#!/usr/bin/env bash
# =============================================================================
# disable-ipv6.sh v2.0.0
# Completely disable IPv6 on Debian-family Linux with autodetection,
# per-section fault isolation, idempotent writes, and post-change verification.
#
# Targets: Pop!_OS 22.04+, Zorin 17/18, Ubuntu 22.04+, Debian 12/13,
#          MX Linux, LMDE 6/7, Linux Mint 22+
#
# Usage:
#   sudo bash disable-ipv6.sh            apply + verify
#   sudo bash disable-ipv6.sh --verify   verify only (use after reboot)
#   sudo bash disable-ipv6.sh --help
#
# Design notes:
#   * No `set -e` / `set -u` on purpose: one failing section must never abort
#     the rest. An ERR trap logs unexpected failures with line numbers instead.
#   * Every section runs through run_step(), which records PASS/FAIL and always
#     returns success so the script runs to completion.
#   * Writes are idempotent (temp file + cmp): unchanged files are left alone,
#     so re-runs are fast and don't spam backups or rebuild GRUB/initramfs.
#   * A reboot is required for the kernel cmdline change to take effect.
# =============================================================================

if [ -z "${BASH_VERSION:-}" ]; then
    echo "ERROR: this script requires bash. Run: sudo bash $0" >&2
    exit 1
fi

set -o pipefail
set -o errtrace
umask 077

VERSION="2.0.0"
PARAM="ipv6.disable=1"
MODE="apply"
BACKUP_ROOT=""

IN_CONTAINER=0
GRUB_CHANGED=0
MODPROBE_CHANGED=0
NM_CHANGED=0

CRITICAL_FAIL=0
OPTIONAL_FAIL=0
STEPS_OK=0
STEPS_FAIL=0
STEPS_SKIP=0

declare -a REPORT_LINES=()
declare -a SECTION_RESULTS=()

SYSCTL_DROPIN="/etc/sysctl.d/zz-disable-ipv6.conf"
NM_DROPIN="/etc/NetworkManager/conf.d/90-disable-ipv6.conf"
NETPLAN_FILE="/etc/netplan/99-disable-ipv6.yaml"
MODPROBE_FILE="/etc/modprobe.d/disable-ipv6.conf"

# ---- colors -----------------------------------------------------------------
setup_colors() {
    if [[ -n "${NO_COLOR:-}" || ! -t 1 ]]; then
        C_RED=""; C_GRN=""; C_YEL=""; C_BLU=""; C_MAG=""; C_CYN=""
        C_BOLD=""; C_DIM=""; C_NC=""
        return
    fi
    C_RED=$'\033[31m'; C_GRN=$'\033[32m'; C_YEL=$'\033[33m'
    C_BLU=$'\033[34m'; C_MAG=$'\033[35m'; C_CYN=$'\033[36m'
    C_BOLD=$'\033[1m';  C_DIM=$'\033[2m';  C_NC=$'\033[0m'
}

log_info()  { printf '%s[INFO]%s  %s\n'  "$C_CYN" "$C_NC" "$*"; }
log_ok()    { printf '%s[OK]%s    %s\n'  "$C_GRN" "$C_NC" "$*"; STEPS_OK=$((STEPS_OK+1)); }
log_warn()  { printf '%s[WARN]%s  %s\n'  "$C_YEL" "$C_NC" "$*"; }
log_skip()  { printf '%s[SKIP]%s  %s\n'  "$C_DIM" "$C_NC" "$*"; STEPS_SKIP=$((STEPS_SKIP+1)); }
log_error() { printf '%s[ERROR]%s %s\n'  "$C_RED" "$C_NC" "$*"; STEPS_FAIL=$((STEPS_FAIL+1)); }
log_step()  { printf '\n%s%s==> %s%s\n' "$C_BOLD" "$C_MAG" "$*" "$C_NC"; }

trap_err() {
    # Safety net: logs unexpected failures (with line number) but never exits.
    log_warn "Unexpected error at line $1 (exit $2) — continuing."
}

report() {
    # report <CRITICAL|OPTIONAL> <PASS|FAIL|SKIP> <component> <detail>
    local sev="$1" st="$2" name="$3" detail="$4"
    REPORT_LINES+=("$sev|$st|$name|$detail")
    if [[ "$st" == "FAIL" ]]; then
        if [[ "$sev" == "CRITICAL" ]]; then CRITICAL_FAIL=$((CRITICAL_FAIL+1)); fi
        if [[ "$sev" == "OPTIONAL" ]]; then OPTIONAL_FAIL=$((OPTIONAL_FAIL+1)); fi
    fi
}

