#!/bin/sh
if [ -z "${IPKG_INSTROOT}" ]; then
	# Safety-net stop in case preinst did not run or procd restarted the
	# service between preinst and postinst.
	/etc/init.d/mwan3 stop 2>/dev/null
	# mwan3_prerouting/mwan3_output run at priority mangle + 1, backed by
	# non-destructive vmap-dispatch save/restore so the placement is
	# order-independent w.r.t. pbr. Older installs used mangle - 1.
	# nftables rejects a base chain redeclaration at a different priority,
	# so flush+delete the old chains before start recreates them.
	for chain in mwan3_prerouting mwan3_output; do
		if nft list chain inet fw4 "$chain" 2>/dev/null | grep -q "priority mangle - 1"; then
			nft flush chain inet fw4 "$chain" 2>/dev/null
			nft delete chain inet fw4 "$chain" 2>/dev/null
		fi
	done
	# Drop legacy ip->mark sticky maps (replaced by per-(rule,family,member)
	# ip-only sets). Leftover legacy maps are unreferenced after upgrade
	# but waste a name and confuse status.
	for mapname in $(nft list maps inet 2>/dev/null | awk '$1=="map" && $2 ~ /^mwan3_sticky_v[46]_/ { print $2 }'); do
		nft delete map inet fw4 "$mapname" 2>/dev/null
	done
	# mwan3 now operates in table inet mwan3 rather than table inet fw4.
	# fw4 uses flush-table (not delete-table) on reload, so any mwan3
	# chains/sets left in fw4 survive fw4 reloads and must be explicitly
	# removed.
	for chain in mwan3_prerouting mwan3_output mwan3_postrouting mwan3_ifaces_in mwan3_rules mwan3_connected mwan3_custom mwan3_dynamic; do
		nft flush chain inet fw4 "$chain" 2>/dev/null
		nft delete chain inet fw4 "$chain" 2>/dev/null
	done
	for setname in mwan3_connected_v4 mwan3_connected_v6 mwan3_custom_v4 mwan3_custom_v6 mwan3_dynamic_v4 mwan3_dynamic_v6; do
		nft delete set inet fw4 "$setname" 2>/dev/null
	done
	for mapname in $(nft list maps inet fw4 2>/dev/null | awk '$1=="map" && $2 ~ /^mwan3_sticky_/ { print $2 }'); do
		nft flush map inet fw4 "$mapname" 2>/dev/null
		nft delete map inet fw4 "$mapname" 2>/dev/null
	done
	# Remove stale firewall.mwan3_reload UCI section if present and reload
	# fw4 only if it was. An unconditional fw4 -q reload would trigger
	# queued ifup hotplug events that race with mwan3_create_iface_rules
	# in the init hotplug, producing RTNETLINK "File exists" errors.
	if uci -q delete firewall.mwan3_reload; then
		uci commit firewall
		fw4 -q reload
	fi
	# Migrate any fw4-side set references in mwan3 rules to config ipset
	# declarations in /etc/config/mwan3 (one-shot, idempotent).
	/lib/mwan3/mwan3-migrate-ipset-v4.sh
	rm -f /lib/mwan3/mwan3-migrate-ipset-v4.sh
	/etc/init.d/rpcd restart
	# Second stop immediately before start: procd may have auto-started mwan3
	# when the init script was installed (the first stop above runs before that
	# happens and is therefore a no-op). By this point the auto-start has
	# completed, so this stop calls stop_service and removes its ip rules.
	# Without this, mwan3 start below calls procd_close_service (which tells
	# procd to replace the service instances) but never calls stop_service,
	# so the ip rules from the auto-start are still present when the init
	# hotplug events try to add them again.
	# Auto-enable on fresh install so mwan3 starts at boot without requiring
	# a manual /etc/init.d/mwan3 enable. On upgrade the flag is absent, so
	# an explicit disable by the user is preserved.
	if [ -f /tmp/mwan3_first_install ]; then
		rm -f /tmp/mwan3_first_install
		/etc/init.d/mwan3 enable
	fi
	/etc/init.d/mwan3 stop 2>/dev/null
	/etc/init.d/mwan3 start
fi
exit 0
