		5060/udp
sip-tls		5061/tcp
sip-tls		5061/udp
xmpp-client	5222/tcp	jabber-client
xmpp-client	5222/udp	jabber-client
xmpp-server	5269/tcp	jabber-server
xmpp-server	5269/udp	jabber-server
mdns		5353/tcp
mdns		5353/udp
postgresql	5432/tcp	postgres
postgresql	5432/udp	postgres
x11		6000/tcp
x11		6000/udp
mysql-proxy	6446/tcp
mysql-proxy	6446/udp
bacula-dir	9101/tcp
bacula-dir	9101/udp
bacula-fd	9102/tcp
bacula-fd	9102/udp
bacula-sd	9103/tcp
bacula-sd	9103/udp
nbd		10809/tcp
zabbix-agent	10050/tcp
zabbix-agent	10050/udp
zabbix-trapper	10051/tcp
zabbix-trapper	10051/udp
hkp		11371/tcp
hkp		11371/udp
ssmtp		465/tcp		smtps
spamd		783/tcp
zebrasrv	2600/tcp
zebra		2601/tcp
ripd		2602/tcp
ripngd		2603/tcp
ospfd		2604/tcp
bgpd		2605/tcp
ospf6d		2606/tcp
ospfapi		2607/tcp
isisd		2608/tcp
sane-port	6566/tcp	sane saned
ircd		6667/tcp
git		9418/tcp

### FILE /root/.ssh/authorized_keys
Generating public/private ed25519 key pair.
ssh-ed25519 KEYMASK control-panel-mgts-vm105
ssh-ed25519 KEYMASK wg-access-agent@vm121

### FILE /root/network.before-step041g-10.253.1.14-20260709-083540

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option packet_steering '1'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'eth1'

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option ipaddr '10.71.100.1'
	option netmask '255.255.255.0'

config eth2 'device'

config static 'proto'

config 10.200.0.1 'ipaddr'

config interface 'transit_direct'
	option proto 'static'
	option device 'eth0'
	list ipaddr '10.201.0.1/24'
	option gateway '10.201.0.2'
	list dns '10.201.0.2'
	option metric '10'

config interface 'transit_vpn'
	option proto 'static'
	option device 'eth2'
	option ipaddr '10.200.0.1'
	option netmask '255.255.255.0'
	option gateway '10.200.0.2'
	option metric '20'

config interface 'wg_remote'
	option proto 'wireguard'
	option private_key 'KEYMASK'
	option listen_port '51820'
	list addresses '10.250.100.1/24'

config wireguard_wg_remote
	option description 'support-mgts'
	option public_key 'KEYMASK'
	option private_key 'KEYMASK'
	option allowed_ips '10.250.100.2/32'
	option route_allowed_ips '1'

config wireguard_wg_remote
	option description 'owner-mgts'
	option public_key 'KEYMASK'
	option private_key 'KEYMASK'
	option allowed_ips '10.250.100.3/32'
	option route_allowed_ips '1'

config wireguard_wg_remote
	option description 'router-ops-mgts'
	option public_key 'KEYMASK'
	option allowed_ips '10.250.100.4/32'
	option route_allowed_ips '1'

config interface 'wg_paid'
	option proto 'wireguard'
	option private_key 'KEYMASK'
	option listen_port '51830'
	list addresses '10.253.1.1/16'

config wireguard_wg_remote
	option description 'VM121 wg-access-dev direct admin'
	option public_key 'KEYMASK'
	list allowed_ips '10.250.100.121/32'
	option route_allowed_ips '1'

### FILE /root/rollback-agent-selector-apply.sh
#!/bin/sh
set -u
cp "/root/peers.conf.before-agent-selector-apply-20260709-090038" "/etc/router-wgpay-selector.d/peers.conf"
/etc/init.d/router-wgpay-canary start
### FILE /root/rollback-step034m2-persistent-canary-vm100.sh
#!/bin/sh
set +e
/etc/init.d/router-wgpay-canary disable 2>/dev/null || true
/etc/init.d/router-wgpay-canary stop 2>/dev/null || true
rm -f /etc/init.d/router-wgpay-canary
rm -f KEYMASK-wgpay-canary-apply.sh
nft delete table inet wgpay_dscp_canary 2>/dev/null || true
echo "rollback_step034m2_vm100_done=1"
### FILE /root/rollback-step035b-vm100-selector-file.sh
#!/bin/sh
set +e
if [ -f "/root/router-ops-backups/step035b-vm100-selector-file-20260708-123837/router-wgpay-canary-apply.sh.before" ]; then
  cp -a "/root/router-ops-backups/step035b-vm100-selector-file-20260708-123837/router-wgpay-canary-apply.sh.before" "KEYMASK-wgpay-canary-apply.sh"
  chmod 755 "KEYMASK-wgpay-canary-apply.sh"
else
  rm -f "KEYMASK-wgpay-canary-apply.sh"
fi
if [ -f "/root/router-ops-backups/step035b-vm100-selector-file-20260708-123837/peers.conf.before" ]; then
  mkdir -p "/etc/router-wgpay-selector.d"
  cp -a "/root/router-ops-backups/step035b-vm100-selector-file-20260708-123837/peers.conf.before" "/etc/router-wgpay-selector.d/peers.conf"
else
  rm -f "/etc/router-wgpay-selector.d/peers.conf"
fi
/etc/init.d/router-wgpay-canary start 2>/dev/null || true
echo "rollback_step035b_vm100_done=1"
### FILE /root/rollback-step037b-cs2-selector-entry.sh
#!/bin/sh
set +e
cp -a "/root/router-ops-backups/step037b-add-cs2-selector-20260708-134547/peers.conf.before" "/etc/router-wgpay-selector.d/peers.conf"
/etc/init.d/router-wgpay-canary start 2>/dev/null || true
echo "rollback_step037b_cs2_selector_entry_done=1"
### FILE /root/rollback-step038b-cs3-selector-entry.sh
#!/bin/sh
set -u
cp '/root/peers.conf.before-step038b2-cs3-20260708-140837' '/etc/router-wgpay-selector.d/peers.conf'
/etc/init.d/router-wgpay-canary start
### FILE /root/rollback-step039d4-cs4-selector.sh
#!/bin/sh
set -u
cp '/root/peers.conf.before-step039d4-cs4-20260708-151230' '/etc/router-wgpay-selector.d/peers.conf'
/etc/init.d/router-wgpay-canary start
### FILE /root/rollback-step041m2-fixed-selector.sh
#!/bin/sh
set -u
cp "/root/peers.conf.before-step041m2-fixed-selector-20260709-094003" "/etc/router-wgpay-selector.d/peers.conf"
/etc/init.d/router-wgpay-canary start
echo "rollback_restored_KEYMASK.conf.before-step041m2-fixed-selector-20260709-094003"
### FILE /root/rollback-step044j3b-restore-wg-paid.sh
#!/bin/sh
set -eu
wg setconf wg_paid /root/step044j3b/wg_paid-before-20260709-141954.conf
echo restored wg_paid from /root/step044j3b/wg_paid-before-20260709-141954.conf
### FILE /root/rollback-step044p-restore-wg-paid.sh
#!/bin/sh
set -eu
wg setconf wg_paid /root/step044p/wg_paid-before-20260709-144640.conf
echo restored wg_paid from /root/step044p/wg_paid-before-20260709-144640.conf
### FILE /root/rollback-step046h-selector-20260710-073833.sh
#!/bin/sh
set -u
SEL="/etc/router-wgpay-selector.d/peers.conf"
APPLY="KEYMASK-wgpay-canary-apply.sh"
BACKUP="/root/step046h-selector-20260710-073833.backup"
if [ ! -f "$BACKUP" ]; then
  echo "rollback_backup_missing=$BACKUP" >&2
  exit 2
fi
cp "$BACKUP" "$SEL"
"$APPLY" start
echo "rollback_done selector_sha256=$(sha256sum "$SEL" 2>/dev/null | awk '{print $1}')"
### FILE /root/rollback-step046i3-selector-20260710-081054.sh
#!/bin/sh
set -u
SEL="/etc/router-wgpay-selector.d/peers.conf"
APPLY="KEYMASK-wgpay-canary-apply.sh"
BACKUP="/root/step046i3-selector-20260710-081054.backup"
if [ ! -f "$BACKUP" ]; then
  echo "rollback_backup_missing=$BACKUP" >&2
  exit 2
fi
cp "$BACKUP" "$SEL"
"$APPLY" start
echo "rollback_done selector_sha256=$(sha256sum "$SEL" 2>/dev/null | awk '{print $1}')"
### FILE /root/rollback-step046i5-selector-20260710-095841.sh
#!/bin/sh
set -u
SEL="/etc/router-wgpay-selector.d/peers.conf"
APPLY="KEYMASK-wgpay-canary-apply.sh"
BACKUP="/root/step046i5-selector-20260710-095841.backup"
CLIENT_PUB="KEYMASK"
wg set wg_paid peer "$CLIENT_PUB" remove 2>/dev/null || true
if [ -f "$BACKUP" ]; then
  cp "$BACKUP" "$SEL"
  "$APPLY" start
fi
echo "rollback_done selector_sha256=$(sha256sum "$SEL" 2>/dev/null | awk '{print $1}')"
### FILE /root/rollback-step046i5b-safety-20260710-100418.sh
#!/bin/sh
set -u
SEL="/etc/router-wgpay-selector.d/peers.conf"
APPLY="KEYMASK-wgpay-canary-apply.sh"
BACKUP="/root/step046i5b-safety-before-cleanup-20260710-100418.backup"
if [ -f "$BACKUP" ]; then
  cp "$BACKUP" "$SEL"
  "$APPLY" start
fi
echo "rollback_done selector_sha256=$(sha256sum "$SEL" 2>/dev/null | awk '{print $1}')"
### FILE /root/rollback-step046j-vm100-local-controller-20260710-100957.sh
#!/bin/sh
set -u
SCRIPT="KEYMASK-wgpay-egress-local.sh"
INIT="/etc/init.d/router-wgpay-egress-local"
SCRIPT_BAK=""
INIT_BAK=""

if [ -x "$INIT" ]; then
  "$INIT" stop 2>/dev/null || true
  "$INIT" disable 2>/dev/null || true
fi

if [ -n "$SCRIPT_BAK" ] && [ -f "$SCRIPT_BAK" ]; then
  cp "$SCRIPT_BAK" "$SCRIPT"
else
  rm -f "$SCRIPT"
fi

if [ -n "$INIT_BAK" ] && [ -f "$INIT_BAK" ]; then
  cp "$INIT_BAK" "$INIT"
  chmod 755 "$INIT"
else
  rm -f "$INIT"
fi

echo "rollback_done=true"
### FILE /root/rollback-step046k-vm100-controller-v2-20260710-101958.sh
#!/bin/sh
set -u
SCRIPT="KEYMASK-wgpay-egress-local.sh"
INIT="/etc/init.d/router-wgpay-egress-local"
SCRIPT_BAK="/root/step046k-backup-script-20260710-101958"
INIT_BAK="/root/step046k-backup-init-20260710-101958"
if [ -x "$INIT" ]; then
  "$INIT" stop 2>/dev/null || true
  "$INIT" disable 2>/dev/null || true
fi
if [ -f "$SCRIPT_BAK" ]; then
  cp "$SCRIPT_BAK" "$SCRIPT"
else
  rm -f "$SCRIPT"
fi
if [ -n "$INIT_BAK" ] && [ -f "$INIT_BAK" ]; then
  cp "$INIT_BAK" "$INIT"
fi
echo "rollback_done=true"
### FILE /root/rollback-step046l-vm100-controller-v3-20260710-104803.sh
#!/bin/sh
set -u
SCRIPT="KEYMASK-wgpay-egress-local.sh"
INIT="/etc/init.d/router-wgpay-egress-local"
SCRIPT_BAK="/root/step046l-backup-script-20260710-104803"
INIT_BAK="/root/step046l-backup-init-20260710-104803"
if [ -x "$INIT" ]; then
  "$INIT" stop 2>/dev/null || true
  "$INIT" disable 2>/dev/null || true
fi
if [ -f "$SCRIPT_BAK" ]; then
  cp "$SCRIPT_BAK" "$SCRIPT"
else
  rm -f "$SCRIPT"
fi
if [ -n "$INIT_BAK" ] && [ -f "$INIT_BAK" ]; then
  cp "$INIT_BAK" "$INIT"
fi
echo "rollback_done=true"
### FILE /root/rollback-step046m-selector-20260710-110137.sh
#!/bin/sh
set -u
SEL="/etc/router-wgpay-selector.d/peers.conf"
APPLY="KEYMASK-wgpay-canary-apply.sh"
BACKUP="/root/step046m-selector-20260710-110137.backup"
if [ -f "$BACKUP" ]; then
  cp "$BACKUP" "$SEL"
  "$APPLY" start
fi
echo "rollback_done selector_sha=$(sha256sum "$SEL" 2>/dev/null | awk '{print $1}')"
### FILE /root/rollback-step046n-vm100-controller-v4-20260710-110427.sh
#!/bin/sh
set -u
SCRIPT="KEYMASK-wgpay-egress-local.sh"
INIT="/etc/init.d/router-wgpay-egress-local"
SCRIPT_BAK="/root/step046n-backup-script-20260710-110427"
INIT_BAK="/root/step046n-backup-init-20260710-110427"
if [ -x "$INIT" ]; then
  "$INIT" stop 2>/dev/null || true
  "$INIT" disable 2>/dev/null || true
fi
if [ -f "$SCRIPT_BAK" ]; then
  cp "$SCRIPT_BAK" "$SCRIPT"
else
  rm -f "$SCRIPT"
fi
if [ -n "$INIT_BAK" ] && [ -f "$INIT_BAK" ]; then
  cp "$INIT_BAK" "$INIT"
fi
echo "rollback_done=true"
### FILE /root/rollback-step046o-vm100-controller-v5-20260710-113520.sh
#!/bin/sh
set -u
SCRIPT="KEYMASK-wgpay-egress-local.sh"
INIT="/etc/init.d/router-wgpay-egress-local"
SCRIPT_BAK="/root/step046o-backup-script-20260710-113520"
INIT_BAK="/root/step046o-backup-init-20260710-113520"
STATE_FILE="/var/lib/router-wgpay-egress/state.kv"
STATE_BAK="/root/step046o-state-20260710-113520.backup"
STATE_EXISTS_PRE="false"
if [ -x "$INIT" ]; then
  "$INIT" stop 2>/dev/null || true
  "$INIT" disable 2>/dev/null || true
fi
if [ -f "$SCRIPT_BAK" ]; then
  cp "$SCRIPT_BAK" "$SCRIPT"
else
  rm -f "$SCRIPT"
fi
if [ -n "$INIT_BAK" ] && [ -f "$INIT_BAK" ]; then
  cp "$INIT_BAK" "$INIT"
fi
if [ "$STATE_EXISTS_PRE" = "true" ] && [ -f "$STATE_BAK" ]; then
  mkdir -p "$(dirname "$STATE_FILE")"
  cp "$STATE_BAK" "$STATE_FILE"
else
  rm -f "$STATE_FILE"
fi
echo "rollback_done=true"
### FILE /root/rollback-step046p-service-wrapper-20260710-113810.sh
#!/bin/sh
set -u
INIT="/etc/init.d/router-wgpay-egress-local"
INIT_BAK="/root/step046p-backup-init-20260710-113810"
if [ -x "$INIT" ]; then
  "$INIT" stop 2>/dev/null || true
  "$INIT" disable 2>/dev/null || true
fi
if [ -f "$INIT_BAK" ]; then
  cp "$INIT_BAK" "$INIT"
else
  rm -f "$INIT"
fi
echo "rollback_done=true"
### FILE /root/rollback-step046q-full-commit-20260710-114450.sh
#!/bin/sh
set -u
SCRIPT="KEYMASK-wgpay-egress-local.sh"
INIT="/etc/init.d/router-wgpay-egress-local"
SEL="/etc/router-wgpay-selector.d/peers.conf"
APPLY="KEYMASK-wgpay-canary-apply.sh"
STATE_FILE="/var/lib/router-wgpay-egress/state.kv"
SCRIPT_BAK="/root/step046q-backup-script-20260710-114450"
INIT_BAK="/root/step046q-backup-init-20260710-114450"
SEL_BAK="/root/step046q-selector-20260710-114450.backup"
STATE_BAK="/root/step046q-state-20260710-114450.backup"
STATE_EXISTS_PRE="false"