die()  { log_error "$*"; exit 1; }
have() { command -v "$1" >/dev/null 2>&1; }
is_systemd() { [[ -d /run/systemd/system ]]; }

run_step() {
    # Fault-isolation wrapper: a section may fail; the script never stops.
    local name="$1" fn="$2" rc=0
    log_step "$name"
    "$fn"
    rc=$?
    if [[ $rc -eq 0 ]]; then
        SECTION_RESULTS+=("PASS|$name")
    else
        SECTION_RESULTS+=("FAIL|$name")
        log_warn "Section '$name' reported failures (rc=$rc) — continuing with remaining sections."
    fi
    return 0
}

# ---- usage ------------------------------------------------------------------
usage() {
    cat << 'USAGE'
disable-ipv6.sh — reliably disable IPv6 on Debian-family Linux

Usage:
  sudo bash disable-ipv6.sh              Apply all changes and verify
  sudo bash disable-ipv6.sh --verify     Re-check configs + runtime (post-reboot)
  sudo bash disable-ipv6.sh --help

Layers applied (idempotent; each verified after writing):
  1. Kernel cmdline  ipv6.disable=1   (GRUB/grub.d, kernelstub, or systemd-boot)
  2. sysctl.d drop-in + live sysctl
  3. NetworkManager conf.d + existing connections (nmcli)
  4. netplan (networkd renderer only)
  5. UFW (/etc/default/ufw IPV6=no + /etc/ufw/sysctl.conf)
  6. gai.conf IPv4 precedence
  7. Avahi use-ipv6=no
  8. ConnMan IPv6=false
  9. Postfix inet_protocols=ipv4
 10. modprobe blacklist + initramfs rebuild (only when changed)
 11. ip6tables DROP policies (only if ip6tables already installed)

A reboot is required for the kernel-level disable. Re-run with --verify after.
USAGE
}

# ---- detection --------------------------------------------------------------
ID=""; ID_LIKE=""; VERSION_ID=""; PRETTY_NAME=""
FAMILY=""       # ubuntu | debian | unknown
BOOTLOADER=""   # kernelstub | systemd-boot | grub | unknown
HAS_NM=0; HAS_NETPLAN=0; HAS_NETWORKD=0; HAS_UFW=0
HAS_AVAHI=0; HAS_IFUPDOWN=0; HAS_CONNMAN=0; SYSTEMD=0

load_os_release() {
    [[ -r /etc/os-release ]] || die "Cannot read /etc/os-release — unsupported system."
    # shellcheck disable=SC1091
    . /etc/os-release
    ID="${ID:-unknown}"
    ID_LIKE="${ID_LIKE:-}"
    VERSION_ID="${VERSION_ID:-}"
    PRETTY_NAME="${PRETTY_NAME:-$ID $VERSION_ID}"
}

detect_family() {
    local like=" $ID $ID_LIKE "
    if [[ "$ID" =~ ^(ubuntu|pop|zorin)$ || "$like" == *" ubuntu "* ]]; then
        FAMILY="ubuntu"
    elif [[ "$ID" =~ ^(debian|mx)$ || "$like" == *" debian "* ]]; then
        FAMILY="debian"
    else
        FAMILY="unknown"
    fi
}

distro_supported_hint() {
    case "$ID" in
        pop)
            [[ "$VERSION_ID" == 22.04 || "$VERSION_ID" == 24.04* ]] && return 0 ;;
        zorin)
            [[ "$VERSION_ID" == 17* || "$VERSION_ID" == 18* ]] && return 0 ;;
        ubuntu)
            awk -v v="$VERSION_ID" 'BEGIN{exit !(v+0 >= 22.04)}'
            return $? ;;
        debian)
            [[ "$VERSION_ID" == 12* || "$VERSION_ID" == 13* ]] && return 0 ;;
        mx)
            return 0 ;;
        linuxmint)
            if [[ "$ID_LIKE" == *ubuntu* ]]; then
                awk -v v="$VERSION_ID" 'BEGIN{exit !(v+0 >= 22)}'
                return $?
            fi
            [[ "$VERSION_ID" == 6* || "$VERSION_ID" == 7* ]] && return 0 ;;
    esac
    return 1
}

