#!/usr/bin/env python3
"""Authorized extension: add dynamic CF trust only to the original gateway vhosts."""
import pathlib
import re
import subprocess

p = pathlib.Path('/etc/nginx/conf.d/g1.gembox-sub.com.conf')
include = 'include /etc/nginx/dpl-cloudflare-realip.conf;'
assert pathlib.Path('/etc/nginx/dpl-cloudflare-realip.conf').is_file()
old = p.read_text()
if include in old:
    print('Original gateway already uses dynamic Cloudflare ranges')
    raise SystemExit
pattern = r'(?m)^(\s*server_name\s+fu101\.gembox-sub\.com\s*;)$'
new, count = re.subn(pattern, lambda m: m.group(0) + '\n    ' + include, old)
assert 1 <= count <= 2, 'Unexpected vhost structure; inspect manually'
backup = pathlib.Path('/root/codex-backups/dpl-gateway-20261011/original-before-ip-sync.conf')
assert not backup.exists(), 'Backup exists; inspect previous attempt'
backup.write_text(old)
backup.chmod(0o600)
p.write_text(new)
try:
    subprocess.run(['nginx', '-t'], check=True)
    subprocess.run(['systemctl', 'reload', 'nginx'], check=True)
except Exception:
    p.write_text(old)
    raise
print(f'Original gateway Cloudflare trust synchronized in {count} vhosts; no containers restarted')