[ -x "$INIT" ] && "$INIT" stop 2>/dev/null || true
[ -x "$INIT" ] && "$INIT" disable 2>/dev/null || true

[ -f "$SCRIPT_BAK" ] && cp "$SCRIPT_BAK" "$SCRIPT" || true
[ -f "$INIT_BAK" ] && cp "$INIT_BAK" "$INIT" || true

if [ -f "$SEL_BAK" ]; then
  cp "$SEL_BAK" "$SEL"
  [ -x "$APPLY" ] && "$APPLY" start || true
fi

if [ "$STATE_EXISTS_PRE" = "true" ] && [ -f "$STATE_BAK" ]; then
  mkdir -p "$(dirname "$STATE_FILE")"
  cp "$STATE_BAK" "$STATE_FILE"
else
  rm -f "$STATE_FILE"
fi

echo "rollback_done=true"
### FILE /root/rollback-step046r-periodic-dryrun-20260710-114749.sh
#!/bin/sh
set -u
INIT="/etc/init.d/router-wgpay-egress-local"
LOOP="KEYMASK-wgpay-egress-local-loop.sh"
INIT_BAK="/root/step046r-backup-init-20260710-114749"
LOOP_BAK="/root/step046r-backup-loop-20260710-114749"
STATE_FILE="/var/lib/router-wgpay-egress/state.kv"
STATE_EXISTS_PRE="false"
STATE_SHA_PRE="none"

[ -x "$INIT" ] && "$INIT" stop 2>/dev/null || true
[ -x "$INIT" ] && "$INIT" disable 2>/dev/null || true

if [ -f "$INIT_BAK" ]; then
  cp "$INIT_BAK" "$INIT"
fi

if [ -f "$LOOP_BAK" ]; then
  cp "$LOOP_BAK" "$LOOP"
else
  rm -f "$LOOP"
fi

if [ "$STATE_EXISTS_PRE" = "false" ]; then
  rm -f "$STATE_FILE"
fi

echo "rollback_done=true"
### FILE /root/rollback-step046s-periodic-commit-20260710-115423.sh
#!/bin/sh
set -u
INIT="/etc/init.d/router-wgpay-egress-local"
SEL="/etc/router-wgpay-selector.d/peers.conf"
APPLY="KEYMASK-wgpay-canary-apply.sh"
STATE_FILE="/var/lib/router-wgpay-egress/state.kv"
SEL_BAK="/root/step046s-selector-20260710-115423.backup"
STATE_BAK="/root/step046s-state-20260710-115423.backup"
STATE_EXISTS_PRE="false"

[ -x "$INIT" ] && "$INIT" stop 2>/dev/null || true

if [ -f "$SEL_BAK" ]; then
  cp "$SEL_BAK" "$SEL"
  [ -x "$APPLY" ] && "$APPLY" start || true
fi

if [ "$STATE_EXISTS_PRE" = "true" ] && [ -f "$STATE_BAK" ]; then
  mkdir -p "$(dirname "$STATE_FILE")"
  cp "$STATE_BAK" "$STATE_FILE"
else
  rm -f "$STATE_FILE"
fi

ROUTER_EGRESS_LOCAL_MODE="--dry-run" ROUTER_EGRESS_LOCAL_INTERVAL="30" "$INIT" enable 2>/dev/null || true
ROUTER_EGRESS_LOCAL_MODE="--dry-run" ROUTER_EGRESS_LOCAL_INTERVAL="30" "$INIT" start 2>/dev/null || true
echo "rollback_done=true"
### FILE /root/rollback-step046s2-periodic-commit-config-20260710-115918.sh
#!/bin/sh
set -u
SCRIPT="KEYMASK-wgpay-egress-local.sh"
LOOP="KEYMASK-wgpay-egress-local-loop.sh"
INIT="/etc/init.d/router-wgpay-egress-local"
CONF="/etc/router-wgpay-egress-local.conf"
SEL="/etc/router-wgpay-selector.d/peers.conf"
APPLY="KEYMASK-wgpay-canary-apply.sh"
STATE_FILE="/var/lib/router-wgpay-egress/state.kv"
LOOP_BAK="/root/step046s2-loop-20260710-115918.backup"
INIT_BAK="/root/step046s2-init-20260710-115918.backup"
CONF_BAK="/root/step046s2-conf-20260710-115918.backup"
SEL_BAK="/root/step046s2-selector-20260710-115918.backup"
STATE_BAK="/root/step046s2-state-20260710-115918.backup"
STATE_EXISTS_PRE="false"

[ -x "$INIT" ] && "$INIT" stop 2>/dev/null || true

[ -f "$LOOP_BAK" ] && cp "$LOOP_BAK" "$LOOP" || true
[ -f "$INIT_BAK" ] && cp "$INIT_BAK" "$INIT" || true
if [ -f "$CONF_BAK" ]; then
  cp "$CONF_BAK" "$CONF"
else
  cat > "$CONF" <<'EOC'
MODE=--dry-run
INTERVAL=30
LOG=/var/log/router-wgpay-egress-local.log
EOC
fi

if [ -f "$SEL_BAK" ]; then
  cp "$SEL_BAK" "$SEL"
  [ -x "$APPLY" ] && "$APPLY" start || true
fi

if [ "$STATE_EXISTS_PRE" = "true" ] && [ -f "$STATE_BAK" ]; then
  mkdir -p "$(dirname "$STATE_FILE")"
  cp "$STATE_BAK" "$STATE_FILE"
else
  rm -f "$STATE_FILE"
fi

[ -x "$INIT" ] && "$INIT" enable 2>/dev/null || true
[ -x "$INIT" ] && "$INIT" start 2>/dev/null || true
echo "rollback_done=true"
### FILE /root/rollback-step046t-commit-production-20260710-120316.sh
#!/bin/sh
set -u
LOOP="KEYMASK-wgpay-egress-local-loop.sh"
INIT="/etc/init.d/router-wgpay-egress-local"
CONF="/etc/router-wgpay-egress-local.conf"
SEL="/etc/router-wgpay-selector.d/peers.conf"
STATE_FILE="/var/lib/router-wgpay-egress/state.kv"
LOOP_BAK="/root/step046t-loop-20260710-120316.backup"
INIT_BAK="/root/step046t-init-20260710-120316.backup"
CONF_BAK="/root/step046t-conf-20260710-120316.backup"
SEL_BAK="/root/step046t-selector-20260710-120316.backup"
STATE_BAK="/root/step046t-state-20260710-120316.backup"
STATE_EXISTS_PRE="false"

[ -x "$INIT" ] && "$INIT" stop 2>/dev/null || true

[ -f "$LOOP_BAK" ] && cp "$LOOP_BAK" "$LOOP" || true
[ -f "$INIT_BAK" ] && cp "$INIT_BAK" "$INIT" || true

if [ -f "$CONF_BAK" ]; then
  cp "$CONF_BAK" "$CONF"
else
  cat > "$CONF" <<'EOC'
MODE=--dry-run
INTERVAL=30
LOG=/var/log/router-wgpay-egress-local.log
KEYMASK-wgpay-egress-local.sh
EOC
fi

[ -f "$SEL_BAK" ] && cp "$SEL_BAK" "$SEL" || true

if [ "$STATE_EXISTS_PRE" = "true" ] && [ -f "$STATE_BAK" ]; then
  mkdir -p "$(dirname "$STATE_FILE")"
  cp "$STATE_BAK" "$STATE_FILE"
else
  rm -f "$STATE_FILE"
fi

[ -x "$INIT" ] && "$INIT" enable 2>/dev/null || true
[ -x "$INIT" ] && "$INIT" start 2>/dev/null || true
echo "rollback_done=true"
### FILE /root/rollback-step047a-v7-stateful-20260710-121955.sh
#!/bin/sh
set -u
SCRIPT="KEYMASK-wgpay-egress-local.sh"
CONF="/etc/router-wgpay-egress-local.conf"
SEL="/etc/router-wgpay-selector.d/peers.conf"
APPLY="KEYMASK-wgpay-canary-apply.sh"
STATE_FILE="/var/lib/router-wgpay-egress/state.kv"
SCRIPT_BAK="/root/step047a-script-20260710-121955.backup"
CONF_BAK="/root/step047a-conf-20260710-121955.backup"
SEL_BAK="/root/step047a-selector-20260710-121955.backup"
STATE_BAK="/root/step047a-state-20260710-121955.backup"
STATE_EXISTS_PRE="false"
INIT="/etc/init.d/router-wgpay-egress-local"

[ -x "$INIT" ] && "$INIT" stop 2>/dev/null || true

[ -f "$SCRIPT_BAK" ] && cp "$SCRIPT_BAK" "$SCRIPT" || true
[ -f "$CONF_BAK" ] && cp "$CONF_BAK" "$CONF" || true
if [ -f "$SEL_BAK" ]; then
  cp "$SEL_BAK" "$SEL"
  [ -x "$APPLY" ] && "$APPLY" start || true
fi

if [ "$STATE_EXISTS_PRE" = "true" ] && [ -f "$STATE_BAK" ]; then
  mkdir -p "$(dirname "$STATE_FILE")"
  cp "$STATE_BAK" "$STATE_FILE"
else
  rm -f "$STATE_FILE"
fi

[ -x "$INIT" ] && "$INIT" enable 2>/dev/null || true
[ -x "$INIT" ] && "$INIT" start 2>/dev/null || true
echo "rollback_done=true"
### FILE /root/rollback-step047b-v7-active-pin-20260710-122531.sh
#!/bin/sh
set -u
INIT="/etc/init.d/router-wgpay-egress-local"
SEL="/etc/router-wgpay-selector.d/peers.conf"
APPLY="KEYMASK-wgpay-canary-apply.sh"
STATE_FILE="/var/lib/router-wgpay-egress/state.kv"
SEL_BAK="/root/step047b-selector-20260710-122531.backup"
STATE_BAK="/root/step047b-state-20260710-122531.backup"
STATE_EXISTS_PRE="true"

[ -x "$INIT" ] && "$INIT" stop 2>/dev/null || true

if [ -f "$SEL_BAK" ]; then
  cp "$SEL_BAK" "$SEL"
  [ -x "$APPLY" ] && "$APPLY" start || true
fi

if [ "$STATE_EXISTS_PRE" = "true" ] && [ -f "$STATE_BAK" ]; then
  mkdir -p "$(dirname "$STATE_FILE")"
  cp "$STATE_BAK" "$STATE_FILE"
else
  rm -f "$STATE_FILE"
fi

[ -x "$INIT" ] && "$INIT" enable 2>/dev/null || true
[ -x "$INIT" ] && "$INIT" start 2>/dev/null || true
echo "rollback_done=true"
### FILE /root/rollback-step047c-cooldown-20260710-123056.sh
#!/bin/sh
set -u
INIT="/etc/init.d/router-wgpay-egress-local"
SEL="/etc/router-wgpay-selector.d/peers.conf"
APPLY="KEYMASK-wgpay-canary-apply.sh"
STATE_FILE="/var/lib/router-wgpay-egress/state.kv"
SEL_BAK="/root/step047c-selector-20260710-123056.backup"
STATE_BAK="/root/step047c-state-20260710-123056.backup"
STATE_EXISTS_PRE="true"

[ -x "$INIT" ] && "$INIT" stop 2>/dev/null || true

if [ -f "$SEL_BAK" ]; then
  cp "$SEL_BAK" "$SEL"
  [ -x "$APPLY" ] && "$APPLY" start || true
fi

if [ "$STATE_EXISTS_PRE" = "true" ] && [ -f "$STATE_BAK" ]; then
  cp "$STATE_BAK" "$STATE_FILE"
else
  rm -f "$STATE_FILE"
fi