detect_container() {
    IN_CONTAINER=0
    if have systemd-detect-virt && systemd-detect-virt --quiet --container; then
        IN_CONTAINER=1
    elif [[ -f /.dockerenv || -f /run/.containerenv ]]; then
        IN_CONTAINER=1
    fi
    return 0
}

detect_bootloader() {
    if have kernelstub || [[ -f /etc/kernelstub/configuration ]]; then
        BOOTLOADER="kernelstub"
    elif [[ -d /boot/efi/loader/entries || -d /boot/loader/entries || -d /efi/loader/entries ]]; then
        if have bootctl && bootctl is-installed >/dev/null 2>&1; then
            BOOTLOADER="systemd-boot"
        elif [[ -f /etc/default/grub ]]; then
            BOOTLOADER="grub"
        else
            BOOTLOADER="systemd-boot"
        fi
    elif [[ -f /etc/default/grub ]]; then
        BOOTLOADER="grub"
    else
        BOOTLOADER="unknown"
    fi
}

detect_network() {
    if have nmcli || [[ -f /etc/NetworkManager/NetworkManager.conf ]]; then HAS_NM=1; fi
    if have netplan || [[ -d /etc/netplan ]]; then
        if compgen -G '/etc/netplan/*.yaml' >/dev/null 2>&1 || \
           compgen -G '/etc/netplan/*.yml'  >/dev/null 2>&1; then
            HAS_NETPLAN=1
        fi
    fi
    if is_systemd && have systemctl && systemctl is-enabled systemd-networkd >/dev/null 2>&1; then
        HAS_NETWORKD=1
    fi
    if have ufw || [[ -f /etc/default/ufw ]]; then HAS_UFW=1; fi
    if [[ -f /etc/avahi/avahi-daemon.conf ]]; then HAS_AVAHI=1; fi
    if [[ -f /etc/network/interfaces ]]; then HAS_IFUPDOWN=1; fi
    if have connmanctl || [[ -f /etc/connman/main.conf ]]; then HAS_CONNMAN=1; fi
    if is_systemd; then SYSTEMD=1; fi
}

print_detection() {
    log_step "System autodetection"
    log_info "OS:            $PRETTY_NAME"
    log_info "ID / ID_LIKE:  $ID / ${ID_LIKE:-none}"
    log_info "Family:        $FAMILY"
    log_info "Bootloader:    $BOOTLOADER"
    log_info "systemd:       $([[ $SYSTEMD -eq 1 ]] && echo yes || echo no)"
    log_info "Container:     $([[ $IN_CONTAINER -eq 1 ]] && echo yes || echo no)"
    log_info "NetworkManager:$([[ $HAS_NM -eq 1 ]] && echo yes || echo no)"
    log_info "netplan:       $([[ $HAS_NETPLAN -eq 1 ]] && echo yes || echo no)"
    log_info "networkd:      $([[ $HAS_NETWORKD -eq 1 ]] && echo yes || echo no)"
    log_info "UFW:           $([[ $HAS_UFW -eq 1 ]] && echo yes || echo no)"
    log_info "Avahi:         $([[ $HAS_AVAHI -eq 1 ]] && echo yes || echo no)"
    log_info "ifupdown:      $([[ $HAS_IFUPDOWN -eq 1 ]] && echo yes || echo no)"
    log_info "ConnMan:       $([[ $HAS_CONNMAN -eq 1 ]] && echo yes || echo no)"

    if distro_supported_hint; then
        log_ok "Distro/version is in the tested set."
        report CRITICAL PASS "Distro" "$PRETTY_NAME ($FAMILY / $BOOTLOADER)"
    else
        log_warn "Untested version ($PRETTY_NAME) — proceeding because it is Debian-family."
        report CRITICAL PASS "Distro" "$PRETTY_NAME (untested; debian-family)"
    fi
    if [[ $IN_CONTAINER -eq 1 ]]; then
        log_warn "Container detected: bootloader/initramfs steps will be skipped;"
        log_warn "IPv6 must ultimately be disabled on the container host."
    fi
}

preflight() {
    load_os_release
    detect_family
    [[ "$FAMILY" != "unknown" ]] || die "Not a Debian/Ubuntu-family system (ID=$ID ID_LIKE=$ID_LIKE)."
    detect_container
    detect_bootloader
    detect_network
    print_detection
}

