pic/api/routes/config.py

import io
import os
import re
import copy
import json
import ipaddress
import zipfile
import shutil
import logging
import threading
from datetime import datetime
from flask import Blueprint, request, jsonify, send_file, current_app
logger = logging.getLogger('picell')
bp = Blueprint('config', __name__)


# ---------------------------------------------------------------------------
# Pending-restart helpers
# ---------------------------------------------------------------------------

def _collect_service_ports(configs: dict) -> dict:
    """Extract current port values from service configs for .env generation."""
    from app import config_manager as _cm
    ports = {}
    net      = configs.get('network', {})
    wg       = configs.get('wireguard', {})
    email    = configs.get('email', {})
    cal      = configs.get('calendar', {})
    files    = configs.get('files', {})
    identity = configs.get('_identity', {})

    if 'dns_port'         in net:      ports['dns_port']             = net['dns_port']
    if 'port'             in wg:       ports['wg_port']              = wg['port']
    elif 'wireguard_port' in identity: ports['wg_port']              = identity['wireguard_port']
    if 'smtp_port'        in email:    ports['mail_smtp_port']       = email['smtp_port']
    if 'submission_port'  in email:    ports['mail_submission_port'] = email['submission_port']
    if 'imap_port'        in email:    ports['mail_imap_port']       = email['imap_port']
    if 'webmail_port'     in email:    ports['rainloop_port']        = email['webmail_port']
    if 'port'             in cal:      ports['radicale_port']        = cal['port']
    if 'port'             in files:    ports['webdav_port']          = files['port']
    if 'manager_port'     in files:    ports['filegator_port']       = files['manager_port']
    return ports


def _dedup_changes(existing: list, new: list) -> list:
    """Merge change lists, keeping only the latest entry per config key."""
    def key_of(msg: str) -> str:
        if ' changed' in msg:
            return msg.split(' changed')[0].strip()
        if ':' in msg:
            return msg.split(':')[0].strip()
        return msg
    merged = {key_of(c): c for c in existing}
    merged.update({key_of(c): c for c in new})
    return list(merged.values())


def _set_pending_restart(changes: list, containers: list = None, network_recreate: bool = False,
                         pre_change_snapshot: dict = None):
    """Record that specific containers need to be restarted to apply configuration."""
    from app import config_manager
    existing = config_manager.configs.get('_pending_restart', {})
    existing_changes = existing.get('changes', []) if existing.get('needs_restart') else []
    existing_containers = existing.get('containers', []) if existing.get('needs_restart') else []

    if not existing.get('needs_restart'):
        snapshot = pre_change_snapshot or {}
    else:
        snapshot = existing.get('_snapshot', {})

    if containers is None or '*' in (containers or []) or existing_containers == ['*']:
        new_containers = ['*']
    else:
        new_containers = list(set(existing_containers) | set(containers))

    config_manager.configs['_pending_restart'] = {
        'needs_restart': True,
        'changed_at': datetime.utcnow().isoformat(),
        'changes': _dedup_changes(existing_changes, changes),
        'containers': new_containers,
        'network_recreate': network_recreate or existing.get('network_recreate', False),
        '_snapshot': snapshot,
    }
    config_manager._save_all_configs()


def _clear_pending_restart():
    from app import config_manager
    config_manager.configs['_pending_restart'] = {
        'needs_restart': False, 'changes': [], 'containers': [], 'network_recreate': False
    }
    config_manager._save_all_configs()


# ---------------------------------------------------------------------------
# Config routes
# ---------------------------------------------------------------------------

@bp.route('/api/config', methods=['GET'])
def get_config():
    try:
        from app import config_manager
        import ip_utils as _ip_utils_cfg
        service_configs = config_manager.get_all_configs()
        identity = service_configs.pop('_identity', {})
        config = {
            'cell_name': identity.get('cell_name', os.environ.get('CELL_NAME', 'mycell')),
            'domain': identity.get('domain', os.environ.get('CELL_DOMAIN', 'cell')),
            'ip_range': identity.get('ip_range', os.environ.get('CELL_IP_RANGE', '172.20.0.0/16')),
            'wireguard_port': identity.get('wireguard_port', int(os.environ.get('WG_PORT', '51820'))),
        }
        _ips = _ip_utils_cfg.get_service_ips(config['ip_range'])
        config['service_ips'] = {
            'dns':          _ips['dns'],
            'vip_mail':     _ips['vip_mail'],
            'vip_calendar': _ips['vip_calendar'],
            'vip_files':    _ips['vip_files'],
            'vip_webdav':   _ips['vip_webdav'],
        }
        config['service_configs'] = service_configs
        config['installed_services'] = config_manager.get_installed_services()
        config['domain_mode'] = identity.get('domain_mode', 'lan')
        config['domain_name'] = identity.get('domain_name', '')
        config['effective_domain'] = config_manager.get_effective_domain()
        ddns_section = config_manager.configs.get('ddns', {})
        _provider = ddns_section.get('provider', '')
        _has_token = bool(
            (config_manager.get_ddns_token() if _provider == 'pic_ngo' else '') or
            ddns_section.get('api_token') or ddns_section.get('token')
        )
        config['ddns'] = {
            'provider': _provider,
            'subdomain': ddns_section.get('subdomain', ''),
            'has_token': _has_token,
        }
        return jsonify(config)
    except Exception as e:
        logger.error(f"Error getting config: {e}")
        return jsonify({"error": str(e)}), 500


