#!/usr/bin/env bash
# Called by pinix's systemd timer with an agenix-backed EnvironmentFile.
# Update only the existing test/SSH AAAA; never create or delete records.
set -euo pipefail
set +x
public_ip=$(curl -6 --fail --silent --show-error --max-time 20 https://api6.ipify.org)
[[ "$public_ip" =~ ^[23][[:xdigit:]:]+$ && "$public_ip" == *:* ]] || {
  echo 'Refusing a non-global IPv6 response.' >&2
  exit 1
}
api() {
  printf 'Authorization: Bearer %s\n' "$CLOUDFLARE_DNS_API_TOKEN" |
    curl --fail --silent --show-error --max-time 20 -H @- \
      -H 'Content-Type: application/json' "$@"
}
base=https://api.cloudflare.com/client/v4
zone=$(api "$base/zones?name=0ff.space" |
  jq -er 'select(.success) | .result | select(length == 1) | .[0].id')
url="$base/zones/$zone/dns_records/d4365926627a225a9d38bba316474e61"
record=$(api "$url" | jq -ec 'select(.success) | .result |
  select(.name == "ipv6-test.0ff.space" and .type == "AAAA" and .proxied == false)')
if [ "$(jq -r .content <<< "$record")" = "$public_ip" ]; then
  echo "ipv6-test.0ff.space unchanged: $public_ip"
  exit 0
fi
payload=$(jq -nc --arg ip "$public_ip" '{content:$ip,ttl:120}')
api -X PATCH "$url" --data "$payload" |
  jq -e 'select(.success) | {name:.result.name,content:.result.content,ttl:.result.ttl}'