# ---- file helpers -----------------------------------------------------------
backup_file() {
    local f="$1"
    [[ -n "$BACKUP_ROOT" && -f "$f" ]] || return 0
    local dest="$BACKUP_ROOT${f}"
    mkdir -p "$(dirname "$dest")" || return 1
    cp -a "$f" "$dest" || return 1
    log_info "Backup: $f -> $dest"
    return 0
}

write_file_idempotent() {
    # write_file_idempotent <dest> <line1> [line2 ...]
    # rc: 0 = written, 2 = already identical, 1 = error
    local dest="$1"; shift
    local tmp
    tmp="$(mktemp /tmp/disable-ipv6.XXXXXX)" || return 1
    if ! printf '%s\n' "$@" > "$tmp"; then
        rm -f "$tmp"
        return 1
    fi
    if [[ -f "$dest" ]] && cmp -s "$tmp" "$dest"; then
        rm -f "$tmp"
        return 2
    fi
    mkdir -p "$(dirname "$dest")" || { rm -f "$tmp"; return 1; }
    [[ -f "$dest" ]] && backup_file "$dest"
    if mv "$tmp" "$dest"; then
        return 0
    fi
    rm -f "$tmp"
    return 1
}

note_written() {
    # note_written <rc from write_file_idempotent> <path> <label>
    case "$1" in
        0) log_info "Wrote $2" ;;
        2) log_info "$2 already up to date" ;;
        *) log_error "Failed to write $2"; report OPTIONAL FAIL "$3" "write failed: $2" ;;
    esac
}

file_contains() { [[ -f "$1" ]] && grep -Eq -- "$2" "$1"; }

verify_file() {
    # verify_file <CRITICAL|OPTIONAL> <file> <regex> <component>
    # Always returns 0 (report-only) so a failed check can never stop the run.
    local sev="$1" f="$2" pat="$3" name="$4"
    if file_contains "$f" "$pat"; then
        log_ok "Verified $name in $f"
        report "$sev" PASS "$name" "$f matches /$pat/"
    else
        log_error "Verification FAILED: $name ($f missing /$pat/)"
        report "$sev" FAIL "$name" "$f missing /$pat/"
    fi
    return 0
}

# ---- 1) sysctl ---------------------------------------------------------------
apply_sysctl() {
    local wrc=0
    write_file_idempotent "$SYSCTL_DROPIN" \
        '# Written by disable-ipv6.sh — managed file; do not edit.' \
        'net.ipv6.conf.all.disable_ipv6 = 1' \
        'net.ipv6.conf.default.disable_ipv6 = 1' \
        'net.ipv6.conf.lo.disable_ipv6 = 1' || wrc=$?
    note_written $wrc "$SYSCTL_DROPIN" "sysctl drop-in"

    # Neutralize anything in /etc/sysctl.conf that would re-enable IPv6.
    if [[ -f /etc/sysctl.conf ]]; then
        if grep -Eq '^[[:space:]]*net\.ipv6\.conf\.(all|default|lo)\.disable_ipv6[[:space:]]*=[[:space:]]*0' /etc/sysctl.conf; then
            backup_file /etc/sysctl.conf
            sed -i -E 's/^[[:space:]]*(net\.ipv6\.conf\.(all|default|lo)\.disable_ipv6)[[:space:]]*=[[:space:]]*0/\1 = 1/' /etc/sysctl.conf \
                && log_ok "Flipped disable_ipv6=0 entries in /etc/sysctl.conf" \
                || log_error "Failed to edit /etc/sysctl.conf"
        fi
        if ! grep -Eq '^[[:space:]]*net\.ipv6\.conf\.all\.disable_ipv6' /etc/sysctl.conf; then
            backup_file /etc/sysctl.conf
            printf '\n# Added by disable-ipv6.sh\nnet.ipv6.conf.all.disable_ipv6 = 1\nnet.ipv6.conf.default.disable_ipv6 = 1\nnet.ipv6.conf.lo.disable_ipv6 = 1\n' >> /etc/sysctl.conf \
                && log_ok "Appended disable keys to /etc/sysctl.conf" \
                || log_error "Failed to append to /etc/sysctl.conf"
        fi
    fi

