;;; SPDX-License-Identifier: GPL-3.0-or-later
;;; Copyright © 2022-2024 Hilton Chain <hako@ultrarare.space>

(define-module (rosenthal packages networking)
  ;; Utilities
  #:use-module (guix gexp)
  #:use-module ((guix licenses) #:prefix license:)
  #:use-module (guix packages)
  #:use-module (rosenthal utils packages)
  ;; Guix origin methods
  #:use-module (guix git-download)
  #:use-module (rosenthal utils download)
  ;; Guix build systems
  #:use-module (guix build-system go)
  #:use-module (rosenthal build-system go-vendored)
  ;; Guix packages
  #:use-module (gnu packages base)
  #:use-module (gnu packages dns)
  #:use-module (gnu packages freedesktop)
  #:use-module (gnu packages golang)
  #:use-module (gnu packages golang-build)
  #:use-module (gnu packages linux))

(define-public cloudflared
  (package
    (name "cloudflared")
    (version "2026.5.2")
    (source (origin
              (method git-fetch)
              (uri (git-reference
                    (url "https://github.com/cloudflare/cloudflared")
                    (commit version)))
              (file-name (git-file-name name version))
              ;; TODO: Unbundle vendored dependencies.
              ;; (modules '((guix build utils)))
              ;; (snippet '(delete-file-recursively "vendor"))
              (sha256
               (base32
                "092745jrmq6cqgad0cbkq9jiybq9s9by22y7fbr5y2rj7gw01cyy"))))
    (build-system go-vendored-build-system)
    (arguments
     (list #:go go-1.26
           #:install-source? #f
           #:import-path "./cmd/cloudflared"
           #:build-flags
           #~(list (string-append
                    "-ldflags="
                    " -X main.Version=" #$(package-version this-package)
                    " -X github.com/cloudflare/cloudflared/cmd/cloudflared/updater.BuiltForPackageManager=Guix"))
           #:phases
           #~(modify-phases %standard-phases
               (add-after 'install 'install-documentation
                 (lambda _
                   (let ((src "cloudflared_man_template")
                         (dst (string-append #$output "/share/man/man1/cloudflared.1")))
                     (substitute* src
                       (("\\$\\{VERSION\\}") #$(package-version this-package)))
                     (mkdir-p (dirname dst))
                     (copy-file src dst)))))))
    (home-page "https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/")
    (synopsis "Cloudflare Tunnel client")
    (description
     "This package provides the command-line client for Cloudflare Tunnel, a
tunneling daemon that proxies traffic from the Cloudflare network to your
origins.  This daemon sits between Cloudflare network and your origin (e.g. a
webserver).  Cloudflare attracts client requests and sends them to you via
this daemon, without requiring you to poke holes on your firewall --- your
origin can remain as closed as possible.")
    (license license:asl2.0)))

(define-public mihomo
  (package
    (name "mihomo")
    (version "1.19.26")
    (source (origin
              (method git-fetch)
              (uri (git-reference
                    (url "https://github.com/MetaCubeX/mihomo")
                    (commit (string-append "v" version))))
              (file-name (git-file-name name version))
              (sha256
               (base32
                "16vhaq2h67al39k1757vvfgzav8bdkhsa5m5z6km3cw7h6l0rk82"))))
    (build-system go-vendored-build-system)
    (arguments
     (list
      #:go go-1.26
      #:vendor-hash (base32 "0kz38byz4q18234z8i9gbc6728dch8lfzw54spng736x3wql2an9")
      #:tests? (not (%current-target-system)) ;TODO: Run test suite.
      #:install-source? #f
      #:build-flags
      #~(list "-tags" "with_gvisor"
              (string-append
               "-ldflags="
               " -X github.com/metacubex/mihomo/constant.Version="
               #$(package-version this-package)))
      #:phases
      #~(modify-phases %standard-phases
          (delete 'check)
          (add-after 'install 'check
            (lambda* (#:key tests? #:allow-other-keys)
              (when tests?
                (let ((mihomo (in-vicinity #$output "bin/mihomo")))
                  (invoke mihomo "--help")
                  (invoke mihomo "-v"))))))))
    (native-inputs
     (if (%current-target-system)
         (list this-package)
         '()))
    (home-page "https://wiki.metacubex.one/")
    (synopsis "Rule-based proxy")
    (description
     "Mihomo is an anti-censorship proxy application, originally known as
\"Clash Meta\", designed to facilitate secure and flexible internet access.
It supports various protocols, making it a versatile tool for users seeking to
bypass network restrictions." )
    (license license:gpl3+)))