@bp.route('/api/config', methods=['PUT'])
def update_config():
    try:
        from app import (config_manager, network_manager, wireguard_manager, email_manager,
                         calendar_manager, file_manager, routing_manager,
                         peer_registry, firewall_manager, service_bus, EventType, detect_conflicts)
        import ip_utils
        data = request.get_json(silent=True)
        if data is None:
            return jsonify({"error": "No data provided"}), 400

        identity_keys = {'cell_name', 'domain', 'ip_range', 'wireguard_port'}
        identity_updates = {k: v for k, v in data.items() if k in identity_keys}

        _CELL_NAME_RE = re.compile(r'^[a-zA-Z0-9][a-zA-Z0-9-]{0,254}$')
        _DOMAIN_RE    = re.compile(r'^[a-zA-Z0-9][a-zA-Z0-9.-]{0,254}$')

        if 'cell_name' in identity_updates:
            v = str(identity_updates['cell_name'])
            if not v:
                return jsonify({'error': 'cell_name cannot be empty'}), 400
            if len(v) > 255:
                return jsonify({'error': 'cell_name must be 255 characters or fewer'}), 400
            if not _CELL_NAME_RE.match(v):
                return jsonify({'error': 'Invalid cell_name: use only letters, digits, hyphens'}), 400

        if 'domain' in identity_updates:
            v = str(identity_updates['domain'])
            if not v:
                return jsonify({'error': 'domain cannot be empty'}), 400
            if len(v) > 255:
                return jsonify({'error': 'domain must be 255 characters or fewer'}), 400
            if not _DOMAIN_RE.match(v):
                return jsonify({'error': 'Invalid domain: use only letters, digits, hyphens, dots'}), 400
            from app import cell_link_manager as _clm
            for _link in _clm.list_connections():
                if _link.get('domain') == v:
                    return jsonify({'error': (
                        f"Domain {v!r} is already used by connected cell "
                        f"'{_link['cell_name']}' — each cell must use a unique domain"
                    )}), 409

        if 'ip_range' in identity_updates:
            _rfc1918 = [
                ipaddress.ip_network('10.0.0.0/8'),
                ipaddress.ip_network('172.16.0.0/12'),
                ipaddress.ip_network('192.168.0.0/16'),
            ]
            try:
                _raw = str(identity_updates['ip_range'])
                if '/' not in _raw:
                    return jsonify({'error': 'ip_range must include a CIDR prefix (e.g. 172.20.0.0/16)'}), 400
                _net = ipaddress.ip_network(_raw, strict=False)
                if not any(_net.subnet_of(r) for r in _rfc1918):
                    return jsonify({'error': (
                        'ip_range must be within an RFC-1918 private range '
                        '(10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16)'
                    )}), 400
            except ValueError as _e:
                return jsonify({'error': f'Invalid ip_range: {_e}'}), 400
            from app import cell_link_manager as _clm
            for _link in _clm.list_connections():
                try:
                    _cell_net = ipaddress.ip_network(_link['vpn_subnet'], strict=False)
                    if _net.overlaps(_cell_net):
                        return jsonify({'error': (
                            f"ip_range {str(_net)!r} overlaps connected cell "
                            f"'{_link['cell_name']}' ({_link['vpn_subnet']!r}) — "
                            f"use a non-overlapping range"
                        )}), 409
                except Exception:
                    pass

        _port_fields = {
            'network':   ['dns_port'],
            'wireguard': ['port'],
            'email':     ['smtp_port', 'submission_port', 'imap_port', 'webmail_port'],
            'calendar':  ['port'],
            'files':     ['port', 'manager_port'],
        }
        for _svc, _fields in _port_fields.items():
            if _svc not in data:
                continue
            _svc_data = data[_svc]
            if not isinstance(_svc_data, dict):
                continue
            for _f in _fields:
                if _f in _svc_data and _svc_data[_f] is not None and _svc_data[_f] != '':
                    try:
                        _p = int(_svc_data[_f])
                        if not (1 <= _p <= 65535):
                            raise ValueError()
                    except (ValueError, TypeError):
                        return jsonify({'error': f'{_svc}.{_f} must be an integer between 1 and 65535'}), 400