    # Apply live (IPv4 is untouched).
    sysctl -w net.ipv6.conf.all.disable_ipv6=1     >/dev/null 2>&1 || true
    sysctl -w net.ipv6.conf.default.disable_ipv6=1 >/dev/null 2>&1 || true
    sysctl -w net.ipv6.conf.lo.disable_ipv6=1      >/dev/null 2>&1 || true
    local p
    for p in /proc/sys/net/ipv6/conf/*/disable_ipv6; do
        [[ -f "$p" ]] || continue
        echo 1 > "$p" 2>/dev/null || true
    done
    if have sysctl; then
        sysctl --system >/dev/null 2>&1 || sysctl -p "$SYSCTL_DROPIN" >/dev/null 2>&1 || true
    fi

    verify_file CRITICAL "$SYSCTL_DROPIN" \
        '^[[:space:]]*net\.ipv6\.conf\.all\.disable_ipv6[[:space:]]*=[[:space:]]*1' \
        "sysctl all.disable_ipv6"
    verify_file CRITICAL "$SYSCTL_DROPIN" \
        '^[[:space:]]*net\.ipv6\.conf\.default\.disable_ipv6[[:space:]]*=[[:space:]]*1' \
        "sysctl default.disable_ipv6"
    verify_file CRITICAL "$SYSCTL_DROPIN" \
        '^[[:space:]]*net\.ipv6\.conf\.lo\.disable_ipv6[[:space:]]*=[[:space:]]*1' \
        "sysctl lo.disable_ipv6"
    return 0
}

verify_sysctl_runtime() {
    if [[ ! -d /proc/sys/net/ipv6 ]]; then
        log_ok "Kernel IPv6 stack absent (/proc/sys/net/ipv6 missing) — fully disabled."
        report CRITICAL PASS "Runtime IPv6 stack" "not present"
        return 0
    fi
    local v
    v="$(cat /proc/sys/net/ipv6/conf/all/disable_ipv6 2>/dev/null || echo unset)"
    if [[ "$v" == "1" ]]; then
        log_ok "Live sysctl net.ipv6.conf.all.disable_ipv6 = 1"
        report CRITICAL PASS "Runtime sysctl" "disable_ipv6=1"
        return 0
    fi
    log_error "Live sysctl disable_ipv6 = $v (expected 1)"
    report CRITICAL FAIL "Runtime sysctl" "disable_ipv6=$v"
    return 1
}

# ---- 2) bootloader -----------------------------------------------------------
grub_has_param() { grep -Eq '^GRUB_CMDLINE_LINUX(_DEFAULT)?=.*ipv6\.disable=1' "$1" 2>/dev/null; }

grub_insert_param() {
    local f="$1" var="$2"
    if grep -Eq "^${var}=.*ipv6\\.disable=1" "$f"; then
        return 0
    fi
    if grep -q "^${var}=" "$f"; then
        # Insert after opening quote, then tidy stray spaces.
        sed -i -E "s/^${var}=\"/${var}=\"${PARAM} /; s/^(${var}=\") +/\1/; s/ +\"$/\"/" "$f"
    fi
}

apply_grub() {
    local grub=/etc/default/grub
    if [[ ! -f "$grub" ]]; then
        log_error "$grub not found"
        report CRITICAL FAIL "GRUB file" "missing $grub"
        return 1
    fi

    if [[ -d /etc/default/grub.d ]]; then
        local wrc=0
        write_file_idempotent /etc/default/grub.d/99-disable-ipv6.cfg \
            '# Written by disable-ipv6.sh' \
            'GRUB_CMDLINE_LINUX="${GRUB_CMDLINE_LINUX:+$GRUB_CMDLINE_LINUX }ipv6.disable=1"' || wrc=$?
        note_written $wrc "/etc/default/grub.d/99-disable-ipv6.cfg" "GRUB drop-in"
        [[ $wrc -eq 0 ]] && GRUB_CHANGED=1
    fi