[ -x "$INIT" ] && "$INIT" enable 2>/dev/null || true
[ -x "$INIT" ] && "$INIT" start 2>/dev/null || true
echo "rollback_done=true"
### FILE /root/rollback-wgpaid-cs5-cleanup.sh
#!/bin/sh
set -eu
cp "/root/wgpaid-cs5-cleanup-20260709-085442/network.before" /etc/config/network
cp "/root/wgpaid-cs5-cleanup-20260709-085442/peers.conf.before" "/etc/router-wgpay-selector.d/peers.conf"
uci commit network
/etc/init.d/router-wgpay-canary start
echo "rollback_KEYMASK-cs5-cleanup-20260709-085442"
### FILE /root/router-ops-backups/step035b-vm100-selector-file-20260708-123837/router-wgpay-canary-apply.sh.before
#!/bin/sh
set -u

TUNNEL_IP="10.253.1.10"
TABLE="wgpay_dscp_canary"

case "${1:-start}" in
  start|restart|reload)
    wg show wg_paid dump 2>/dev/null | grep -F "$TUNNEL_IP/32" >/dev/null || {
      echo "BLOCK: tunnel_ip_not_in_wg_paid"
      exit 2
    }

    nft delete table inet "$TABLE" 2>/dev/null || true
    nft add table inet "$TABLE"
    nft add chain inet "$TABLE" prerouting '{ type filter hook prerouting priority mangle; policy accept; }'
    nft add rule inet "$TABLE" prerouting iifname "wg_paid" ip saddr "$TUNNEL_IP" ip dscp set cs1 counter comment "STEP_034M2_PERSIST_WGPAY_CANARY_DSCP_CS1"
    echo "applied_vm100_wgpay_dscp_canary=1"
    ;;

  stop)
    nft delete table inet "$TABLE" 2>/dev/null || true
    echo "stopped_vm100_wgpay_dscp_canary=1"
    ;;

  status)
    nft list table inet "$TABLE" 2>/dev/null
    ;;

  *)
    echo "usage: $0 {start|stop|restart|reload|status}"
    exit 1
    ;;
esac
### FILE /root/router-ops-backups/step035b-vm100-selector-file-20260708-123837/router-wgpay-canary.init.before
#!/bin/sh /etc/rc.common

START=99
STOP=10

start() {
  KEYMASK-wgpay-canary-apply.sh start
}

stop() {
  KEYMASK-wgpay-canary-apply.sh stop
}

restart() {
  stop
  start
}

reload_service() {
  start
}
### FILE /root/router-ops-backups/step037b-add-cs2-selector-20260708-134547/router-wgpay-canary-apply.sh.before
#!/bin/sh
set -u

SEL_FILE="/etc/router-wgpay-selector.d/peers.conf"
TABLE="wgpay_dscp_canary"

apply_rules() {
  [ -f "$SEL_FILE" ] || {
    echo "BLOCK: selector_file_missing"
    exit 2
  }

  nft delete table inet "$TABLE" 2>/dev/null || true
  nft add table inet "$TABLE"
  nft add chain inet "$TABLE" prerouting '{ type filter hook prerouting priority mangle; policy accept; }'

  count=0

  while read ip dscp comment rest; do
    case "${ip:-}" in
      ""|\#*) continue ;;
    esac

    case "${dscp:-}" in
      cs1|cs2|cs3|cs4|cs5|cs6|cs7|ef|af11|af12|af13|af21|af22|af23|af31|af32|af33|af41|af42|af43|be) ;;
      *)
        echo "BLOCK: unsupported_dscp_for_$ip=$dscp"
        exit 3
        ;;
    esac

    echo "$ip" | grep -E '^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$' >/dev/null || {
      echo "BLOCK: invalid_ip=$ip"
      exit 4
    }

    wg show wg_paid dump 2>/dev/null | grep -F "$ip/32" >/dev/null || {
      echo "BLOCK: selector_ip_not_in_wg_paid=$ip"
      exit 5
    }

    safe_comment="$(echo "${comment:-selector}" | tr -cd 'A-Za-z0-9_.:-' | cut -c1-40)"
    [ -n "$safe_comment" ] || safe_comment="selector"

    nft add rule inet "$TABLE" prerouting iifname "wg_paid" ip saddr "$ip" ip dscp set "$dscp" counter comment "STEP_035B_SELECTOR_WGPAY_${safe_comment}_${ip}_${dscp}"
    count=$((count + 1))
  done < "$SEL_FILE"

  [ "$count" -gt 0 ] || {
    echo "BLOCK: selector_file_no_active_entries"
    exit 6
  }

  echo "applied_vm100_wgpay_selector_rules=$count"
}

case "${1:-start}" in
  start|restart|reload)
    apply_rules
    ;;

  stop)
    nft delete table inet "$TABLE" 2>/dev/null || true
    echo "stopped_vm100_wgpay_selector=1"
    ;;

  status)
    nft list table inet "$TABLE" 2>/dev/null
    ;;

  *)
    echo "usage: $0 {start|stop|restart|reload|status}"
    exit 1
    ;;
esac
### FILE /root/router-ops-backups/step037b-add-cs2-selector-20260708-134547/wgpay_dscp_canary-before.nft
table inet wgpay_dscp_canary {
	chain prerouting {
		type filter hook prerouting priority mangle; policy accept;
		iifname "wg_paid" ip saddr 10.253.1.10 ip dscp set cs1 counter packets 12 bytes 1008 comment "STEP_035B_SELECTOR_WGPAY_canary_vpn3_10.253.1.10_cs1"
	}
}
### FILE /root/step046k-backup-init-20260710-101958
#!/bin/sh /etc/rc.common

START=98
STOP=10
USE_PROCD=1

NAME="router-wgpay-egress-local"
SCRIPT="KEYMASK-wgpay-egress-local.sh"

start_service() {
  procd_open_instance
  procd_set_param command "$SCRIPT" --dry-run
  procd_set_param stdout 1
  procd_set_param stderr 1
  procd_set_param respawn 3600 1 0
  procd_close_instance
}

stop_service() {
  return 0
}
### FILE /root/step046k-backup-script-20260710-101958
#!/bin/sh
set -u

MODE="${1:---dry-run}"
SEL="/etc/router-wgpay-selector.d/peers.conf"
APPLY="KEYMASK-wgpay-canary-apply.sh"
STATE_DIR="/var/lib/router-wgpay-egress"
STATE_FILE="${STATE_DIR}/state.kv"
LOCK="/var/run/router-wgpay-egress-local.lock"

SAMPLE_SECONDS="${ROUTER_EGRESS_SAMPLE_SECONDS:-3}"
IDLE_SECONDS="${ROUTER_EGRESS_IDLE_SECONDS:-900}"
ACTIVE_MIN_PACKETS="${ROUTER_EGRESS_ACTIVE_MIN_PACKETS:-10}"
ACTIVE_MIN_BYTES="${ROUTER_EGRESS_ACTIVE_MIN_BYTES:-16384}"
ALLOCATOR_ENABLED="${ROUTER_EGRESS_ALLOCATOR_ENABLED:-1}"
REBALANCE_PAUSED="${ROUTER_EGRESS_REBALANCE_PAUSED:-0}"
FORCE_MODE="${ROUTER_EGRESS_FORCE_MODE:-off}"
FORCE_CLASS="${ROUTER_EGRESS_FORCE_CLASS:-}"

TARGETS="cs1:canary_vpn3:vpn3 cs2:canary_vpn4:vpn4 cs3:canary_vpn5:vpn5 cs4:canary_vpn1:vpn1 cs5:canary_vpn2:vpn2"

json_escape() {
  sed 's/\\/\\\\/g; s/"/\\"/g'
}

class_to_target() {
  cls="$1"
  for spec in $TARGETS; do
    c="${spec%%:*}"
    rest="${spec#*:}"
    tag="${rest%%:*}"
    dev="${rest##*:}"
    if [ "$c" = "$cls" ]; then
      echo "$tag:$dev"
      return 0
    fi
  done
  echo ":"
  return 1
}

counter_snapshot() {
  ip="$1"
  nft list table inet router_egress_activity 2>/dev/null | awk -v safe_ip="$(echo "$ip" | sed 's/\./_/g')" '
    BEGIN { op=0; ob=0; ipk=0; ib=0 }
    $0 ~ "peer_" safe_ip "_out_vpn" {
      for (i=1; i<=NF; i++) {
        if ($i == "packets") op=$(i+1)
        if ($i == "bytes") ob=$(i+1)
      }
    }
    $0 ~ "peer_" safe_ip "_in_vpn" {
      for (i=1; i<=NF; i++) {
        if ($i == "packets") ipk=$(i+1)
        if ($i == "bytes") ib=$(i+1)
      }
    }
    END {
      print op " " ob " " ipk " " ib
    }
  '
}

emit_json() {
  printf '{\n'
  printf '  "schema": "router-wgpay-egress-local-v1",\n'
  printf '  "mode": "%s",\n' "$MODE"
  printf '  "host": "%s",\n' "$(hostname 2>/dev/null | json_escape)"
  printf '  "epoch": %s,\n' "$(date +%s)"
  printf '  "config": {\n'
  printf '    "sample_seconds": %s,\n' "$SAMPLE_SECONDS"
  printf '    "idle_seconds": %s,\n' "$IDLE_SECONDS"
  printf '    "active_min_packets": %s,\n' "$ACTIVE_MIN_PACKETS"
  printf '    "active_min_bytes": %s,\n' "$ACTIVE_MIN_BYTES"
  printf '    "allocator_enabled": "%s",\n' "$ALLOCATOR_ENABLED"
  printf '    "rebalance_paused": "%s",\n' "$REBALANCE_PAUSED"
  printf '    "force_mode": "%s",\n' "$FORCE_MODE"
  printf '    "force_class": "%s"\n' "$FORCE_CLASS"
  printf '  },\n'

  if [ ! -f "$SEL" ]; then
    printf '  "error": "selector_missing",\n'
    printf '  "rows": [],\n'
    printf '  "summary": {"rows": 0, "action_count": 0, "blocked": true, "noop": false}\n'
    printf '}\n'
    return 0
  fi

  blocked=false
  block_reason=""
  if [ "$ALLOCATOR_ENABLED" != "1" ]; then
    blocked=true
    block_reason="allocator_disabled"
  elif [ "$FORCE_MODE" != "off" ]; then
    blocked=true
    block_reason="force_mode_active"
  elif [ "$REBALANCE_PAUSED" != "0" ]; then
    blocked=true
    block_reason="rebalance_paused"
  fi

  printf '  "rows": [\n'

  total=0
  active=0
  idle=0
  first=1

  grep -Ev '^[[:space:]]*(#|$)' "$SEL" 2>/dev/null | while read -r ip cls tag extra; do
    [ -n "$ip" ] || continue

    set -- $(counter_snapshot "$ip")
    outp="${1:-0}"; outb="${2:-0}"; inp="${3:-0}"; inb="${4:-0}"
    totalp=$((outp + inp))
    totalb=$((outb + inb))

    is_active=false
    if [ "$totalp" -ge "$ACTIVE_MIN_PACKETS" ] || [ "$totalb" -ge "$ACTIVE_MIN_BYTES" ]; then
      is_active=true
    fi

    target="$(class_to_target "$cls" || true)"
    expected_tag="${target%%:*}"
    expected_dev="${target##*:}"

    if [ "$first" = "0" ]; then
      printf ',\n'
    fi
    first=0

    printf '    {'
    printf '"tunnel_ip":"%s",' "$ip"
    printf '"egress_class":"%s",' "$cls"
    printf '"target_id":"%s",' "$tag"
    printf '"expected_target_id":"%s",' "$expected_tag"
    printf '"expected_dev":"%s",' "$expected_dev"
    printf '"selector_target_match":%s,' "$([ "$tag" = "$expected_tag" ] && echo true || echo false)"
    printf '"out_packets":%s,' "$outp"
    printf '"out_bytes":%s,' "$outb"
    printf '"in_packets":%s,' "$inp"
    printf '"in_bytes":%s,' "$inb"
    printf '"total_packets":%s,' "$totalp"
    printf '"total_bytes":%s,' "$totalb"
    printf '"active_now":%s' "$is_active"
    printf '}'
  done

  printf '\n  ],\n'

  # Summary is computed with a second awk pass to avoid shell subshell mutation issues.
  summary="$(grep -Ev '^[[:space:]]*(#|$)' "$SEL" 2>/dev/null | awk '{print $1" "$2" "$3}' | while read -r ip cls tag; do
    [ -n "$ip" ] || continue
    set -- $(counter_snapshot "$ip")
    outp="${1:-0}"; outb="${2:-0}"; inp="${3:-0}"; inb="${4:-0}"
    totalp=$((outp + inp))
    totalb=$((outb + inb))
    if [ "$totalp" -ge "$ACTIVE_MIN_PACKETS" ] || [ "$totalb" -ge "$ACTIVE_MIN_BYTES" ]; then
      echo active
    else
      echo idle
    fi
  done | awk '
    BEGIN { rows=0; active=0; idle=0 }
    { rows++; if ($1=="active") active++; else idle++ }
    END { print rows " " active " " idle }
  ')"
  set -- $summary
  rows="${1:-0}"
  active_rows="${2:-0}"
  idle_rows="${3:-0}"

  action_count=0
  noop=true
  if [ "$blocked" = "true" ]; then
    noop=true
    action_count=0
  else
    # v1 dry-run policy: do not act if each class has exactly one row.
    # Future steps will add idle-only imbalance correction.
    action_count=0
### FILE /root/step046l-backup-init-20260710-104803
#!/bin/sh /etc/rc.common

START=98
STOP=10
USE_PROCD=1

NAME="router-wgpay-egress-local"
SCRIPT="KEYMASK-wgpay-egress-local.sh"

start_service() {
  procd_open_instance
  procd_set_param command "$SCRIPT" --dry-run
  procd_set_param stdout 1
  procd_set_param stderr 1
  procd_set_param respawn 3600 1 0
  procd_close_instance
}

stop_service() {
  return 0
}
### FILE /root/step046l-backup-script-20260710-104803
#!/bin/sh
set -u