        _conflicts = detect_conflicts(config_manager.configs, data)
        if _conflicts:
            _msgs = [
                f"port {_c['port']} is used by {', '.join(f'{_s}.{_f}' for _s, _f in _c['conflicts'])}"
                for _c in _conflicts
            ]
            return jsonify({'error': 'Port conflict: ' + '; '.join(_msgs)}), 409

        if 'wireguard' in data and isinstance(data['wireguard'], dict):
            _addr = data['wireguard'].get('address')
            if _addr:
                if '/' not in str(_addr):
                    return jsonify({'error': 'wireguard.address must include a prefix length (e.g. 10.0.0.1/24)'}), 400
                try:
                    _iface = ipaddress.ip_interface(_addr)
                except ValueError as _e:
                    return jsonify({'error': f'wireguard.address is not a valid IP/CIDR: {_e}'}), 400
                _new_net = _iface.network
                from app import cell_link_manager as _clm
                for _link in _clm.list_connections():
                    try:
                        _cell_net = ipaddress.ip_network(_link['vpn_subnet'], strict=False)
                        if _new_net.overlaps(_cell_net):
                            return jsonify({'error': (
                                f"WireGuard subnet {str(_new_net)!r} overlaps connected cell "
                                f"'{_link['cell_name']}' ({_link['vpn_subnet']!r}) — "
                                f"use a non-overlapping address"
                            )}), 409
                    except Exception:
                        pass

        old_identity = dict(config_manager.configs.get('_identity', {}))
        old_svc_configs = {
            svc: dict(config_manager.configs.get(svc, {}))
            for svc in data if svc in config_manager.service_schemas
        }
        _pre_change_snapshot = {k: copy.deepcopy(v) for k, v in config_manager.configs.items()
                                 if not k.startswith('_')}
        _pre_change_snapshot['_identity'] = copy.deepcopy(config_manager.configs.get('_identity', {}))

        if identity_updates:
            stored = config_manager.configs.get('_identity', {})
            stored.update(identity_updates)
            config_manager.configs['_identity'] = stored
            config_manager._save_all_configs()

        _svc_managers = {
            'network':   network_manager,
            'wireguard': wireguard_manager,
            'email':     email_manager,
            'calendar':  calendar_manager,
            'files':     file_manager,
            'routing':   routing_manager,
            'vault':     current_app.vault_manager,
        }

        all_restarted = []
        all_warnings  = []

        for service, config in data.items():
            if service in config_manager.service_schemas:
                config_manager.update_service_config(service, config)
                mgr = _svc_managers.get(service)
                if mgr:
                    mgr.update_config(config)
                    result = mgr.apply_config(config)
                    all_restarted.extend(result.get('restarted', []))
                    all_warnings.extend(result.get('warnings', []))
                service_bus.publish_event(EventType.CONFIG_CHANGED, service, {
                    'service': service, 'config': config
                })
                if service == 'wireguard' and ('port' in config or 'address' in config):
                    for p in peer_registry.list_peers():
                        peer_registry.update_peer(p['peer'], {'config_needs_reinstall': True})
                    n = len(peer_registry.list_peers())
                    if n:
                        all_warnings.append(f'WireGuard endpoint changed — {n} peer(s) must reinstall VPN config')
                    if 'port' in config:
                        _id = config_manager.configs.get('_identity', {})
                        _id['wireguard_port'] = config['port']
                        config_manager.configs['_identity'] = _id
                        config_manager._save_all_configs()

        if identity_updates.get('domain') and identity_updates['domain'] != old_identity.get('domain', ''):
            domain = identity_updates['domain']
            net_result = network_manager.apply_domain(domain, reload=False)
            all_warnings.extend(net_result.get('warnings', []))
            _set_pending_restart(
                [f'domain changed to {domain}'],
                ['dns', 'caddy'],
                pre_change_snapshot=_pre_change_snapshot,
            )

        if identity_updates.get('cell_name'):
            old_name = old_identity.get('cell_name', os.environ.get('CELL_NAME', 'mycell'))
            new_name = identity_updates['cell_name']
            if old_name != new_name:
                cn_result = network_manager.apply_cell_name(old_name, new_name, reload=False)
                all_warnings.extend(cn_result.get('warnings', []))
                _set_pending_restart(
                    [f'cell_name changed to {new_name}'],
                    ['dns'],
                    pre_change_snapshot=_pre_change_snapshot,
                )
                _ddns_cfg = config_manager.configs.get('ddns', {})
                if _ddns_cfg.get('provider') == 'pic_ngo':
                    try:
                        from ddns_manager import DDNSManager as _DDNSManager
                        _ddns_mgr = _DDNSManager(config_manager)
                        _result = _ddns_mgr.register(new_name, '')
                        _new_sub = _result.get('subdomain', f'{new_name}.pic.ngo')
                        config_manager.set_identity_field('domain_name', _new_sub)
                        logger.info('DDNS re-registered: cell_name=%r subdomain=%r', new_name, _new_sub)
                    except Exception as _exc:
                        logger.warning('DDNS re-registration failed for %r: %s', new_name, _exc)
                        all_warnings.append(f'DDNS name update failed — {_exc}')