    # Main file too: Debian/MX/LMDE have no grub.d, and a visible grep succeeds.
    if grub_has_param "$grub"; then
        log_info "$grub already contains $PARAM"
    else
        backup_file "$grub"
        grub_insert_param "$grub" GRUB_CMDLINE_LINUX
        grub_insert_param "$grub" GRUB_CMDLINE_LINUX_DEFAULT
        if ! grep -q '^GRUB_CMDLINE_LINUX=' "$grub"; then
            printf '\nGRUB_CMDLINE_LINUX="ipv6.disable=1"\n' >> "$grub"
        fi
        GRUB_CHANGED=1
    fi

    if grub_has_param "$grub" || file_contains /etc/default/grub.d/99-disable-ipv6.cfg 'ipv6\.disable=1'; then
        log_ok "GRUB configuration includes $PARAM"
        report CRITICAL PASS "GRUB config" "$PARAM present"
    else
        log_error "Failed to add $PARAM to GRUB configuration"
        report CRITICAL FAIL "GRUB config" "insert failed"
        return 1
    fi

    local grub_cfg=""
    if [[ -f /boot/grub/grub.cfg ]]; then
        grub_cfg=/boot/grub/grub.cfg
    elif [[ -f /boot/grub2/grub.cfg ]]; then
        grub_cfg=/boot/grub2/grub.cfg
    fi

    # Skip regeneration when nothing changed and grub.cfg already has the param.
    if [[ $GRUB_CHANGED -eq 0 && -n "$grub_cfg" ]] && grep -q 'ipv6.disable=1' "$grub_cfg"; then
        log_info "Nothing changed and $grub_cfg already has $PARAM — skipping regenerate."
        log_ok "Verified $PARAM inside $grub_cfg"
        report CRITICAL PASS "grub.cfg" "$PARAM present"
        return 0
    fi

    log_info "Regenerating GRUB configuration..."
    local ok=1
    if have update-grub; then
        update-grub && ok=0
    elif have grub-mkconfig && [[ -n "$grub_cfg" ]]; then
        grub-mkconfig -o "$grub_cfg" && ok=0
    else
        log_error "Neither update-grub nor grub-mkconfig is available"
        report CRITICAL FAIL "GRUB regenerate" "tools missing"
        return 1
    fi
    if [[ $ok -ne 0 ]]; then
        log_error "GRUB regeneration command failed"
        report CRITICAL FAIL "GRUB regenerate" "command failed"
        return 1
    fi
    log_ok "GRUB regenerated"
    report CRITICAL PASS "GRUB regenerate" "ok"

    if [[ -n "$grub_cfg" ]]; then
        if grep -q 'ipv6.disable=1' "$grub_cfg"; then
            log_ok "Verified $PARAM inside $grub_cfg"
            report CRITICAL PASS "grub.cfg" "$PARAM present"
        else
            log_error "$PARAM missing from $grub_cfg after regenerate"
            report CRITICAL FAIL "grub.cfg" "param missing after regenerate"
            return 1
        fi
    fi
    return 0
}

apply_kernelstub() {
    log_info "systemd-boot via kernelstub (Pop!_OS path)"
    local already=0
    if file_contains /etc/kernelstub/configuration 'ipv6.disable=1'; then
        already=1
    elif have kernelstub && kernelstub -p 2>/dev/null | grep -q 'ipv6.disable=1'; then
        already=1
    fi

    if [[ $already -eq 1 ]]; then
        log_ok "kernelstub already has $PARAM"
    else
        [[ -f /etc/kernelstub/configuration ]] && backup_file /etc/kernelstub/configuration
        if have kernelstub && kernelstub -a "$PARAM"; then
            log_ok "kernelstub -a $PARAM succeeded"
        else
            log_error "kernelstub -a $PARAM failed"
            report CRITICAL FAIL "kernelstub" "kernelstub -a failed"
            return 1
        fi
    fi

    if file_contains /etc/kernelstub/configuration 'ipv6.disable=1'; then
        log_ok "Verified $PARAM in /etc/kernelstub/configuration"
        report CRITICAL PASS "kernelstub config" "$PARAM present"
    else
        log_warn "Could not confirm kernelstub configuration file contents"
        report OPTIONAL FAIL "kernelstub config" "unconfirmed"
    fi

    local e found=0
    for e in /boot/efi/loader/entries/*.conf /boot/loader/entries/*.conf /efi/loader/entries/*.conf; do
        [[ -f "$e" ]] || continue
        if grep -q 'ipv6.disable=1' "$e"; then found=1; break; fi
    done
    if [[ $found -eq 1 ]]; then
        log_ok "Verified $PARAM in a systemd-boot loader entry"
        report CRITICAL PASS "systemd-boot entry" "$PARAM present"
    else
        log_warn "No loader entry shows $PARAM yet (kernelstub writes entries at kernel-update time)"
        report OPTIONAL FAIL "systemd-boot entry" "not visible yet"
    fi
    return 0
}