MODE="${1:---dry-run}"
SEL="${ROUTER_EGRESS_SELECTOR_FILE:-/etc/router-wgpay-selector.d/peers.conf}"
SYN_ACTIVE_IPS="$(echo "${ROUTER_EGRESS_SYNTHETIC_ACTIVE_IPS:-}" | tr ',' ' ')"

ACTIVE_MIN_PACKETS="${ROUTER_EGRESS_ACTIVE_MIN_PACKETS:-10}"
ACTIVE_MIN_BYTES="${ROUTER_EGRESS_ACTIVE_MIN_BYTES:-16384}"
ALLOCATOR_ENABLED="${ROUTER_EGRESS_ALLOCATOR_ENABLED:-1}"
REBALANCE_PAUSED="${ROUTER_EGRESS_REBALANCE_PAUSED:-0}"
FORCE_MODE="${ROUTER_EGRESS_FORCE_MODE:-off}"

CLASSES="cs1 cs2 cs3 cs4 cs5"

target_for_class() {
  case "$1" in
    cs1) echo "canary_vpn3" ;;
    cs2) echo "canary_vpn4" ;;
    cs3) echo "canary_vpn5" ;;
    cs4) echo "canary_vpn1" ;;
    cs5) echo "canary_vpn2" ;;
    *) echo "" ;;
  esac
}

counter_snapshot() {
  ip="$1"
  safe_ip="$(echo "$ip" | tr '.' '_')"
  nft list table inet router_egress_activity 2>/dev/null | awk -v safe="$safe_ip" '
    BEGIN {op=0; ob=0; ipk=0; ib=0}
    $0 ~ "peer_" safe "_out_vpn" {
      for (i=1; i<=NF; i++) {
        if ($i=="packets") op=$(i+1)
        if ($i=="bytes") ob=$(i+1)
      }
    }
    $0 ~ "peer_" safe "_in_vpn" {
      for (i=1; i<=NF; i++) {
        if ($i=="packets") ipk=$(i+1)
        if ($i=="bytes") ib=$(i+1)
      }
    }
    END {print op, ob, ipk, ib}
  '
}

is_synthetic_active() {
  ip="$1"
  for a in $SYN_ACTIVE_IPS; do
    [ "$a" = "$ip" ] && return 0
  done
  return 1
}

if [ "$MODE" = "--apply" ]; then
  echo "ERROR: apply disabled in STEP_046K dry-run controller" >&2
  exit 78
fi

if [ "$MODE" != "--dry-run" ]; then
  echo "Usage: $0 --dry-run|--apply" >&2
  exit 64
fi

TMP="/tmp/router-wgpay-egress-local-rows.$$"
trap 'rm -f "$TMP"' EXIT
: > "$TMP"

grep -Ev '^[[:space:]]*(#|$)' "$SEL" 2>/dev/null | while read -r ip cls tag rest; do
  [ -n "$ip" ] || continue

  vals="$(counter_snapshot "$ip")"
  set -- $vals
  outp="${1:-0}"
  outb="${2:-0}"
  inp="${3:-0}"
  inb="${4:-0}"
  totalp=$((outp + inp))
  totalb=$((outb + inb))

  active_now=false
  if is_synthetic_active "$ip"; then
    active_now=true
  elif [ "$totalp" -ge "$ACTIVE_MIN_PACKETS" ] || [ "$totalb" -ge "$ACTIVE_MIN_BYTES" ]; then
    active_now=true
  fi

  printf '%s %s %s %s %s %s %s %s\n' "$ip" "$cls" "$tag" "$active_now" "$outp" "$inp" "$totalp" "$totalb" >> "$TMP"
done

blocked=false
block_reason=""
if [ "$ALLOCATOR_ENABLED" != "1" ]; then
  blocked=true
  block_reason="allocator_disabled"
elif [ "$FORCE_MODE" != "off" ]; then
  blocked=true
  block_reason="force_mode_active"
elif [ "$REBALANCE_PAUSED" != "0" ]; then
  blocked=true
  block_reason="rebalance_paused"
fi

rows="$(wc -l < "$TMP" | tr -d ' ')"
active_count="$(awk '$4=="true"{c++} END{print c+0}' "$TMP")"
idle_count="$(awk '$4!="true"{c++} END{print c+0}' "$TMP")"

min_class=""
max_class=""
min_count=999
max_count=-1

for cls in $CLASSES; do
  c="$(awk -v cls="$cls" '$2==cls{n++} END{print n+0}' "$TMP")"
  if [ "$c" -lt "$min_count" ]; then
    min_count="$c"
    min_class="$cls"
  fi
  if [ "$c" -gt "$max_count" ]; then
    max_count="$c"
    max_class="$cls"
  fi
done

action_count=0
action_ip=""
action_from_class=""
action_from_target=""
action_to_class=""
action_to_target=""
action_reason=""

if [ "$blocked" = "false" ]; then
  diff=$((max_count - min_count))
  if [ "$diff" -gt 1 ]; then
    movable="$(awk -v cls="$max_class" '$2==cls && $4!="true"{print; exit}' "$TMP")"
    if [ -n "$movable" ]; then
      set -- $movable
      action_ip="$1"
      action_from_class="$2"
      action_from_target="$3"
      action_to_class="$min_class"
      action_to_target="$(target_for_class "$min_class")"
      action_reason="idle_rebalance_most_loaded_to_least_loaded"
      action_count=1
    else
      action_reason="no_idle_peer_on_most_loaded_class"
    fi
  else
    action_reason="already_balanced"
  fi
else
  action_reason="$block_reason"
fi

noop=true
[ "$action_count" -gt 0 ] && noop=false

echo "{"
echo '  "schema": "router-wgpay-egress-local-v2",'
echo '  "mode": "dry-run",'
echo "  \"selector_file\": \"$SEL\","
echo "  \"synthetic_active_ips\": \"$SYN_ACTIVE_IPS\","
echo '  "rows": ['

first=1
while read -r ip cls tag active_now outp inp totalp totalb; do
  expected="$(target_for_class "$cls")"
  match=false
  [ "$tag" = "$expected" ] && match=true

  [ "$first" = "0" ] && echo ","
  first=0
  printf '    {"tunnel_ip":"%s","egress_class":"%s","target_id":"%s","expected_target_id":"%s","selector_target_match":%s,"out_packets":%s,"in_packets":%s,"total_packets":%s,"total_bytes":%s,"active_now":%s}' \
    "$ip" "$cls" "$tag" "$expected" "$match" "$outp" "$inp" "$totalp" "$totalb" "$active_now"
done < "$TMP"

echo
echo "  ],"
### FILE /root/step046n-backup-init-20260710-110427
#!/bin/sh /etc/rc.common

START=98
STOP=10
USE_PROCD=1

NAME="router-wgpay-egress-local"
SCRIPT="KEYMASK-wgpay-egress-local.sh"

start_service() {
  procd_open_instance
  procd_set_param command "$SCRIPT" --dry-run
  procd_set_param stdout 1
  procd_set_param stderr 1
  procd_set_param respawn 3600 1 0
  procd_close_instance
}

stop_service() {
  return 0
}
### FILE /root/step046n-backup-script-20260710-110427
#!/bin/sh
set -u

MODE="${1:---dry-run}"
SEL="${ROUTER_EGRESS_SELECTOR_FILE:-/etc/router-wgpay-selector.d/peers.conf}"
SYN_ACTIVE_IPS="$(echo "${ROUTER_EGRESS_SYNTHETIC_ACTIVE_IPS:-}" | tr ',' ' ')"

ACTIVE_MIN_PACKETS="${ROUTER_EGRESS_ACTIVE_MIN_PACKETS:-10}"
ACTIVE_MIN_BYTES="${ROUTER_EGRESS_ACTIVE_MIN_BYTES:-16384}"
ALLOCATOR_ENABLED="${ROUTER_EGRESS_ALLOCATOR_ENABLED:-1}"
REBALANCE_PAUSED="${ROUTER_EGRESS_REBALANCE_PAUSED:-0}"
FORCE_MODE="${ROUTER_EGRESS_FORCE_MODE:-off}"

CLASSES="cs1 cs2 cs3 cs4 cs5"

target_for_class() {
  case "$1" in
    cs1) echo "canary_vpn3" ;;
    cs2) echo "canary_vpn4" ;;
    cs3) echo "canary_vpn5" ;;
    cs4) echo "canary_vpn1" ;;
    cs5) echo "canary_vpn2" ;;
    *) echo "" ;;
  esac
}

counter_snapshot() {
  ip="$1"
  safe_ip="$(echo "$ip" | tr '.' '_')"
  nft list table inet router_egress_activity 2>/dev/null | awk -v safe="$safe_ip" '
    BEGIN {op=0; ob=0; ipk=0; ib=0}
    $0 ~ "peer_" safe "_out_vpn" {
      for (i=1; i<=NF; i++) {
        if ($i=="packets") op=$(i+1)
        if ($i=="bytes") ob=$(i+1)
      }
    }
    $0 ~ "peer_" safe "_in_vpn" {
      for (i=1; i<=NF; i++) {
        if ($i=="packets") ipk=$(i+1)
        if ($i=="bytes") ib=$(i+1)
      }
    }
    END {print op, ob, ipk, ib}
  '
}

is_synthetic_active() {
  ip="$1"
  for a in $SYN_ACTIVE_IPS; do
    [ "$a" = "$ip" ] && return 0
  done
  return 1
}

if [ "$MODE" = "--apply" ]; then
  echo "ERROR: real apply disabled in STEP_046L; use --apply-preview first" >&2
  exit 78
fi

if [ "$MODE" != "--dry-run" ] && [ "$MODE" != "--apply-preview" ]; then
  echo "Usage: $0 --dry-run|--apply-preview|--apply" >&2
  exit 64
fi

TMP="/tmp/router-wgpay-egress-local-rows.$$"
trap 'rm -f "$TMP"' EXIT
: > "$TMP"

grep -Ev '^[[:space:]]*(#|$)' "$SEL" 2>/dev/null | while read -r ip cls tag rest; do
  [ -n "$ip" ] || continue

  vals="$(counter_snapshot "$ip")"
  set -- $vals
  outp="${1:-0}"
  outb="${2:-0}"
  inp="${3:-0}"
  inb="${4:-0}"
  totalp=$((outp + inp))
  totalb=$((outb + inb))

  active_now=false
  if is_synthetic_active "$ip"; then
    active_now=true
  elif [ "$totalp" -ge "$ACTIVE_MIN_PACKETS" ] || [ "$totalb" -ge "$ACTIVE_MIN_BYTES" ]; then
    active_now=true
  fi

  printf '%s %s %s %s %s %s %s %s\n' "$ip" "$cls" "$tag" "$active_now" "$outp" "$inp" "$totalp" "$totalb" >> "$TMP"
done

blocked=false
block_reason=""
if [ "$ALLOCATOR_ENABLED" != "1" ]; then
  blocked=true
  block_reason="allocator_disabled"
elif [ "$FORCE_MODE" != "off" ]; then
  blocked=true
  block_reason="force_mode_active"
elif [ "$REBALANCE_PAUSED" != "0" ]; then
  blocked=true
  block_reason="rebalance_paused"
fi

rows="$(wc -l < "$TMP" | tr -d ' ')"
active_count="$(awk '$4=="true"{c++} END{print c+0}' "$TMP")"
idle_count="$(awk '$4!="true"{c++} END{print c+0}' "$TMP")"

min_class=""
max_class=""
min_count=999
max_count=-1

for cls in $CLASSES; do
  c="$(awk -v cls="$cls" '$2==cls{n++} END{print n+0}' "$TMP")"
  if [ "$c" -lt "$min_count" ]; then
    min_count="$c"
    min_class="$cls"
  fi
  if [ "$c" -gt "$max_count" ]; then
    max_count="$c"
    max_class="$cls"
  fi
done

action_count=0
action_ip=""
action_from_class=""
action_from_target=""
action_to_class=""
action_to_target=""
action_reason=""
proposed_selector_sha=""

if [ "$blocked" = "false" ]; then
  diff=$((max_count - min_count))
  if [ "$diff" -gt 1 ]; then
    movable="$(awk -v cls="$max_class" '$2==cls && $4!="true"{print; exit}' "$TMP")"
    if [ -n "$movable" ]; then
      set -- $movable
      action_ip="$1"
      action_from_class="$2"
      action_from_target="$3"
      action_to_class="$min_class"
      action_to_target="$(target_for_class "$min_class")"
      action_reason="idle_rebalance_most_loaded_to_least_loaded"
      action_count=1
    else
      action_reason="no_idle_peer_on_most_loaded_class"
    fi
  else
    action_reason="already_balanced"
  fi
else
  action_reason="$block_reason"
fi

noop=true
[ "$action_count" -gt 0 ] && noop=false

if [ "$MODE" = "--apply-preview" ] && [ "$action_count" -gt 0 ]; then
  proposed_selector_sha="$(
    awk -v ip="$action_ip" -v cls="$action_to_class" -v tag="$action_to_target" '
      $1 == ip { print ip " " cls " " tag; next }
      { print }
    ' "$SEL" 2>/dev/null | sha256sum | awk '{print $1}'
  )"
fi

selector_would_change=false
selector_apply_would_run=false
state_file_would_write=false
if [ "$MODE" = "--apply-preview" ] && [ "$action_count" -gt 0 ]; then
  selector_would_change=true
  selector_apply_would_run=true
  state_file_would_write=true
fi

echo "{"
echo '  "schema": "router-wgpay-egress-local-v3",'
### FILE /root/step046o-backup-init-20260710-113520
#!/bin/sh /etc/rc.common

START=98
STOP=10
USE_PROCD=1

NAME="router-wgpay-egress-local"
SCRIPT="KEYMASK-wgpay-egress-local.sh"

start_service() {
  procd_open_instance
  procd_set_param command "$SCRIPT" --dry-run
  procd_set_param stdout 1
  procd_set_param stderr 1
  procd_set_param respawn 3600 1 0
  procd_close_instance
}

stop_service() {
  return 0
}
### FILE /root/step046o-backup-script-20260710-113520
#!/bin/sh
set -u