        if identity_updates.get('ip_range') and identity_updates['ip_range'] != old_identity.get('ip_range', ''):
            new_range = identity_updates['ip_range']
            cur_identity = config_manager.configs.get('_identity', {})
            cur_cell_name = cur_identity.get('cell_name', os.environ.get('CELL_NAME', 'mycell'))
            cur_domain = cur_identity.get('domain', os.environ.get('CELL_DOMAIN', 'cell'))
            ip_result = network_manager.apply_ip_range(new_range, cur_cell_name, cur_domain)
            all_restarted.extend(ip_result.get('restarted', []))
            all_warnings.extend(ip_result.get('warnings', []))
            firewall_manager.update_service_ips(new_range)
            firewall_manager.ensure_caddy_virtual_ips()
            env_file = os.environ.get('COMPOSE_ENV_FILE', '/app/.env.compose')
            ip_utils.write_env_file(new_range, env_file, _collect_service_ports(config_manager.configs))
            _set_pending_restart(
                [f'ip_range changed to {new_range} — network will be recreated'],
                ['*'], network_recreate=True,
                pre_change_snapshot=_pre_change_snapshot,
            )

        if identity_updates:
            _cur_identity = config_manager.configs.get('_identity', {})
            _eff_domain = config_manager.get_effective_domain()
            service_bus.publish_event(EventType.IDENTITY_CHANGED, 'config', {
                'cell_name': _cur_identity.get('cell_name'),
                'domain': _cur_identity.get('domain'),
                'domain_name': _cur_identity.get('domain_name'),
                'domain_mode': _cur_identity.get('domain_mode'),
                'effective_domain': _eff_domain,
            })
            if _cur_identity.get('domain_mode', 'lan') != 'lan' and _eff_domain:
                try:
                    import ip_utils as _ip_sh
                    _ip_range = _cur_identity.get('ip_range', os.environ.get('CELL_IP_RANGE', '172.20.0.0/16'))
                    _caddy_ip = _ip_sh.get_service_ips(_ip_range).get('caddy', '172.20.0.2')
                    _primary_domain = _cur_identity.get('domain', os.environ.get('CELL_DOMAIN', 'cell'))
                    network_manager.update_split_horizon_zone(
                        _eff_domain, _caddy_ip, primary_domain=_primary_domain
                    )
                except Exception as _sh_exc:
                    logger.warning('split-horizon zone update failed: %s', _sh_exc)

        _PORT_CHANGE_MAP = {
            ('network',  'dns_port'):          ('dns_port',             ['dns']),
            ('wireguard','port'):               ('wg_port',              ['wireguard']),
            ('email',    'smtp_port'):          ('mail_smtp_port',       ['mail']),
            ('email',    'submission_port'):    ('mail_submission_port', ['mail']),
            ('email',    'imap_port'):          ('mail_imap_port',       ['mail']),
            ('email',    'webmail_port'):       ('rainloop_port',        ['rainloop']),
            ('calendar', 'port'):               ('radicale_port',        ['radicale']),
            ('files',    'port'):               ('webdav_port',          ['webdav']),
            ('files',    'manager_port'):       ('filegator_port',       ['filegator']),
        }

        port_changed_containers = set()
        port_change_messages = []

        for (svc_key, field), (_env_key, containers) in _PORT_CHANGE_MAP.items():
            if svc_key in data and field in data[svc_key]:
                default_val = ip_utils.PORT_DEFAULTS.get(_env_key)
                old_val = old_svc_configs.get(svc_key, {}).get(field, default_val)
                new_val = data[svc_key][field]
                if old_val != new_val:
                    port_changed_containers.update(containers)
                    port_change_messages.append(f'{svc_key} {field}: {old_val} → {new_val}')

        if 'wireguard_port' in identity_updates:
            old_wg = old_identity.get('wireguard_port', ip_utils.PORT_DEFAULTS.get('wg_port', 51820))
            new_wg = identity_updates['wireguard_port']
            if old_wg != new_wg:
                _wg_svc = config_manager.configs.get('wireguard', {})
                _wg_svc['port'] = new_wg
                config_manager.update_service_config('wireguard', _wg_svc)
                wireguard_manager.apply_config({'port': new_wg})
                port_changed_containers.add('wireguard')
                port_change_messages.append(f'wireguard_port: {old_wg} → {new_wg}')

        # WireGuard address change — queue a wireguard container restart and push
        # the updated invite to all connected cells so they can update their
        # dns_ip, vpn_subnet, and WG AllowedIPs without manual re-pairing.
        _wg_address_changed = (
            'wireguard' in data
            and isinstance(data.get('wireguard'), dict)
            and 'address' in data['wireguard']
            and data['wireguard']['address'] != old_svc_configs.get('wireguard', {}).get('address', '')
        )
        if _wg_address_changed:
            _new_addr = data['wireguard']['address']
            _old_addr = old_svc_configs.get('wireguard', {}).get('address', '(unknown)')
            port_changed_containers.add('wireguard')
            port_change_messages.append(f'wireguard address: {_old_addr} → {_new_addr}')
            # Push updated invite to connected cells in the background so they can
            # heal their dns_ip / AllowedIPs without any manual action.
            def _push_cell_invites():
                import time as _time
                _time.sleep(3)  # brief wait to let wg0.conf settle
                try:
                    from app import cell_link_manager as _clm
                    for _link in _clm.list_connections():
                        try:
                            _clm._push_invite_to_remote(_link)
                            logger.info(f"Pushed updated invite to cell '{_link['cell_name']}' after address change")
                        except Exception as _e:
                            logger.warning(f"Post-address-change invite push to '{_link.get('cell_name')}' failed: {_e}")
                except Exception as _e:
                    logger.warning(f"_push_cell_invites failed: {_e}")
            threading.Thread(target=_push_cell_invites, daemon=True).start()