apply_systemd_boot_entries() {
    local dir found_dir="" e changed=0 scanned=0
    for dir in /boot/efi/loader/entries /boot/loader/entries /efi/loader/entries; do
        [[ -d "$dir" ]] || continue
        found_dir="$dir"
        for e in "$dir"/*.conf; do
            [[ -f "$e" ]] || continue
            scanned=$((scanned+1))
            if grep -q 'ipv6.disable=1' "$e"; then
                continue
            fi
            backup_file "$e"
            if grep -q '^options ' "$e"; then
                sed -i '/^options / s/[[:space:]]*$/ ipv6.disable=1/' "$e" && changed=$((changed+1))
            else
                printf '\noptions ipv6.disable=1\n' >> "$e" && changed=$((changed+1))
            fi
        done
    done

    if [[ -z "$found_dir" || $scanned -eq 0 ]]; then
        log_error "No systemd-boot loader entries found"
        report CRITICAL FAIL "systemd-boot" "no loader entries"
        return 1
    fi

    local ok=0
    for e in "$found_dir"/*.conf; do
        [[ -f "$e" ]] || continue
        grep -q 'ipv6.disable=1' "$e" && ok=$((ok+1))
    done
    if [[ $ok -ge 1 ]]; then
        log_ok "Patched $changed / verified $ok loader entries in $found_dir"
        report CRITICAL PASS "systemd-boot entries" "$ok contain $PARAM"
        return 0
    fi
    log_error "Loader entries exist but $PARAM is missing"
    report CRITICAL FAIL "systemd-boot entries" "param missing"
    return 1
}

apply_bootloader() {
    if [[ $IN_CONTAINER -eq 1 ]]; then
        log_skip "Container: kernel cmdline is controlled by the host — skipping."
        report CRITICAL SKIP "Bootloader" "container: not applicable"
        return 0
    fi
    case "$BOOTLOADER" in
        kernelstub)    apply_kernelstub ;;
        systemd-boot)  apply_systemd_boot_entries ;;
        grub)          apply_grub ;;
        *)
            log_error "No supported bootloader detected (GRUB / kernelstub / systemd-boot)."
            log_error "Add '$PARAM' to your kernel command line manually."
            report CRITICAL FAIL "Bootloader" "unknown bootloader"
            return 1
            ;;
    esac
}

verify_cmdline_runtime() {
    if [[ -r /proc/cmdline ]] && grep -q 'ipv6.disable=1' /proc/cmdline; then
        log_ok "/proc/cmdline contains $PARAM (kernel-level disable active this boot)"
        report CRITICAL PASS "Live kernel cmdline" "$PARAM"
        return 0
    fi
    if [[ "$MODE" == "verify" ]]; then
        log_error "/proc/cmdline does NOT contain $PARAM — reboot pending or bootloader change did not take."
        report CRITICAL FAIL "Live kernel cmdline" "param missing"
        return 1
    fi
    log_warn "/proc/cmdline does not yet contain $PARAM — expected until reboot."
    report OPTIONAL SKIP "Live kernel cmdline" "reboot required"
    return 0
}

# ---- 3) NetworkManager -------------------------------------------------------
apply_nm() {
    if [[ $HAS_NM -ne 1 ]]; then
        log_skip "NetworkManager not present"
        report OPTIONAL SKIP "NetworkManager" "not installed"
        return 0
    fi

    local wrc=0
    write_file_idempotent "$NM_DROPIN" \
        '# Written by disable-ipv6.sh' \
        '[connection]' \
        'ipv6.method=disabled' || wrc=$?
    note_written $wrc "$NM_DROPIN" "NM conf.d default"
    [[ $wrc -eq 0 ]] && NM_CHANGED=1
    verify_file OPTIONAL "$NM_DROPIN" '^ipv6\.method=disabled' "NM conf.d default"

    if ! have nmcli; then
        log_warn "nmcli not found — drop-in applies to all new connections"
        report OPTIONAL FAIL "nmcli" "binary missing"
        return 0
    fi
    if ! nmcli general status >/dev/null 2>&1; then
        log_warn "NetworkManager daemon not reachable — drop-in written; re-run later to update saved connections."
        report OPTIONAL FAIL "NM daemon" "not running"
        return 0
    fi