MODE="${1:---dry-run}"
SEL="${ROUTER_EGRESS_SELECTOR_FILE:-/etc/router-wgpay-selector.d/peers.conf}"
STATE_DIR="${ROUTER_EGRESS_STATE_DIR:-/var/lib/router-wgpay-egress}"
STATE_FILE="${ROUTER_EGRESS_STATE_FILE:-${STATE_DIR}/state.kv}"
SYN_ACTIVE_IPS="$(echo "${ROUTER_EGRESS_SYNTHETIC_ACTIVE_IPS:-}" | tr ',' ' ')"

ACTIVE_MIN_PACKETS="${ROUTER_EGRESS_ACTIVE_MIN_PACKETS:-10}"
ACTIVE_MIN_BYTES="${ROUTER_EGRESS_ACTIVE_MIN_BYTES:-16384}"
ALLOCATOR_ENABLED="${ROUTER_EGRESS_ALLOCATOR_ENABLED:-1}"
REBALANCE_PAUSED="${ROUTER_EGRESS_REBALANCE_PAUSED:-0}"
FORCE_MODE="${ROUTER_EGRESS_FORCE_MODE:-off}"

CLASSES="cs1 cs2 cs3 cs4 cs5"

target_for_class() {
  case "$1" in
    cs1) echo "canary_vpn3" ;;
    cs2) echo "canary_vpn4" ;;
    cs3) echo "canary_vpn5" ;;
    cs4) echo "canary_vpn1" ;;
    cs5) echo "canary_vpn2" ;;
    *) echo "" ;;
  esac
}

counter_snapshot() {
  ip="$1"
  safe_ip="$(echo "$ip" | tr '.' '_')"
  nft list table inet router_egress_activity 2>/dev/null | awk -v safe="$safe_ip" '
    BEGIN {op=0; ob=0; ipk=0; ib=0}
    $0 ~ "peer_" safe "_out_vpn" {
      for (i=1; i<=NF; i++) {
        if ($i=="packets") op=$(i+1)
        if ($i=="bytes") ob=$(i+1)
      }
    }
    $0 ~ "peer_" safe "_in_vpn" {
      for (i=1; i<=NF; i++) {
        if ($i=="packets") ipk=$(i+1)
        if ($i=="bytes") ib=$(i+1)
      }
    }
    END {print op, ob, ipk, ib}
  '
}

is_synthetic_active() {
  ip="$1"
  for a in $SYN_ACTIVE_IPS; do
    [ "$a" = "$ip" ] && return 0
  done
  return 1
}

if [ "$MODE" = "--apply" ]; then
  echo "ERROR: real apply disabled in STEP_046N; state-preview only" >&2
  exit 78
fi

if [ "$MODE" != "--dry-run" ] && [ "$MODE" != "--apply-preview" ] && [ "$MODE" != "--state-preview" ]; then
  echo "Usage: $0 --dry-run|--apply-preview|--state-preview|--apply" >&2
  exit 64
fi

TMP="/tmp/router-wgpay-egress-local-rows.$$"
trap 'rm -f "$TMP"' EXIT
: > "$TMP"

grep -Ev '^[[:space:]]*(#|$)' "$SEL" 2>/dev/null | while read -r ip cls tag rest; do
  [ -n "$ip" ] || continue

  vals="$(counter_snapshot "$ip")"
  set -- $vals
  outp="${1:-0}"
  outb="${2:-0}"
  inp="${3:-0}"
  inb="${4:-0}"
  totalp=$((outp + inp))
  totalb=$((outb + inb))

  active_now=false
  if is_synthetic_active "$ip"; then
    active_now=true
  elif [ "$totalp" -ge "$ACTIVE_MIN_PACKETS" ] || [ "$totalb" -ge "$ACTIVE_MIN_BYTES" ]; then
    active_now=true
  fi

  printf '%s %s %s %s %s %s %s %s\n' "$ip" "$cls" "$tag" "$active_now" "$outp" "$inp" "$totalp" "$totalb" >> "$TMP"
done

blocked=false
block_reason=""
if [ "$ALLOCATOR_ENABLED" != "1" ]; then
  blocked=true
  block_reason="allocator_disabled"
elif [ "$FORCE_MODE" != "off" ]; then
  blocked=true
  block_reason="force_mode_active"
elif [ "$REBALANCE_PAUSED" != "0" ]; then
  blocked=true
  block_reason="rebalance_paused"
fi

rows="$(wc -l < "$TMP" | tr -d ' ')"
active_count="$(awk '$4=="true"{c++} END{print c+0}' "$TMP")"
idle_count="$(awk '$4!="true"{c++} END{print c+0}' "$TMP")"

min_class=""
max_class=""
min_count=999
max_count=-1

for cls in $CLASSES; do
  c="$(awk -v cls="$cls" '$2==cls{n++} END{print n+0}' "$TMP")"
  if [ "$c" -lt "$min_count" ]; then
    min_count="$c"
    min_class="$cls"
  fi
  if [ "$c" -gt "$max_count" ]; then
    max_count="$c"
    max_class="$cls"
  fi
done

action_count=0
action_ip=""
action_from_class=""
action_from_target=""
action_to_class=""
action_to_target=""
action_reason=""

if [ "$blocked" = "false" ]; then
  diff=$((max_count - min_count))
  if [ "$diff" -gt 1 ]; then
    movable="$(awk -v cls="$max_class" '$2==cls && $4!="true"{print; exit}' "$TMP")"
    if [ -n "$movable" ]; then
      set -- $movable
      action_ip="$1"
      action_from_class="$2"
      action_from_target="$3"
      action_to_class="$min_class"
      action_to_target="$(target_for_class "$min_class")"
      action_reason="idle_rebalance_most_loaded_to_least_loaded"
      action_count=1
    else
      action_reason="no_idle_peer_on_most_loaded_class"
    fi
  else
    action_reason="already_balanced"
  fi
else
  action_reason="$block_reason"
fi

noop=true
[ "$action_count" -gt 0 ] && noop=false

selector_would_change=false
selector_apply_would_run=false
state_file_would_write=false
if [ "$MODE" = "--apply-preview" ] || [ "$MODE" = "--state-preview" ]; then
  if [ "$action_count" -gt 0 ]; then
    selector_would_change=true
    selector_apply_would_run=true
    state_file_would_write=true
  fi
fi

state_preview_sha="$(
  {
    echo "schema=router-wgpay-egress-local-state-v1"
    echo "generated_epoch=$(date +%s)"
    echo "selector_file=$SEL"
    echo "mode=$MODE"
    echo "rows=$rows"
    echo "active_count=$active_count"
### FILE /root/step046p-backup-init-20260710-113810
#!/bin/sh /etc/rc.common

START=98
STOP=10
USE_PROCD=1

NAME="router-wgpay-egress-local"
SCRIPT="KEYMASK-wgpay-egress-local.sh"

start_service() {
  procd_open_instance
  procd_set_param command "$SCRIPT" --dry-run
  procd_set_param stdout 1
  procd_set_param stderr 1
  procd_set_param respawn 3600 1 0
  procd_close_instance
}

stop_service() {
  return 0
}
### FILE /root/step046q-backup-init-20260710-114450
#!/bin/sh /etc/rc.common

START=99
STOP=10

SCRIPT="KEYMASK-wgpay-egress-local.sh"
LOG="/var/log/router-wgpay-egress-local.log"
MODE="${ROUTER_EGRESS_LOCAL_SERVICE_MODE:---dry-run}"

start() {
  mkdir -p "$(dirname "$LOG")" 2>/dev/null || true
  {
    echo "__ROUTER_WGPAY_EGRESS_LOCAL_SERVICE_RUN_BEGIN__"
    echo "started_at=$(date -Is 2>/dev/null || date)"
    echo "mode=$MODE"
    echo "script=$SCRIPT"
    "$SCRIPT" "$MODE"
    rc=$?
    echo "service_run_rc=$rc"
    echo "finished_at=$(date -Is 2>/dev/null || date)"
    echo "__ROUTER_WGPAY_EGRESS_LOCAL_SERVICE_RUN_END__"
    exit "$rc"
  } >> "$LOG" 2>&1
}

stop() {
  return 0
}
### FILE /root/step046q-backup-script-20260710-114450
#!/bin/sh
set -u

MODE="${1:---dry-run}"
SEL="${ROUTER_EGRESS_SELECTOR_FILE:-/etc/router-wgpay-selector.d/peers.conf}"
STATE_DIR="${ROUTER_EGRESS_STATE_DIR:-/var/lib/router-wgpay-egress}"
STATE_FILE="${ROUTER_EGRESS_STATE_FILE:-${STATE_DIR}/state.kv}"
SYN_ACTIVE_IPS="$(echo "${ROUTER_EGRESS_SYNTHETIC_ACTIVE_IPS:-}" | tr ',' ' ')"

ACTIVE_MIN_PACKETS="${ROUTER_EGRESS_ACTIVE_MIN_PACKETS:-10}"
ACTIVE_MIN_BYTES="${ROUTER_EGRESS_ACTIVE_MIN_BYTES:-16384}"
ALLOCATOR_ENABLED="${ROUTER_EGRESS_ALLOCATOR_ENABLED:-1}"
REBALANCE_PAUSED="${ROUTER_EGRESS_REBALANCE_PAUSED:-0}"
FORCE_MODE="${ROUTER_EGRESS_FORCE_MODE:-off}"

CLASSES="cs1 cs2 cs3 cs4 cs5"

target_for_class() {
  case "$1" in
    cs1) echo "canary_vpn3" ;;
    cs2) echo "canary_vpn4" ;;
    cs3) echo "canary_vpn5" ;;
    cs4) echo "canary_vpn1" ;;
    cs5) echo "canary_vpn2" ;;
    *) echo "" ;;
  esac
}

counter_snapshot() {
  ip="$1"
  safe_ip="$(echo "$ip" | tr '.' '_')"
  nft list table inet router_egress_activity 2>/dev/null | awk -v safe="$safe_ip" '
    BEGIN {op=0; ob=0; ipk=0; ib=0}
    $0 ~ "peer_" safe "_out_vpn" {
      for (i=1; i<=NF; i++) {
        if ($i=="packets") op=$(i+1)
        if ($i=="bytes") ob=$(i+1)
      }
    }
    $0 ~ "peer_" safe "_in_vpn" {
      for (i=1; i<=NF; i++) {
        if ($i=="packets") ipk=$(i+1)
        if ($i=="bytes") ib=$(i+1)
      }
    }
    END {print op, ob, ipk, ib}
  '
}

is_synthetic_active() {
  ip="$1"
  for a in $SYN_ACTIVE_IPS; do
    [ "$a" = "$ip" ] && return 0
  done
  return 1
}

if [ "$MODE" = "--apply" ]; then
  echo "ERROR: real selector apply disabled in STEP_046O; this step only tests state write/restore" >&2
  exit 78
fi

if [ "$MODE" != "--dry-run" ] && [ "$MODE" != "--apply-preview" ] && [ "$MODE" != "--state-preview" ] && [ "$MODE" != "--state-write" ]; then
  echo "Usage: $0 --dry-run|--apply-preview|--state-preview|--state-write|--apply" >&2
  exit 64
fi

TMP="/tmp/router-wgpay-egress-local-rows.$$"
STATE_TMP="/tmp/router-wgpay-egress-local-state.$$"
trap 'rm -f "$TMP" "$STATE_TMP"' EXIT
: > "$TMP"

grep -Ev '^[[:space:]]*(#|$)' "$SEL" 2>/dev/null | while read -r ip cls tag rest; do
  [ -n "$ip" ] || continue

  vals="$(counter_snapshot "$ip")"
  set -- $vals
  outp="${1:-0}"
  outb="${2:-0}"
  inp="${3:-0}"
  inb="${4:-0}"
  totalp=$((outp + inp))
  totalb=$((outb + inb))

  active_now=false
  if is_synthetic_active "$ip"; then
    active_now=true
  elif [ "$totalp" -ge "$ACTIVE_MIN_PACKETS" ] || [ "$totalb" -ge "$ACTIVE_MIN_BYTES" ]; then
    active_now=true
  fi

  printf '%s %s %s %s %s %s %s %s\n' "$ip" "$cls" "$tag" "$active_now" "$outp" "$inp" "$totalp" "$totalb" >> "$TMP"
done

blocked=false
block_reason=""
if [ "$ALLOCATOR_ENABLED" != "1" ]; then
  blocked=true
  block_reason="allocator_disabled"
elif [ "$FORCE_MODE" != "off" ]; then
  blocked=true
  block_reason="force_mode_active"
elif [ "$REBALANCE_PAUSED" != "0" ]; then
  blocked=true
  block_reason="rebalance_paused"
fi

rows="$(wc -l < "$TMP" | tr -d ' ')"
active_count="$(awk '$4=="true"{c++} END{print c+0}' "$TMP")"
idle_count="$(awk '$4!="true"{c++} END{print c+0}' "$TMP")"

min_class=""
max_class=""
min_count=999
max_count=-1

for cls in $CLASSES; do
  c="$(awk -v cls="$cls" '$2==cls{n++} END{print n+0}' "$TMP")"
  if [ "$c" -lt "$min_count" ]; then
    min_count="$c"
    min_class="$cls"
  fi
  if [ "$c" -gt "$max_count" ]; then
    max_count="$c"
    max_class="$cls"
  fi
done

action_count=0
action_ip=""
action_from_class=""
action_from_target=""
action_to_class=""
action_to_target=""
action_reason=""

if [ "$blocked" = "false" ]; then
  diff=$((max_count - min_count))
  if [ "$diff" -gt 1 ]; then
    movable="$(awk -v cls="$max_class" '$2==cls && $4!="true"{print; exit}' "$TMP")"
    if [ -n "$movable" ]; then
      set -- $movable
      action_ip="$1"
      action_from_class="$2"
      action_from_target="$3"
      action_to_class="$min_class"
      action_to_target="$(target_for_class "$min_class")"
      action_reason="idle_rebalance_most_loaded_to_least_loaded"
      action_count=1
    else
      action_reason="no_idle_peer_on_most_loaded_class"
    fi
  else
    action_reason="already_balanced"
  fi
else
  action_reason="$block_reason"
fi

noop=true
[ "$action_count" -gt 0 ] && noop=false

selector_would_change=false
selector_apply_would_run=false
state_file_would_write=false
if [ "$MODE" = "--apply-preview" ] || [ "$MODE" = "--state-preview" ] || [ "$MODE" = "--state-write" ]; then
  if [ "$action_count" -gt 0 ]; then
    selector_would_change=true
    selector_apply_would_run=true
    state_file_would_write=true
  fi
fi