        if port_changed_containers:
            env_file = os.environ.get('COMPOSE_ENV_FILE', '/app/.env.compose')
            _ip_range = config_manager.configs.get('_identity', {}).get(
                'ip_range', os.environ.get('CELL_IP_RANGE', '172.20.0.0/16')
            )
            ip_utils.write_env_file(_ip_range, env_file, _collect_service_ports(config_manager.configs))
            _set_pending_restart(port_change_messages, list(port_changed_containers),
                                 pre_change_snapshot=_pre_change_snapshot)

        logger.info(f"Updated config, restarted: {all_restarted}")
        return jsonify({
            "message": "Configuration updated and applied",
            "restarted": all_restarted,
            "warnings": all_warnings,
        })
    except Exception as e:
        logger.error(f"Error updating config: {e}")
        return jsonify({"error": str(e)}), 500


@bp.route('/api/ddns/check/<name>', methods=['GET'])
def ddns_check_name(name):
    import urllib.request as _ureq
    import urllib.error as _uerr
    import json as _json_
    from setup_manager import DDNS_API_BASE as _DDNS_BASE
    try:
        url = f'{_DDNS_BASE}/api/v1/check/{name}'
        with _ureq.urlopen(url, timeout=8) as resp:
            body = _json_.loads(resp.read())
            return jsonify({'available': bool(body.get('available'))})
    except Exception as exc:
        logger.warning('DDNS check failed for %r: %s', name, exc)
        return jsonify({'available': None, 'error': 'DDNS service unreachable'}), 503


@bp.route('/api/ddns', methods=['PUT'])
def update_ddns_config():
    import urllib.request as _ureq
    import urllib.error as _uerr
    import json as _json_
    try:
        from app import config_manager
        from setup_manager import _build_ddns_config, DDNS_API_BASE as _DDNS_BASE

        data = request.get_json(silent=True) or {}
        domain_mode = data.get('domain_mode', '').strip()
        domain_name = data.get('domain_name', '').strip()
        cf_token = data.get('cloudflare_api_token', '').strip()
        duck_token = data.get('duckdns_token', '').strip()

        from setup_manager import VALID_DOMAIN_MODES
        if domain_mode not in VALID_DOMAIN_MODES:
            return jsonify({'error': f'domain_mode must be one of: {", ".join(sorted(VALID_DOMAIN_MODES))}'}), 400

        if domain_mode == 'cloudflare':
            if not domain_name:
                return jsonify({'error': 'domain_name is required for cloudflare'}), 400
            if not cf_token:
                existing = config_manager.configs.get('ddns', {}).get('api_token', '')
                if not existing:
                    return jsonify({'error': 'cloudflare_api_token is required'}), 400
                cf_token = existing
            try:
                req = _ureq.Request(
                    'https://api.cloudflare.com/client/v4/user/tokens/verify',
                    headers={'Authorization': f'Bearer {cf_token}'},
                )
                with _ureq.urlopen(req, timeout=8) as resp:
                    body = _json_.loads(resp.read())
                    if not body.get('success'):
                        return jsonify({'error': 'Cloudflare token is invalid'}), 422
            except _uerr.HTTPError:
                return jsonify({'error': 'Cloudflare token is invalid'}), 422
            except Exception as exc:
                return jsonify({'error': f'Could not reach Cloudflare: {exc}'}), 503

        if domain_mode == 'duckdns':
            if not domain_name:
                return jsonify({'error': 'domain_name is required for duckdns'}), 400
            if not duck_token:
                existing = config_manager.configs.get('ddns', {}).get('token', '')
                if not existing:
                    return jsonify({'error': 'duckdns_token is required'}), 400
                duck_token = existing
            subdomain = domain_name.replace('.duckdns.org', '')
            try:
                url = f'https://www.duckdns.org/update?domains={subdomain}&token={duck_token}&ip='
                with _ureq.urlopen(url, timeout=8) as resp:
                    if resp.read().strip() != b'OK':
                        return jsonify({'error': 'DuckDNS token or subdomain is invalid'}), 422
            except Exception as exc:
                return jsonify({'error': f'Could not reach DuckDNS: {exc}'}), 503

        duck_sub = domain_name.replace('.duckdns.org', '') if domain_mode == 'duckdns' else ''
        ddns_cfg = _build_ddns_config(
            domain_mode,
            cloudflare_api_token=cf_token,
            duckdns_token=duck_token,
            duckdns_subdomain=duck_sub,
        )
        config_manager.set_ddns_config(ddns_cfg)
        config_manager.set_identity_field('domain_mode', domain_mode)
        if domain_name:
            config_manager.set_identity_field('domain_name', domain_name)
        if domain_mode == 'cloudflare' and cf_token:
            config_manager.set_identity_field('cloudflare_api_token', cf_token)
        if domain_mode == 'duckdns':
            if duck_token:
                config_manager.set_identity_field('duckdns_token', duck_token)
            config_manager.set_identity_field('duckdns_subdomain', duck_sub)

