<?php
function snowctl_ports_range_normalize($s){
  $s=trim($s);
  $s=str_replace('-' ,':',$s);
  if(!preg_match('~^\d{1,5}:\d{1,5}$~',$s)) return '';
  [$a,$b]=array_map('intval',explode(':',$s,2));
  if($a<1||$b<1||$a>$b||$b>65535) return '';
  return $a.':'.$b;
}
function snowctl_build_flags(array $o){
  $f=[];
  if(!empty($o['broker'])) $f[]='-broker '.escapeshellarg($o['broker']);
  if(!empty($o['stun']))   $f[]='-stun '.escapeshellarg($o['stun']);
  if(!empty($o['range'])){ $r=snowctl_ports_range_normalize($o['range']); if($r!=='') $f[]='-ephemeral-ports-range '.$r; }
  if(!empty($o['unsafe'])) $f[]='-unsafe-logging';
  return implode(' ',$f);
}
function snowctl_override_path(){ return '/etc/systemd/system/snowflake-proxy.service.d/override.conf'; }
function snowctl_apply_override($flags){
  $d=dirname(snowctl_override_path());
  if(!is_dir($d)) @mkdir($d,0755,true);
  $exec='/usr/bin/snowflake-proxy';
  $out="[Service]\nIPAccounting=yes\nExecStart=\nExecStart=$exec $flags\n";
  @file_put_contents(snowctl_override_path(),$out);
  @exec('systemctl daemon-reload 2>/dev/null');
  @exec('systemctl restart snowflake-proxy 2>/dev/null');
  return true;
}