{
  echo "schema=router-wgpay-egress-local-state-v1"
  echo "generated_epoch=$(date +%s)"
  echo "selector_file=$SEL"
  echo "state_file=$STATE_FILE"
  echo "mode=$MODE"
  echo "rows=$rows"
### FILE /root/step046r-backup-init-20260710-114749
#!/bin/sh /etc/rc.common

START=99
STOP=10

SCRIPT="KEYMASK-wgpay-egress-local.sh"
LOG="/var/log/router-wgpay-egress-local.log"
MODE="${ROUTER_EGRESS_LOCAL_SERVICE_MODE:---dry-run}"

start() {
  mkdir -p "$(dirname "$LOG")" 2>/dev/null || true
  {
    echo "__ROUTER_WGPAY_EGRESS_LOCAL_SERVICE_RUN_BEGIN__"
    echo "started_at=$(date -Is 2>/dev/null || date)"
    echo "mode=$MODE"
    echo "script=$SCRIPT"
    "$SCRIPT" "$MODE"
    rc=$?
    echo "service_run_rc=$rc"
    echo "finished_at=$(date -Is 2>/dev/null || date)"
    echo "__ROUTER_WGPAY_EGRESS_LOCAL_SERVICE_RUN_END__"
    exit "$rc"
  } >> "$LOG" 2>&1
}

stop() {
  return 0
}
### FILE /root/step046s2-init-20260710-115918.backup
#!/bin/sh /etc/rc.common

START=99
STOP=10
USE_PROCD=1

PROG="KEYMASK-wgpay-egress-local-loop.sh"
LOG="/var/log/router-wgpay-egress-local.log"

start_service() {
  procd_open_instance
  procd_set_param command "$PROG"
  procd_set_param env ROUTER_EGRESS_LOCAL_MODE="${ROUTER_EGRESS_LOCAL_MODE:---dry-run}"
  procd_set_param env ROUTER_EGRESS_LOCAL_INTERVAL="${ROUTER_EGRESS_LOCAL_INTERVAL:-30}"
  procd_set_param env ROUTER_EGRESS_LOCAL_LOG="$LOG"
  procd_set_param respawn 3600 5 5
  procd_set_param stdout 0
  procd_set_param stderr 0
  procd_close_instance
}

stop_service() {
  return 0
}
### FILE /root/step046s2-loop-20260710-115918.backup
#!/bin/sh
set -u

SCRIPT="${ROUTER_EGRESS_LOCAL_SCRIPT:-KEYMASK-wgpay-egress-local.sh}"
LOG="${ROUTER_EGRESS_LOCAL_LOG:-/var/log/router-wgpay-egress-local.log}"
MODE="${ROUTER_EGRESS_LOCAL_MODE:---dry-run}"
INTERVAL="${ROUTER_EGRESS_LOCAL_INTERVAL:-30}"

mkdir -p "$(dirname "$LOG")" 2>/dev/null || true

echo "__ROUTER_WGPAY_EGRESS_LOCAL_LOOP_BEGIN__ pid=$$ mode=$MODE interval=$INTERVAL started_at=$(date -Is 2>/dev/null || date)" >> "$LOG"

while true; do
  {
    echo "__ROUTER_WGPAY_EGRESS_LOCAL_RUN_BEGIN__"
    echo "run_started_at=$(date -Is 2>/dev/null || date)"
    echo "mode=$MODE"
    echo "script=$SCRIPT"
    "$SCRIPT" "$MODE"
    rc=$?
    echo "run_rc=$rc"
    echo "run_finished_at=$(date -Is 2>/dev/null || date)"
    echo "__ROUTER_WGPAY_EGRESS_LOCAL_RUN_END__"
  } >> "$LOG" 2>&1

  sleep "$INTERVAL"
done
### FILE /root/step046t-conf-20260710-120316.backup
MODE=--dry-run
INTERVAL=30
LOG=/var/log/router-wgpay-egress-local.log
KEYMASK-wgpay-egress-local.sh
### FILE /root/step046t-init-20260710-120316.backup
#!/bin/sh /etc/rc.common

START=99
STOP=10
USE_PROCD=1

PROG="KEYMASK-wgpay-egress-local-loop.sh"

start_service() {
  procd_open_instance
  procd_set_param command "$PROG"
  procd_set_param respawn 3600 5 5
  procd_set_param stdout 0
  procd_set_param stderr 0
  procd_close_instance
}

stop_service() {
  return 0
}
### FILE /root/step046t-loop-20260710-120316.backup
#!/bin/sh
set -u

CONF="${ROUTER_EGRESS_LOCAL_CONF:-/etc/router-wgpay-egress-local.conf}"

MODE="--dry-run"
INTERVAL="30"
LOG="/var/log/router-wgpay-egress-local.log"
SCRIPT="KEYMASK-wgpay-egress-local.sh"

if [ -f "$CONF" ]; then
  # shellcheck disable=SC1090
  . "$CONF"
fi

: "${MODE:=--dry-run}"
: "${INTERVAL:=30}"
: "${LOG:=/var/log/router-wgpay-egress-local.log}"
: "${SCRIPT:KEYMASK-wgpay-egress-local.sh}"

mkdir -p "$(dirname "$LOG")" 2>/dev/null || true

echo "__ROUTER_WGPAY_EGRESS_LOCAL_LOOP_BEGIN__ pid=$$ conf=$CONF mode=$MODE interval=$INTERVAL started_at=$(date -Is 2>/dev/null || date)" >> "$LOG"

while true; do
  {
    echo "__ROUTER_WGPAY_EGRESS_LOCAL_RUN_BEGIN__"
    echo "run_started_at=$(date -Is 2>/dev/null || date)"
    echo "conf=$CONF"
    echo "mode=$MODE"
    echo "script=$SCRIPT"
    "$SCRIPT" "$MODE"
    rc=$?
    echo "run_rc=$rc"
    echo "run_finished_at=$(date -Is 2>/dev/null || date)"
    echo "__ROUTER_WGPAY_EGRESS_LOCAL_RUN_END__"
  } >> "$LOG" 2>&1

  sleep "$INTERVAL"
done
### FILE /root/step047a-conf-20260710-121955.backup
MODE=--commit
INTERVAL=60
LOG=/var/log/router-wgpay-egress-local.log
KEYMASK-wgpay-egress-local.sh

ROUTER_EGRESS_ALLOCATOR_ENABLED=1
ROUTER_EGRESS_REBALANCE_PAUSED=0
ROUTER_EGRESS_FORCE_MODE=off
ROUTER_EGRESS_FORCE_CLASS=
ROUTER_EGRESS_FORCE_TARGET_ID=
ROUTER_EGRESS_FORCE_REASON=
ROUTER_EGRESS_FORCE_UNTIL=
ROUTER_EGRESS_ACTIVE_MIN_PACKETS=10
ROUTER_EGRESS_ACTIVE_MIN_BYTES=16384
### FILE /root/step047a-script-20260710-121955.backup
#!/bin/sh
set -u

MODE="${1:---dry-run}"
SEL="${ROUTER_EGRESS_SELECTOR_FILE:-/etc/router-wgpay-selector.d/peers.conf}"
APPLY="${ROUTER_EGRESS_SELECTOR_APPLY:-KEYMASK-wgpay-canary-apply.sh}"
STATE_DIR="${ROUTER_EGRESS_STATE_DIR:-/var/lib/router-wgpay-egress}"
STATE_FILE="${ROUTER_EGRESS_STATE_FILE:-${STATE_DIR}/state.kv}"
SYN_ACTIVE_IPS="$(echo "${ROUTER_EGRESS_SYNTHETIC_ACTIVE_IPS:-}" | tr ',' ' ')"

ACTIVE_MIN_PACKETS="${ROUTER_EGRESS_ACTIVE_MIN_PACKETS:-10}"
ACTIVE_MIN_BYTES="${ROUTER_EGRESS_ACTIVE_MIN_BYTES:-16384}"
ALLOCATOR_ENABLED="${ROUTER_EGRESS_ALLOCATOR_ENABLED:-1}"
REBALANCE_PAUSED="${ROUTER_EGRESS_REBALANCE_PAUSED:-0}"
FORCE_MODE="${ROUTER_EGRESS_FORCE_MODE:-off}"

CLASSES="cs1 cs2 cs3 cs4 cs5"

target_for_class() {
  case "$1" in
    cs1) echo "canary_vpn3" ;;
    cs2) echo "canary_vpn4" ;;
    cs3) echo "canary_vpn5" ;;
    cs4) echo "canary_vpn1" ;;
    cs5) echo "canary_vpn2" ;;
    *) echo "" ;;
  esac
}

counter_snapshot() {
  ip="$1"
  safe_ip="$(echo "$ip" | tr '.' '_')"
  nft list table inet router_egress_activity 2>/dev/null | awk -v safe="$safe_ip" '
    BEGIN {op=0; ob=0; ipk=0; ib=0}
    $0 ~ "peer_" safe "_out_vpn" {
      for (i=1; i<=NF; i++) {
        if ($i=="packets") op=$(i+1)
        if ($i=="bytes") ob=$(i+1)
      }
    }
    $0 ~ "peer_" safe "_in_vpn" {
      for (i=1; i<=NF; i++) {
        if ($i=="packets") ipk=$(i+1)
        if ($i=="bytes") ib=$(i+1)
      }
    }
    END {print op, ob, ipk, ib}
  '
}

is_synthetic_active() {
  ip="$1"
  for a in $SYN_ACTIVE_IPS; do
    [ "$a" = "$ip" ] && return 0
  done
  return 1
}

json_bool() {
  [ "$1" = "true" ] && echo true || echo false
}

if [ "$MODE" != "--dry-run" ] && [ "$MODE" != "--apply-preview" ] && [ "$MODE" != "--state-preview" ] && [ "$MODE" != "--state-write" ] && [ "$MODE" != "--commit" ]; then
  echo "Usage: $0 --dry-run|--apply-preview|--state-preview|--state-write|--commit" >&2
  exit 64
fi

TMP="/tmp/router-wgpay-egress-local-rows.$$"
STATE_TMP="/tmp/router-wgpay-egress-local-state.$$"
SEL_TMP="/tmp/router-wgpay-egress-local-selector.$$"
APPLY_LOG="/tmp/router-wgpay-egress-local-apply.$$.log"
trap 'rm -f "$TMP" "$STATE_TMP" "$SEL_TMP" "$APPLY_LOG" "${STATE_FILE}.tmp.$$"' EXIT
: > "$TMP"

grep -Ev '^[[:space:]]*(#|$)' "$SEL" 2>/dev/null | while read -r ip cls tag rest; do
  [ -n "$ip" ] || continue

  vals="$(counter_snapshot "$ip")"
  set -- $vals
  outp="${1:-0}"
  outb="${2:-0}"
  inp="${3:-0}"
  inb="${4:-0}"
  totalp=$((outp + inp))
  totalb=$((outb + inb))

  active_now=false
  if is_synthetic_active "$ip"; then
    active_now=true
  elif [ "$totalp" -ge "$ACTIVE_MIN_PACKETS" ] || [ "$totalb" -ge "$ACTIVE_MIN_BYTES" ]; then
    active_now=true
  fi

  printf '%s %s %s %s %s %s %s %s\n' "$ip" "$cls" "$tag" "$active_now" "$outp" "$inp" "$totalp" "$totalb" >> "$TMP"
done

blocked=false
block_reason=""
if [ "$ALLOCATOR_ENABLED" != "1" ]; then
  blocked=true
  block_reason="allocator_disabled"
elif [ "$FORCE_MODE" != "off" ]; then
  blocked=true
  block_reason="force_mode_active"
elif [ "$REBALANCE_PAUSED" != "0" ]; then
  blocked=true
  block_reason="rebalance_paused"
fi

rows="$(wc -l < "$TMP" | tr -d ' ')"
active_count="$(awk '$4=="true"{c++} END{print c+0}' "$TMP")"
idle_count="$(awk '$4!="true"{c++} END{print c+0}' "$TMP")"

min_class=""
max_class=""
min_count=999
max_count=-1

for cls in $CLASSES; do
  c="$(awk -v cls="$cls" '$2==cls{n++} END{print n+0}' "$TMP")"
  if [ "$c" -lt "$min_count" ]; then
    min_count="$c"
    min_class="$cls"
  fi
  if [ "$c" -gt "$max_count" ]; then
    max_count="$c"
    max_class="$cls"
  fi
done

action_count=0
action_ip=""
action_from_class=""
action_from_target=""
action_to_class=""
action_to_target=""
action_reason=""

if [ "$blocked" = "false" ]; then
  diff=$((max_count - min_count))
  if [ "$diff" -gt 1 ]; then
    movable="$(awk -v cls="$max_class" '$2==cls && $4!="true"{print; exit}' "$TMP")"
    if [ -n "$movable" ]; then
      set -- $movable
      action_ip="$1"
      action_from_class="$2"
      action_from_target="$3"
      action_to_class="$min_class"
      action_to_target="$(target_for_class "$min_class")"
      action_reason="idle_rebalance_most_loaded_to_least_loaded"
      action_count=1
    else
      action_reason="no_idle_peer_on_most_loaded_class"
    fi
  else
    action_reason="already_balanced"
  fi
else
  action_reason="$block_reason"
fi

noop=true
[ "$action_count" -gt 0 ] && noop=false

selector_would_change=false
selector_apply_would_run=false
state_file_would_write=false
if [ "$MODE" = "--apply-preview" ] || [ "$MODE" = "--state-preview" ] || [ "$MODE" = "--state-write" ] || [ "$MODE" = "--commit" ]; then
  if [ "$action_count" -gt 0 ]; then
    selector_would_change=true
    selector_apply_would_run=true
    state_file_would_write=true
  fi
fi