(define-public sing-box
  (package
    (name "sing-box")
    (version "1.13.12")
    (source (origin
              (method git-fetch)
              (uri (git-reference
                    (url "https://github.com/SagerNet/sing-box")
                    (commit (string-append "v" version))))
              (file-name (git-file-name name version))
              (sha256
               (base32
                "0b5hp696dsh0sl1640726wg36cssdllpc903k7v3sn0q6p9zysq0"))))
    (build-system go-vendored-build-system)
    (arguments
     (list
      #:go go-1.26
      #:vendor-hash (base32 "0gzjdjq94vkbsyr2m37wjpd37m4whksgsp4kcmh6j293vfwc83ll")
      #:install-source? #f
      #:import-path "./cmd/sing-box"
      #:build-flags
      #~(list "-tags" (string-join
                       '("with_quic"
                         "with_dhcp"
                         "with_wireguard"
                         "with_tailscale"
                         "with_utls"
                         "with_acme"
                         "with_clash_api"
                         "with_gvisor"))
              (string-append
               "-ldflags="
               " -X github.com/sagernet/sing-box/constant.Version="
               #$(package-version this-package)))
      #:modules
      (cons '(ice-9 match)
            %default-go-vendored-modules)
      #:phases
      #~(modify-phases %standard-phases
          (add-after 'unpack-vendored-dependencies 'set-tailscale-default-wireguard-port
            (lambda _
              ;; See also: https://tailscale.com/kb/1082/firewall-ports
              ;; https://github.com/tailscale/tailscale/blob/51c11a864b1241d1cf1a736fbc94b0f8c76da563/cmd/tailscaled/tailscaled.go#L102
              (substitute* "vendor/github.com/sagernet/tailscale/tsnet/tsnet.go"
                (("s\\.Port") "41641"))))
          (add-after 'install 'install-extras
            (lambda _
              (let ((sing-box
                     (or (which "sing-box")
                         (in-vicinity #$output "bin/sing-box"))))
                (map
                 (match-lambda
                   ((shell . path)
                    (let ((file (in-vicinity #$output path)))
                      (mkdir-p (dirname file))
                      (with-output-to-file file
                        (lambda ()
                          (invoke sing-box "completion" shell))))))
                 '(("bash" . "etc/bash_completion.d/sing-box")
                   ("fish" . "share/fish/vendor_completions.d/sing-box.fish")
                   ("zsh"  . "share/zsh/site-functions/_sing-box")))))))))
    (native-inputs
     (if (%current-target-system)
         (list this-package)
         '()))
    (home-page "https://sing-box.sagernet.org/")
    (synopsis "Universal proxy platform")
    (description
     "@command{sing-box} is a customizable and univsersal proxy platform that
can be used to create network proxy servers, clients and transparent proxies.")
    (license license:gpl3+)))

(define-public socks2http
  (package
    (name "socks2http")
    (version "0.0.0-20160712034938-bafa2cde8eb4")
    (source (origin
              (method git-fetch)
              (uri (git-reference
                    (url "https://github.com/zenhack/socks2http")
                    (commit (go-version->git-ref version))))
              (file-name (git-file-name name version))
              (sha256
               (base32
                "0c388rir9d0cy5vxqxj7m72nra0w5cya4mmgqdcvqmnk2vawdyb9"))))
    (build-system go-build-system)
    (arguments
     (list #:install-source? #f
           #:import-path "github.com/zenhack/socks2http"))
    (inputs (list go-golang-org-x-net))
    (home-page "https://github.com/zenhack/socks2http")
    (synopsis "SOCKS5 to HTTP proxy")
    (description
     "This package provides a simple tool to plumb HTTP proxy requests through
a SOCKS5 proxy.")
    (license license:expat)
    (properties
     '((disable-updater? . #t)))))