        # Fire IDENTITY_CHANGED so CaddyManager regenerates the Caddyfile
        # for the new domain mode without requiring a container restart.
        try:
            from app import service_bus as _sbus, EventType as _ET
            _cur = config_manager.configs.get('_identity', {})
            _sbus.publish_event(_ET.IDENTITY_CHANGED, 'config', {
                'cell_name': _cur.get('cell_name'),
                'domain': _cur.get('domain'),
                'domain_name': _cur.get('domain_name'),
                'domain_mode': _cur.get('domain_mode'),
                'effective_domain': config_manager.get_effective_domain(),
            })
        except Exception as _ev_err:
            logger.warning('update_ddns_config: failed to fire IDENTITY_CHANGED: %s', _ev_err)

        logger.info('DDNS config updated: domain_mode=%r domain_name=%r', domain_mode, domain_name)
        return jsonify({'updated': True})
    except Exception as e:
        logger.error(f'Error updating DDNS config: {e}')
        return jsonify({'error': str(e)}), 500


_ddns_public_ip_cache: dict = {'ip': None, 'at': 0}

@bp.route('/api/ddns/status', methods=['GET'])
def ddns_status():
    import time as _time
    from app import config_manager
    ddns_cfg = config_manager.configs.get('ddns', {})
    identity = config_manager.configs.get('_identity', {})

    now = _time.time()
    if now - _ddns_public_ip_cache['at'] > 30 or not _ddns_public_ip_cache['ip']:
        try:
            import requests as _req
            resp = _req.get('https://api.ipify.org', timeout=5)
            if resp.ok:
                _ddns_public_ip_cache['ip'] = resp.text.strip()
                _ddns_public_ip_cache['at'] = now
        except Exception:
            pass

    last_ip = None
    try:
        from app import ddns_manager as _ddns_mgr_singleton
        last_ip = _ddns_mgr_singleton._last_ip
    except Exception:
        pass

    registered = bool(config_manager.get_ddns_token())
    return jsonify({
        'registered': registered,
        'domain_name': identity.get('domain_name', ''),
        'public_ip': _ddns_public_ip_cache['ip'],
        'last_ip': last_ip,
    })


@bp.route('/api/ddns/register', methods=['POST'])
def ddns_register():
    """Trigger (re-)registration with the configured DDNS provider."""
    try:
        from app import config_manager
        ddns_cfg = config_manager.configs.get('ddns', {})
        if ddns_cfg.get('provider') != 'pic_ngo':
            return jsonify({'error': 'Re-registration only supported for pic_ngo provider'}), 400
        identity = config_manager.configs.get('_identity', {})
        cell_name = identity.get('cell_name', os.environ.get('CELL_NAME', ''))
        if not cell_name:
            return jsonify({'error': 'cell_name not configured'}), 400
        from ddns_manager import DDNSManager as _DDNSManager
        _mgr = _DDNSManager(config_manager)
        result = _mgr.register(cell_name, '')
        new_sub = result.get('subdomain', f'{cell_name}.pic.ngo')
        config_manager.set_identity_field('domain_name', new_sub)
        logger.info('DDNS registered via /api/ddns/register: cell_name=%r subdomain=%r', cell_name, new_sub)
        from app import service_bus, EventType
        _reg_identity = config_manager.configs.get('_identity', {})
        service_bus.publish_event(EventType.IDENTITY_CHANGED, 'ddns_register', {
            'cell_name': _reg_identity.get('cell_name'),
            'domain': _reg_identity.get('domain'),
            'domain_name': new_sub,
            'domain_mode': _reg_identity.get('domain_mode'),
            'effective_domain': config_manager.get_effective_domain(),
        })
        return jsonify({'registered': True, 'subdomain': new_sub})
    except Exception as e:
        logger.error('Error in /api/ddns/register: %s', e)
        return jsonify({'error': str(e)}), 500


@bp.route('/api/config/pending', methods=['GET'])
def get_pending_config():
    from app import config_manager
    pending = config_manager.configs.get('_pending_restart', {})
    return jsonify({
        'needs_restart': pending.get('needs_restart', False),
        'applying': pending.get('applying', False),
        'changed_at': pending.get('changed_at'),
        'changes': pending.get('changes', []),
        'containers': pending.get('containers', ['*']),
    })


@bp.route('/api/config/pending', methods=['DELETE'])
def cancel_pending_config():
    from app import config_manager, network_manager
    import ip_utils as _ip_revert
    pending = config_manager.configs.get('_pending_restart', {})
    snapshot = pending.get('_snapshot', {})
    if snapshot:
        cur_identity = dict(config_manager.configs.get('_identity', {}))
        old_identity = snapshot.get('_identity', {})

        for k, v in snapshot.items():
            config_manager.configs[k] = v

        _id  = config_manager.configs.get('_identity', {})
        _dom = _id.get('domain', os.environ.get('CELL_DOMAIN', 'cell'))

        cur_domain = cur_identity.get('domain', '')
        old_domain = old_identity.get('domain', '')
        if cur_domain and old_domain and cur_domain != old_domain:
            network_manager.apply_domain(old_domain, reload=False)

        cur_cell_name = cur_identity.get('cell_name', '')
        old_cell_name = old_identity.get('cell_name', '')
        if cur_cell_name and old_cell_name and cur_cell_name != old_cell_name:
            network_manager.apply_cell_name(cur_cell_name, old_cell_name, reload=False)