{
  echo "schema=router-wgpay-egress-local-state-v1"
  echo "generated_epoch=$(date +%s)"
  echo "selector_file=$SEL"
  echo "state_file=$STATE_FILE"
### FILE /root/step047b-state-20260710-122531.backup
schema=router-wgpay-egress-local-state-v2
generated_epoch=1783686298
selector_file=/etc/router-wgpay-selector.d/peers.conf
state_KEYMASK-wgpay-egress/state.kv
mode=--commit
rows=5
active_now_count=0
active_state_count=0
idle_count=5
idle_seconds=900
reassign_cooldown_seconds=900
active_min_packets=10
active_min_bytes=16384
min_class=cs1
min_count=1
max_class=cs1
max_count=1
blocked=false
block_reason=
action_count=0
action_ip=
action_from_class=
action_from_target=
action_to_class=
action_to_target=
action_reason=already_balanced
selector_would_change=false
selector_apply_would_run=false
state_file_would_write=true
peer.10.253.1.10.class=cs1
peer.10.253.1.10.target=canary_vpn3
peer.10.253.1.10.active_now=false
peer.10.253.1.10.active_state=false
peer.10.253.1.10.cooldown_ok=true
peer.10.253.1.10.out_packets=0
peer.10.253.1.10.out_bytes=0
peer.10.253.1.10.in_packets=0
peer.10.253.1.10.in_bytes=0
peer.10.253.1.10.delta_packets=0
peer.10.253.1.10.delta_bytes=0
peer.10.253.1.10.last_active_epoch=0
peer.10.253.1.10.last_reassign_epoch=0
peer.10.253.1.11.class=cs2
peer.10.253.1.11.target=canary_vpn4
peer.10.253.1.11.active_now=false
peer.10.253.1.11.active_state=false
peer.10.253.1.11.cooldown_ok=true
peer.10.253.1.11.out_packets=0
peer.10.253.1.11.out_bytes=0
peer.10.253.1.11.in_packets=0
peer.10.253.1.11.in_bytes=0
peer.10.253.1.11.delta_packets=0
peer.10.253.1.11.delta_bytes=0
peer.10.253.1.11.last_active_epoch=0
peer.10.253.1.11.last_reassign_epoch=0
peer.10.253.1.12.class=cs3
peer.10.253.1.12.target=canary_vpn5
peer.10.253.1.12.active_now=false
peer.10.253.1.12.active_state=false
peer.10.253.1.12.cooldown_ok=true
peer.10.253.1.12.out_packets=0
peer.10.253.1.12.out_bytes=0
peer.10.253.1.12.in_packets=0
peer.10.253.1.12.in_bytes=0
peer.10.253.1.12.delta_packets=0
peer.10.253.1.12.delta_bytes=0
peer.10.253.1.12.last_active_epoch=0
peer.10.253.1.12.last_reassign_epoch=0
peer.10.253.1.13.class=cs4
peer.10.253.1.13.target=canary_vpn1
peer.10.253.1.13.active_now=false
peer.10.253.1.13.active_state=false
peer.10.253.1.13.cooldown_ok=true
peer.10.253.1.13.out_packets=0
peer.10.253.1.13.out_bytes=0
peer.10.253.1.13.in_packets=0
peer.10.253.1.13.in_bytes=0
peer.10.253.1.13.delta_packets=0
peer.10.253.1.13.delta_bytes=0
peer.10.253.1.13.last_active_epoch=0
peer.10.253.1.13.last_reassign_epoch=0
peer.10.253.1.14.class=cs5
peer.10.253.1.14.target=canary_vpn2
peer.10.253.1.14.active_now=false
peer.10.253.1.14.active_state=false
peer.10.253.1.14.cooldown_ok=true
peer.10.253.1.14.out_packets=0
peer.10.253.1.14.out_bytes=0
peer.10.253.1.14.in_packets=0
peer.10.253.1.14.in_bytes=0
peer.10.253.1.14.delta_packets=0
peer.10.253.1.14.delta_bytes=0
peer.10.253.1.14.last_active_epoch=0
peer.10.253.1.14.last_reassign_epoch=0
### FILE /root/step047c-state-20260710-123056.backup
schema=router-wgpay-egress-local-state-v2
generated_epoch=1783686634
selector_file=/etc/router-wgpay-selector.d/peers.conf
state_KEYMASK-wgpay-egress/state.kv
mode=--commit
rows=5
active_now_count=0
active_state_count=0
idle_count=5
idle_seconds=900
reassign_cooldown_seconds=900
active_min_packets=10
active_min_bytes=16384
min_class=cs1
min_count=1
max_class=cs1
max_count=1
blocked=false
block_reason=
action_count=0
action_ip=
action_from_class=
action_from_target=
action_to_class=
action_to_target=
action_reason=already_balanced
selector_would_change=false
selector_apply_would_run=false
state_file_would_write=true
peer.10.253.1.10.class=cs1
peer.10.253.1.10.target=canary_vpn3
peer.10.253.1.10.active_now=false
peer.10.253.1.10.active_state=false
peer.10.253.1.10.cooldown_ok=true
peer.10.253.1.10.out_packets=0
peer.10.253.1.10.out_bytes=0
peer.10.253.1.10.in_packets=0
peer.10.253.1.10.in_bytes=0
peer.10.253.1.10.delta_packets=0
peer.10.253.1.10.delta_bytes=0
peer.10.253.1.10.last_active_epoch=0
peer.10.253.1.10.last_reassign_epoch=0
peer.10.253.1.11.class=cs2
peer.10.253.1.11.target=canary_vpn4
peer.10.253.1.11.active_now=false
peer.10.253.1.11.active_state=false
peer.10.253.1.11.cooldown_ok=true
peer.10.253.1.11.out_packets=0
peer.10.253.1.11.out_bytes=0
peer.10.253.1.11.in_packets=0
peer.10.253.1.11.in_bytes=0
peer.10.253.1.11.delta_packets=0
peer.10.253.1.11.delta_bytes=0
peer.10.253.1.11.last_active_epoch=0
peer.10.253.1.11.last_reassign_epoch=0
peer.10.253.1.12.class=cs3
peer.10.253.1.12.target=canary_vpn5
peer.10.253.1.12.active_now=false
peer.10.253.1.12.active_state=false
peer.10.253.1.12.cooldown_ok=true
peer.10.253.1.12.out_packets=0
peer.10.253.1.12.out_bytes=0
peer.10.253.1.12.in_packets=0
peer.10.253.1.12.in_bytes=0
peer.10.253.1.12.delta_packets=0
peer.10.253.1.12.delta_bytes=0
peer.10.253.1.12.last_active_epoch=0
peer.10.253.1.12.last_reassign_epoch=0
peer.10.253.1.13.class=cs4
peer.10.253.1.13.target=canary_vpn1
peer.10.253.1.13.active_now=false
peer.10.253.1.13.active_state=false
peer.10.253.1.13.cooldown_ok=true
peer.10.253.1.13.out_packets=0
peer.10.253.1.13.out_bytes=0
peer.10.253.1.13.in_packets=0
peer.10.253.1.13.in_bytes=0
peer.10.253.1.13.delta_packets=0
peer.10.253.1.13.delta_bytes=0
peer.10.253.1.13.last_active_epoch=0
peer.10.253.1.13.last_reassign_epoch=0
peer.10.253.1.14.class=cs5
peer.10.253.1.14.target=canary_vpn2
peer.10.253.1.14.active_now=false
peer.10.253.1.14.active_state=false
peer.10.253.1.14.cooldown_ok=true
peer.10.253.1.14.out_packets=0
peer.10.253.1.14.out_bytes=0
peer.10.253.1.14.in_packets=0
peer.10.253.1.14.in_bytes=0
peer.10.253.1.14.delta_packets=0
peer.10.253.1.14.delta_bytes=0
peer.10.253.1.14.last_active_epoch=0
peer.10.253.1.14.last_reassign_epoch=0
### FILE /root/wgpaid-clean-ip14-before-041m-20260709-091439/network.before

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option packet_steering '1'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'eth1'

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option ipaddr '10.71.100.1'
	option netmask '255.255.255.0'

config eth2 'device'

config static 'proto'

config 10.200.0.1 'ipaddr'

config interface 'transit_direct'
	option proto 'static'
	option device 'eth0'
	list ipaddr '10.201.0.1/24'
	option gateway '10.201.0.2'
	list dns '10.201.0.2'
	option metric '10'

config interface 'transit_vpn'
	option proto 'static'
	option device 'eth2'
	option ipaddr '10.200.0.1'
	option netmask '255.255.255.0'
	option gateway '10.200.0.2'
	option metric '20'

config interface 'wg_remote'
	option proto 'wireguard'
	option private_key 'KEYMASK'
	option listen_port '51820'
	list addresses '10.250.100.1/24'

config wireguard_wg_remote
	option description 'support-mgts'
	option public_key 'KEYMASK'
	option private_key 'KEYMASK'
	option allowed_ips '10.250.100.2/32'
	option route_allowed_ips '1'

config wireguard_wg_remote
	option description 'owner-mgts'
	option public_key 'KEYMASK'
	option private_key 'KEYMASK'
	option allowed_ips '10.250.100.3/32'
	option route_allowed_ips '1'

config wireguard_wg_remote
	option description 'router-ops-mgts'
	option public_key 'KEYMASK'
	option allowed_ips '10.250.100.4/32'
	option route_allowed_ips '1'

config interface 'wg_paid'
	option proto 'wireguard'
	option private_key 'KEYMASK'
	option listen_port '51830'
	list addresses '10.253.1.1/16'

config wireguard_wg_remote
	option description 'VM121 wg-access-dev direct admin'
	option public_key 'KEYMASK'
	list allowed_ips '10.250.100.121/32'
	option route_allowed_ips '1'

### FILE /root/wgpaid-cs5-cleanup-20260709-085442/network.before

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option packet_steering '1'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'eth1'

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option ipaddr '10.71.100.1'
	option netmask '255.255.255.0'

config eth2 'device'

config static 'proto'

config 10.200.0.1 'ipaddr'

config interface 'transit_direct'
	option proto 'static'
	option device 'eth0'
	list ipaddr '10.201.0.1/24'
	option gateway '10.201.0.2'
	list dns '10.201.0.2'
	option metric '10'

config interface 'transit_vpn'
	option proto 'static'
	option device 'eth2'
	option ipaddr '10.200.0.1'
	option netmask '255.255.255.0'
	option gateway '10.200.0.2'
	option metric '20'

config interface 'wg_remote'
	option proto 'wireguard'
	option private_key 'KEYMASK'
	option listen_port '51820'
	list addresses '10.250.100.1/24'

config wireguard_wg_remote
	option description 'support-mgts'
	option public_key 'KEYMASK'
	option private_key 'KEYMASK'
	option allowed_ips '10.250.100.2/32'
	option route_allowed_ips '1'

config wireguard_wg_remote
	option description 'owner-mgts'
	option public_key 'KEYMASK'
	option private_key 'KEYMASK'
	option allowed_ips '10.250.100.3/32'
	option route_allowed_ips '1'

config wireguard_wg_remote
	option description 'router-ops-mgts'
	option public_key 'KEYMASK'
	option allowed_ips '10.250.100.4/32'
	option route_allowed_ips '1'

config interface 'wg_paid'
	option proto 'wireguard'
	option private_key 'KEYMASK'
	option listen_port '51830'
	list addresses '10.253.1.1/16'

config wireguard_wg_remote
	option description 'VM121 wg-access-dev direct admin'
	option public_key 'KEYMASK'
	list allowed_ips '10.250.100.121/32'
	option route_allowed_ips '1'

config wireguard_wg_paid 'wg_paid_peer_10_253_1_14'
	option description 'canary_vpn2 cs5 10.253.1.14/32'
	option public_key 'KEYMASK'
	list allowed_ips '10.253.1.14/32'
	option route_allowed_ips '1'
	option preshared_key 'KEYMASK'

### FILE /root/wgpaid-hard-clean-ip14-041m2-20260709-093959/network.before

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option packet_steering '1'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'eth1'

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option ipaddr '10.71.100.1'
	option netmask '255.255.255.0'

config eth2 'device'

config static 'proto'

config 10.200.0.1 'ipaddr'

config interface 'transit_direct'
	option proto 'static'
	option device 'eth0'
	list ipaddr '10.201.0.1/24'
	option gateway '10.201.0.2'
	list dns '10.201.0.2'
	option metric '10'

config interface 'transit_vpn'
	option proto 'static'
	option device 'eth2'
	option ipaddr '10.200.0.1'
	option netmask '255.255.255.0'
	option gateway '10.200.0.2'
	option metric '20'

config interface 'wg_remote'
	option proto 'wireguard'
	option private_key 'KEYMASK'
	option listen_port '51820'
	list addresses '10.250.100.1/24'

config wireguard_wg_remote
	option description 'support-mgts'
	option public_key 'KEYMASK'
	option private_key 'KEYMASK'
	option allowed_ips '10.250.100.2/32'
	option route_allowed_ips '1'

config wireguard_wg_remote
	option description 'owner-mgts'
	option public_key 'KEYMASK'
	option private_key 'KEYMASK'
	option allowed_ips '10.250.100.3/32'
	option route_allowed_ips '1'

config wireguard_wg_remote
	option description 'router-ops-mgts'
	option public_key 'KEYMASK'
	option allowed_ips '10.250.100.4/32'
	option route_allowed_ips '1'

config interface 'wg_paid'
	option proto 'wireguard'
	option private_key 'KEYMASK'
	option listen_port '51830'
	list addresses '10.253.1.1/16'

config wireguard_wg_remote
	option description 'VM121 wg-access-dev direct admin'
	option public_key 'KEYMASK'
	list allowed_ips '10.250.100.121/32'
	option route_allowed_ips '1'