(define-public tailscale
  (package
    (name "tailscale")
    (version "1.98.4")
    (source (origin
              (method git-fetch)
              (uri (git-reference
                    (url "https://github.com/tailscale/tailscale")
                    (commit (string-append "v" version))))
              (file-name (git-file-name name version))
              (sha256
               (base32
                "1qbm26hq3gwlm7vrbsjz72ma2c5y9wc6nh1h61ynp7glb678la7f"))
              (patches
               (rosenthal-patches
                "tailscale-set-guix-system-PATH-for-SSH.patch"))
              (modules '((guix build utils)))
              (snippet
               '(begin
                  (delete-file-recursively "tool")
                  (substitute* "net/tstun/tun_linux.go"
                    (("/sbin/(modprobe)" _ cmd) cmd))))))
    (build-system go-vendored-build-system)
    (arguments
     (list
      #:go go-1.26
      #:vendor-hash (base32 "1ffhpdb5lyfgdb1n7sps8zxs85g725ijx7sir6q0h1lk3mflpg4r")
      #:tests? (not (%current-target-system)) ;TODO: Run test suite.
      #:install-source? #f
      #:build-flags
      #~(list "-tags" "ts_include_cli"
              (string-append
               "-ldflags="
               " -X tailscale.com/version.longStamp="
               #$(package-version this-package)
               " -X tailscale.com/version.shortStamp="
               #$(package-version this-package)))
      #:modules
      (cons '(ice-9 match)
            %default-go-vendored-modules)
      #:phases
      #~(modify-phases %standard-phases
          (add-after 'unpack 'patch-references
            (lambda* (#:key inputs #:allow-other-keys)
              (substitute* "client/systray/startup-creator.go"
                (("desktop-file-(install|edit)" all)
                 (search-input-file inputs (in-vicinity "bin" all))))))
          (replace 'build
            (lambda* (#:key build-flags parallel-build? #:allow-other-keys)
              (let* ((njobs (if parallel-build? (parallel-job-count) 1)))
                (setenv "GOMAXPROCS" (number->string njobs))
                (for-each
                 (lambda (pkg)
                   (apply invoke "go" "build" "-ldflags=-s -w" "-trimpath"
                          "-o" (string-append #$output "/bin/" pkg)
                          `(,@build-flags
                            ,(string-append "tailscale.com/cmd/" pkg))))
                 '("derper"
                   "derpprobe"
                   "tailscaled"
                   "tsidp")))))
          (add-after 'install 'install-extras
            (lambda _
              (symlink (in-vicinity #$output "bin/tailscaled")
                       (in-vicinity #$output "bin/tailscale"))
              (let ((tailscale
                     (or (which "tailscale")
                         (in-vicinity #$output "bin/tailscale"))))
                (map
                 (match-lambda
                   ((shell . path)
                    (let ((file (in-vicinity #$output path)))
                      (mkdir-p (dirname file))
                      (with-output-to-file file
                        (lambda ()
                          (invoke tailscale "completion" shell))))))
                 '(("bash" . "etc/bash_completion.d/tailscale")
                   ("fish" . "share/fish/vendor_completions.d/tailscale.fish")
                   ("zsh"  . "share/zsh/site-functions/_tailscale"))))))
          (add-after 'install 'wrap-binaries
            (lambda* (#:key inputs #:allow-other-keys)
              (wrap-program (in-vicinity #$output "bin/tailscaled")
                `("PATH" ":" prefix
                  ,(map (lambda (cmd)
                          (dirname (search-input-file inputs cmd)))
                        '("bin/find"
                          "bin/getent"
                          "bin/modprobe"
                          "sbin/ip"
                          "sbin/iptables"
                          "sbin/resolvconf"
                          "sbin/sysctl"))))))
          (delete 'check)
          (add-after 'install 'check
            (lambda* (#:key tests? #:allow-other-keys)
              (when tests?
                (for-each
                 (lambda (cmd)
                   (invoke (string-append #$output "/bin/" cmd) "--help"))
                 '("derper"
                   "derpprobe"
                   "tailscaled"
                   "tsidp"))))))))
    (native-inputs
     (if (%current-target-system)
         (list this-package)
         '()))
    (inputs
     (list desktop-file-utils
           findutils
           glibc
           iproute
           iptables-nft
           kmod
           openresolv
           procps))
    (home-page "https://tailscale.com/")
    (synopsis "Mesh VPN service utilizing the WireGuard protocol and 2FA")
    (description
     "Tailscale is a mesh VPN service that simplifies the process of securely
connecting devices and services across various networks.  It allows you to
create a private network with minimal configuration and aims to remove the
complexity of building a trusted and secure network.")
    (license license:bsd-3)))