        # Regenerate Caddyfile for the reverted identity (all domain modes)
        try:
            from app import caddy_manager as _cm
            _cm.regenerate_with_installed([])
        except Exception as _cm_err:
            logger.warning('cancel_pending_config: caddy regenerate failed (non-fatal): %s', _cm_err)

    _clear_pending_restart()
    return jsonify({'message': 'Pending changes discarded'})


@bp.route('/api/config/apply', methods=['POST'])
def apply_pending_config():
    try:
        from app import config_manager
        pending = config_manager.configs.get('_pending_restart', {})
        if not pending.get('needs_restart'):
            return jsonify({'message': 'No pending changes to apply'})

        project_dir  = '/home/roof/pic'
        api_image    = 'pic_api:latest'
        data_host_path = '/home/roof/pic/data/api'
        try:
            import docker as _docker_sdk
            _client = _docker_sdk.from_env()
            _self = _client.containers.get('cell-api')
            project_dir = _self.labels.get('com.docker.compose.project.working_dir', project_dir)
            tags = _self.image.tags
            if tags:
                api_image = tags[0]
            for _m in _self.attrs.get('Mounts', []):
                if _m.get('Destination') == '/app/data':
                    data_host_path = _m.get('Source', data_host_path)
                    break
        except Exception:
            pass

        containers = pending.get('containers', ['*'])
        needs_network_recreate = pending.get('network_recreate', False)

        host_env     = os.path.join(project_dir, '.env')
        host_compose = os.path.join(project_dir, 'docker-compose.yml')

        if '*' in containers:
            config_manager.configs['_pending_restart']['applying'] = True
            config_manager._save_all_configs()

            import base64 as _b64
            _clear_py = (
                "import json,os; p='/app/data/cell_config.json';"
                "f=open(p); d=json.load(f); f.close();"
                "d['_pending_restart']={'needs_restart':False,'changes':[],'containers':[],'network_recreate':False};"
                "tmp=p+'.tmp'; open(tmp,'w').write(json.dumps(d,indent=2)); os.replace(tmp,p)"
            )
            _b64_cmd = _b64.b64encode(_clear_py.encode()).decode()
            clear_flag_cmd = f"python3 -c \"import base64; exec(base64.b64decode('{_b64_cmd}').decode())\""

            if needs_network_recreate:
                helper_script = (
                    f'sleep 2'
                    f' && docker compose --project-directory {project_dir}'
                    f' -f {host_compose} --env-file {host_env} down'
                    f' && {clear_flag_cmd}'
                    f' && docker compose --project-directory {project_dir}'
                    f' -f {host_compose} --env-file {host_env} up -d'
                )
            else:
                helper_script = (
                    f'sleep 2'
                    f' && {clear_flag_cmd}'
                    f' && docker compose --project-directory {project_dir}'
                    f' -f {host_compose} --env-file {host_env} up -d'
                )

            def _do_apply():
                import subprocess as _subprocess
                _subprocess.Popen(
                    ['docker', 'run', '--rm',
                     '-v', '/var/run/docker.sock:/var/run/docker.sock',
                     '-v', f'{project_dir}:{project_dir}',
                     '-v', f'{data_host_path}:/app/data',
                     '--entrypoint', 'sh',
                     api_image,
                     '-c', helper_script],
                    close_fds=True,
                    stdout=_subprocess.DEVNULL,
                    stderr=_subprocess.DEVNULL,
                )
                logger.info(
                    'spawned helper container for all-services restart'
                    + (' (network_recreate)' if needs_network_recreate else '')
                )
        else:
            def _do_apply():
                import time as _time
                import subprocess as _subprocess
                _time.sleep(0.3)
                result = _subprocess.run(
                    ['docker', 'compose',
                     '--project-directory', project_dir,
                     '-f', '/app/docker-compose.yml',
                     '--env-file', '/app/.env.compose',
                     'up', '-d', '--no-deps', '--force-recreate'] + containers,
                    capture_output=True, text=True, timeout=120,
                )
                if result.returncode != 0:
                    logger.error(f"docker compose up failed: {result.stderr.strip()}")
                else:
                    logger.info(f'docker compose up completed for: {containers}')
                    _clear_pending_restart()

        threading.Thread(target=_do_apply, daemon=False).start()
        return jsonify({
            'message': 'Applying configuration — containers are restarting',
            'restart_in_progress': True,
        })
    except Exception as e:
        logger.error(f"Error applying config: {e}")
        return jsonify({'error': str(e)}), 500