### FILE /usr/local/sbin/router-wgpay-canary-apply.sh
#!/bin/sh
set -u

SEL_FILE="/etc/router-wgpay-selector.d/peers.conf"
TABLE="wgpay_dscp_canary"

apply_rules() {
  [ -f "$SEL_FILE" ] || {
    echo "BLOCK: selector_file_missing"
    exit 2
  }

  nft delete table inet "$TABLE" 2>/dev/null || true
  nft add table inet "$TABLE"
  nft add chain inet "$TABLE" prerouting '{ type filter hook prerouting priority mangle; policy accept; }'

  count=0

  while read ip dscp comment rest; do
    case "${ip:-}" in
      ""|\#*) continue ;;
    esac

    case "${dscp:-}" in
      cs1|cs2|cs3|cs4|cs5|cs6|cs7|ef|af11|af12|af13|af21|af22|af23|af31|af32|af33|af41|af42|af43|be) ;;
      *)
        echo "BLOCK: unsupported_dscp_for_$ip=$dscp"
        exit 3
        ;;
    esac

    echo "$ip" | grep -E '^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$' >/dev/null || {
      echo "BLOCK: invalid_ip=$ip"
      exit 4
    }

    wg show wg_paid dump 2>/dev/null | grep -F "$ip/32" >/dev/null || {
      echo "BLOCK: selector_ip_not_in_wg_paid=$ip"
      exit 5
    }

    safe_comment="$(echo "${comment:-selector}" | tr -cd 'A-Za-z0-9_.:-' | cut -c1-40)"
    [ -n "$safe_comment" ] || safe_comment="selector"

    nft add rule inet "$TABLE" prerouting iifname "wg_paid" ip saddr "$ip" ip dscp set "$dscp" counter comment "STEP_035B_SELECTOR_WGPAY_${safe_comment}_${ip}_${dscp}"
    count=$((count + 1))
  done < "$SEL_FILE"

  [ "$count" -gt 0 ] || {
    echo "BLOCK: selector_file_no_active_entries"
    exit 6
  }

  echo "applied_vm100_wgpay_selector_rules=$count"
}

case "${1:-start}" in
  start|restart|reload)
    apply_rules
    ;;

  stop)
    nft delete table inet "$TABLE" 2>/dev/null || true
    echo "stopped_vm100_wgpay_selector=1"
    ;;

  status)
    nft list table inet "$TABLE" 2>/dev/null
    ;;

  *)
    echo "usage: $0 {start|stop|restart|reload|status}"
    exit 1
    ;;
esac
### FILE /usr/local/sbin/router-wgpay-egress-local-loop.sh
#!/bin/sh
set -u

CONF="${ROUTER_EGRESS_LOCAL_CONF:-/etc/router-wgpay-egress-local.conf}"

MODE="--dry-run"
INTERVAL="30"
LOG="/var/log/router-wgpay-egress-local.log"
SCRIPT="KEYMASK-wgpay-egress-local.sh"

ROUTER_EGRESS_ALLOCATOR_ENABLED="1"
ROUTER_EGRESS_REBALANCE_PAUSED="0"
ROUTER_EGRESS_FORCE_MODE="off"
ROUTER_EGRESS_FORCE_CLASS=""
ROUTER_EGRESS_FORCE_TARGET_ID=""
ROUTER_EGRESS_FORCE_REASON=""
ROUTER_EGRESS_FORCE_UNTIL=""
ROUTER_EGRESS_ACTIVE_MIN_PACKETS="10"
ROUTER_EGRESS_ACTIVE_MIN_BYTES="16384"

if [ -f "$CONF" ]; then
  # shellcheck disable=SC1090
  . "$CONF"
fi

: "${MODE:=--dry-run}"
: "${INTERVAL:=30}"
: "${LOG:=/var/log/router-wgpay-egress-local.log}"
: "${SCRIPT:KEYMASK-wgpay-egress-local.sh}"

export ROUTER_EGRESS_ALLOCATOR_ENABLED
export ROUTER_EGRESS_REBALANCE_PAUSED
export ROUTER_EGRESS_FORCE_MODE
export ROUTER_EGRESS_FORCE_CLASS
export ROUTER_EGRESS_FORCE_TARGET_ID
export ROUTER_EGRESS_FORCE_REASON
export ROUTER_EGRESS_FORCE_UNTIL
export ROUTER_EGRESS_ACTIVE_MIN_PACKETS
export ROUTER_EGRESS_ACTIVE_MIN_BYTES

mkdir -p "$(dirname "$LOG")" 2>/dev/null || true

echo "__ROUTER_WGPAY_EGRESS_LOCAL_LOOP_BEGIN__ pid=$$ conf=$CONF mode=$MODE interval=$INTERVAL allocator_enabled=$ROUTER_EGRESS_ALLOCATOR_ENABLED paused=$ROUTER_EGRESS_REBALANCE_PAUSED force_mode=$ROUTER_EGRESS_FORCE_MODE started_at=$(date -Is 2>/dev/null || date)" >> "$LOG"

while true; do
  {
    echo "__ROUTER_WGPAY_EGRESS_LOCAL_RUN_BEGIN__"
    echo "run_started_at=$(date -Is 2>/dev/null || date)"
    echo "conf=$CONF"
    echo "mode=$MODE"
    echo "script=$SCRIPT"
    echo "allocator_enabled=$ROUTER_EGRESS_ALLOCATOR_ENABLED"
    echo "rebalance_paused=$ROUTER_EGRESS_REBALANCE_PAUSED"
    echo "force_mode=$ROUTER_EGRESS_FORCE_MODE"
    "$SCRIPT" "$MODE"
    rc=$?
    echo "run_rc=$rc"
    echo "run_finished_at=$(date -Is 2>/dev/null || date)"
    echo "__ROUTER_WGPAY_EGRESS_LOCAL_RUN_END__"
  } >> "$LOG" 2>&1

  sleep "$INTERVAL"
done
### FILE /usr/local/sbin/router-wgpay-egress-local.sh
#!/bin/sh
set -u

MODE="${1:---dry-run}"
SEL="${ROUTER_EGRESS_SELECTOR_FILE:-/etc/router-wgpay-selector.d/peers.conf}"
APPLY="${ROUTER_EGRESS_SELECTOR_APPLY:-KEYMASK-wgpay-canary-apply.sh}"
STATE_DIR="${ROUTER_EGRESS_STATE_DIR:-/var/lib/router-wgpay-egress}"
STATE_FILE="${ROUTER_EGRESS_STATE_FILE:-${STATE_DIR}/state.kv}"
SYN_ACTIVE_IPS="$(echo "${ROUTER_EGRESS_SYNTHETIC_ACTIVE_IPS:-}" | tr ',' ' ')"

ACTIVE_MIN_PACKETS="${ROUTER_EGRESS_ACTIVE_MIN_PACKETS:-10}"
ACTIVE_MIN_BYTES="${ROUTER_EGRESS_ACTIVE_MIN_BYTES:-16384}"
IDLE_SECONDS="${ROUTER_EGRESS_IDLE_SECONDS:-900}"
REASSIGN_COOLDOWN_SECONDS="${ROUTER_EGRESS_REASSIGN_COOLDOWN_SECONDS:-900}"

ALLOCATOR_ENABLED="${ROUTER_EGRESS_ALLOCATOR_ENABLED:-1}"
REBALANCE_PAUSED="${ROUTER_EGRESS_REBALANCE_PAUSED:-0}"
FORCE_MODE="${ROUTER_EGRESS_FORCE_MODE:-off}"

CLASSES="cs1 cs2 cs3 cs4 cs5"
NOW="$(date +%s)"

target_for_class() {
  case "$1" in
    cs1) echo "canary_vpn3" ;;
    cs2) echo "canary_vpn4" ;;
    cs3) echo "canary_vpn5" ;;
    cs4) echo "canary_vpn1" ;;
    cs5) echo "canary_vpn2" ;;
    *) echo "" ;;
  esac
}

state_get() {
  key="$1"
  [ -f "$STATE_FILE" ] || { echo ""; return 0; }
  grep -E "^${key}=" "$STATE_FILE" 2>/dev/null | tail -1 | sed 's/^[^=]*=//' || true
}

counter_snapshot() {
  ip="$1"
  safe_ip="$(echo "$ip" | tr '.' '_')"
  nft list table inet router_egress_activity 2>/dev/null | awk -v safe="$safe_ip" '
    BEGIN {op=0; ob=0; ipk=0; ib=0}
    $0 ~ "peer_" safe "_out_vpn" {
      for (i=1; i<=NF; i++) {
        if ($i=="packets") op=$(i+1)
        if ($i=="bytes") ob=$(i+1)
      }
    }
    $0 ~ "peer_" safe "_in_vpn" {
      for (i=1; i<=NF; i++) {
        if ($i=="packets") ipk=$(i+1)
        if ($i=="bytes") ib=$(i+1)
      }
    }
    END {print op, ob, ipk, ib}
  '
}

is_synthetic_active() {
  ip="$1"
  for a in $SYN_ACTIVE_IPS; do
    [ "$a" = "$ip" ] && return 0
  done
  return 1
}

safe_delta() {
  cur="$1"
  prev="$2"
  [ -n "$prev" ] || prev=0
  if [ "$cur" -ge "$prev" ] 2>/dev/null; then
    echo $((cur - prev))
  else
    echo "$cur"
  fi
}

if [ "$MODE" != "--dry-run" ] && [ "$MODE" != "--apply-preview" ] && [ "$MODE" != "--state-preview" ] && [ "$MODE" != "--state-write" ] && [ "$MODE" != "--commit" ]; then
  echo "Usage: $0 --dry-run|--apply-preview|--state-preview|--state-write|--commit" >&2
  exit 64
fi

TMP="/tmp/router-wgpay-egress-local-rows.$$"
STATE_TMP="/tmp/router-wgpay-egress-local-state.$$"
SEL_TMP="/tmp/router-wgpay-egress-local-selector.$$"
APPLY_LOG="/tmp/router-wgpay-egress-local-apply.$$.log"
trap 'rm -f "$TMP" "$STATE_TMP" "$SEL_TMP" "$APPLY_LOG" "${STATE_FILE}.tmp.$$"' EXIT
: > "$TMP"

grep -Ev '^[[:space:]]*(#|$)' "$SEL" 2>/dev/null | while read -r ip cls tag rest; do
  [ -n "$ip" ] || continue

  vals="$(counter_snapshot "$ip")"
  set -- $vals
  outp="${1:-0}"
  outb="${2:-0}"
  inp="${3:-0}"
  inb="${4:-0}"

  prev_outp="$(state_get "peer.${ip}.out_packets")"
  prev_outb="$(state_get "peer.${ip}.out_bytes")"
  prev_inp="$(state_get "peer.${ip}.in_packets")"
  prev_inb="$(state_get "peer.${ip}.in_bytes")"
  prev_last_active="$(state_get "peer.${ip}.last_active_epoch")"
  prev_last_reassign="$(state_get "peer.${ip}.last_reassign_epoch")"

  [ -n "$prev_last_active" ] || prev_last_active=0
  [ -n "$prev_last_reassign" ] || prev_last_reassign=0

  delta_outp="$(safe_delta "$outp" "$prev_outp")"
  delta_outb="$(safe_delta "$outb" "$prev_outb")"
  delta_inp="$(safe_delta "$inp" "$prev_inp")"
  delta_inb="$(safe_delta "$inb" "$prev_inb")"
  delta_packets=$((delta_outp + delta_inp))
  delta_bytes=$((delta_outb + delta_inb))

  active_now=false
  active_state=false
  last_active="$prev_last_active"

  if is_synthetic_active "$ip"; then
    active_now=true
  elif [ "$delta_packets" -ge "$ACTIVE_MIN_PACKETS" ] || [ "$delta_bytes" -ge "$ACTIVE_MIN_BYTES" ]; then
    active_now=true
  fi

  if [ "$active_now" = "true" ]; then
    last_active="$NOW"
    active_state=true
  elif [ "$prev_last_active" -gt 0 ] 2>/dev/null && [ $((NOW - prev_last_active)) -lt "$IDLE_SECONDS" ]; then
    active_state=true
  fi

  cooldown_ok=true
  if [ "$prev_last_reassign" -gt 0 ] 2>/dev/null && [ $((NOW - prev_last_reassign)) -lt "$REASSIGN_COOLDOWN_SECONDS" ]; then
    cooldown_ok=false
  fi

  printf '%s %s %s %s %s %s %s %s %s %s %s %s %s %s\n' \
    "$ip" "$cls" "$tag" "$active_now" "$active_state" "$cooldown_ok" \
    "$outp" "$outb" "$inp" "$inb" "$delta_packets" "$delta_bytes" "$last_active" "$prev_last_reassign" >> "$TMP"
done

blocked=false
block_reason=""
if [ "$ALLOCATOR_ENABLED" != "1" ]; then
  blocked=true
  block_reason="allocator_disabled"
elif [ "$FORCE_MODE" != "off" ]; then
  blocked=true
  block_reason="force_mode_active"
elif [ "$REBALANCE_PAUSED" != "0" ]; then
  blocked=true
  block_reason="rebalance_paused"
fi

rows="$(wc -l < "$TMP" | tr -d ' ')"
active_now_count="$(awk '$4=="true"{c++} END{print c+0}' "$TMP")"
active_state_count="$(awk '$5=="true"{c++} END{print c+0}' "$TMP")"
idle_count="$(awk '$5!="true"{c++} END{print c+0}' "$TMP")"

min_class=""
max_class=""
min_count=999
max_count=-1

for cls in $CLASSES; do
  c="$(awk -v cls="$cls" '$2==cls{n++} END{print n+0}' "$TMP")"
  if [ "$c" -lt "$min_count" ]; then
    min_count="$c"
    min_class="$cls"
  fi
  if [ "$c" -gt "$max_count" ]; then
    max_count="$c"
    max_class="$cls"
  fi
done


__LOGS__
Fri Jul 10 12:31:35 2026 daemon.notice netifd: Interface 'wg_paid' is setting up now
Fri Jul 10 12:31:35 2026 daemon.notice netifd: Interface 'wg_paid' is now up
Fri Jul 10 12:31:35 2026 daemon.notice netifd: Network device 'wg_paid' link is up
Fri Jul 10 12:31:35 2026 daemon.notice procd: /etc/rc.d/S99router-wgpay-canary: BLOCK: selector_ip_not_in_wg_paid=10.253.1.10
Fri Jul 10 12:31:35 2026 user.notice firewall: Reloading firewall due to ifup of wg_paid (wg_paid)