@bp.route('/api/config/backup', methods=['POST'])
def create_config_backup():
    try:
        from app import config_manager, service_bus, service_registry, EventType
        backup_id = config_manager.backup_config(service_registry=service_registry)
        service_bus.publish_event(EventType.BACKUP_CREATED, 'api', {
            'backup_id': backup_id,
            'timestamp': datetime.utcnow().isoformat()
        })
        return jsonify({"backup_id": backup_id})
    except Exception as e:
        logger.error(f"Error creating backup: {e}")
        return jsonify({"error": str(e)}), 500


@bp.route('/api/config/backups', methods=['GET'])
def list_config_backups():
    try:
        from app import config_manager
        return jsonify(config_manager.list_backups())
    except Exception as e:
        logger.error(f"Error listing backups: {e}")
        return jsonify({"error": str(e)}), 500


@bp.route('/api/config/restore/<backup_id>', methods=['POST'])
def restore_config(backup_id):
    try:
        from app import config_manager, service_bus, service_registry, EventType
        data = request.get_json(silent=True) or {}
        services = data.get('services')
        success = config_manager.restore_config(
            backup_id,
            services=services,
            service_registry=service_registry if services is None else None,
        )
        if success:
            service_bus.publish_event(EventType.RESTORE_COMPLETED, 'api', {
                'backup_id': backup_id,
                'timestamp': datetime.utcnow().isoformat()
            })
            return jsonify({"message": f"Configuration restored from backup: {backup_id}"})
        return jsonify({"error": f"Failed to restore backup: {backup_id}"}), 500
    except Exception as e:
        logger.error(f"Error restoring backup: {e}")
        return jsonify({"error": str(e)}), 500


@bp.route('/api/config/export', methods=['GET'])
def export_config():
    try:
        from app import config_manager
        format = request.args.get('format', 'json')
        config_data = config_manager.export_config(format)
        return jsonify({"config": config_data, "format": format})
    except Exception as e:
        logger.error(f"Error exporting config: {e}")
        return jsonify({"error": str(e)}), 500


@bp.route('/api/config/import', methods=['POST'])
def import_config():
    try:
        from app import config_manager
        data = request.get_json(silent=True)
        if data is None:
            return jsonify({"error": "No data provided"}), 400
        success = config_manager.import_config(data.get('config'), data.get('format', 'json'))
        if success:
            return jsonify({"message": "Configuration imported successfully"})
        return jsonify({"error": "Failed to import configuration"}), 500
    except Exception as e:
        logger.error(f"Error importing config: {e}")
        return jsonify({"error": str(e)}), 500


@bp.route('/api/config/backups/<backup_id>/download', methods=['GET'])
def download_backup(backup_id):
    try:
        from app import config_manager
        backup_path = config_manager.backup_dir / backup_id
        if not backup_path.exists():
            return jsonify({'error': f'Backup {backup_id} not found'}), 404
        buf = io.BytesIO()
        with zipfile.ZipFile(buf, 'w', zipfile.ZIP_DEFLATED) as zf:
            for f in backup_path.rglob('*'):
                if f.is_file():
                    zf.write(f, f.relative_to(backup_path))
        buf.seek(0)
        return send_file(buf, mimetype='application/zip',
                         as_attachment=True,
                         download_name=f'{backup_id}.zip')
    except Exception as e:
        logger.error(f"Error downloading backup: {e}")
        return jsonify({'error': str(e)}), 500


@bp.route('/api/config/backup/upload', methods=['POST'])
def upload_backup():
    try:
        from app import config_manager
        if 'file' not in request.files:
            return jsonify({'error': 'No file provided'}), 400
        f = request.files['file']
        filename = f.filename or ''
        if filename.endswith('.zip'):
            backup_id = filename[:-4]
        else:
            backup_id = f"backup_{datetime.utcnow().strftime('%Y%m%d_%H%M%S')}"
        backup_id = ''.join(c for c in backup_id if c.isalnum() or c == '_')
        backup_path = config_manager.backup_dir / backup_id
        backup_path.mkdir(parents=True, exist_ok=True)
        try:
            with zipfile.ZipFile(io.BytesIO(f.read())) as zf:
                zf.extractall(backup_path)
        except zipfile.BadZipFile:
            shutil.rmtree(backup_path, ignore_errors=True)
            return jsonify({'error': 'Invalid zip file'}), 400
        if not (backup_path / 'manifest.json').exists():
            shutil.rmtree(backup_path, ignore_errors=True)
            return jsonify({'error': 'Invalid backup: missing manifest.json'}), 400
        return jsonify({'backup_id': backup_id})
    except Exception as e:
        logger.error(f"Error uploading backup: {e}")
        return jsonify({'error': str(e)}), 500


@bp.route('/api/config/backups/<backup_id>', methods=['DELETE'])
def delete_config_backup(backup_id):
    try:
        from app import config_manager
        success = config_manager.delete_backup(backup_id)
        if success:
            return jsonify({"message": f"Backup {backup_id} deleted"})
        return jsonify({"error": f"Failed to delete backup {backup_id}"}), 500
    except Exception as e:
        logger.error(f"Error deleting backup: {e}")
        return jsonify({"error": str(e)}), 500