    local uuid name okc=0 fail=0
    while IFS=: read -r uuid name; do
        [[ -n "$uuid" ]] || continue
        if nmcli connection modify "$uuid" ipv6.method disabled >/dev/null 2>&1; then
            log_ok "NM connection '${name:-$uuid}' -> ipv6.method=disabled"
            okc=$((okc+1)); NM_CHANGED=1
        else
            log_warn "Could not modify NM connection '${name:-$uuid}'"
            fail=$((fail+1))
        fi
    done < <(nmcli -t -f UUID,NAME connection show 2>/dev/null)

    if [[ $okc -gt 0 && $fail -eq 0 ]]; then
        report OPTIONAL PASS "NM connections" "$okc modified"
    elif [[ $okc -gt 0 ]]; then
        report OPTIONAL FAIL "NM connections" "$okc ok / $fail failed"
    else
        log_info "No saved NM connections modified (drop-in still governs new ones)"
        report OPTIONAL PASS "NM connections" "none saved; drop-in active"
    fi

    if [[ $NM_CHANGED -eq 1 ]]; then
        nmcli connection reload >/dev/null 2>&1 || true
        if is_systemd && systemctl is-active --quiet NetworkManager 2>/dev/null; then
            local dev state
            while IFS=: read -r dev state; do
                [[ "$state" == "connected" && "$dev" != "lo" ]] || continue
                nmcli device reapply "$dev" >/dev/null 2>&1 || true
            done < <(nmcli -t -f DEVICE,STATE device status 2>/dev/null)
        fi
    fi
    return 0
}

# ---- 4) netplan --------------------------------------------------------------
netplan_uses_nm() { grep -RqsE 'renderer:[[:space:]]*NetworkManager' /etc/netplan 2>/dev/null; }

apply_netplan() {
    if [[ $HAS_NETPLAN -ne 1 ]]; then
        log_skip "netplan configs not present"
        report OPTIONAL SKIP "netplan" "not present"
        return 0
    fi
    if netplan_uses_nm; then
        log_skip "netplan renderer is NetworkManager — NM drop-in covers this."
        report OPTIONAL SKIP "netplan" "renderer=NetworkManager"
        return 0
    fi

    local wrc=0
    write_file_idempotent "$NETPLAN_FILE" \
        '# Written by disable-ipv6.sh' \
        'network:' \
        '  version: 2' \
        '  ethernets:' \
        '    disable-ipv6-en:' \
        '      match:' \
        '        name: "en*"' \
        '      dhcp6: false' \
        '      accept-ra: false' \
        '      link-local: [ ipv4 ]' \
        '    disable-ipv6-eth:' \
        '      match:' \
        '        name: "eth*"' \
        '      dhcp6: false' \
        '      accept-ra: false' \
        '      link-local: [ ipv4 ]' || wrc=$?
    note_written $wrc "$NETPLAN_FILE" "netplan drop-in"

    if [[ $wrc -eq 0 ]] && have netplan; then
        if netplan generate 2>/tmp/netplan-ipv6.err; then
            log_ok "netplan generate succeeded (full apply happens at boot)"
            report OPTIONAL PASS "netplan generate" "$NETPLAN_FILE"
        else
            log_error "netplan generate failed — removing $NETPLAN_FILE to keep netplan healthy"
            log_error "$(tr '\n' ' ' < /tmp/netplan-ipv6.err)"
            rm -f "$NETPLAN_FILE"
            report OPTIONAL FAIL "netplan generate" "validation failed; file removed"
            return 0
        fi
    fi
    [[ -f "$NETPLAN_FILE" ]] && verify_file OPTIONAL "$NETPLAN_FILE" 'dhcp6: false' "netplan dhcp6"
    return 0
}

# ---- 5) UFW ------------------------------------------------------------------
apply_ufw() {
    if [[ $HAS_UFW -ne 1 ]]; then
        log_skip "UFW not present"
        report OPTIONAL SKIP "UFW" "not present"
        return 0
    fi
    local f=/etc/default/ufw
    if [[ -f "$f" ]]; then
        if grep -q '^IPV6=no' "$f"; then
            log_info "$f already has IPV6=no"
        else
            backup_file "$f"
            if grep -q '^IPV6=' "$f"; then
                sed -i 's/^IPV6=.*/IPV6=no/' "$f"
            else
                printf '\nIPV6=no\n' >> "$f"
            fi
        fi
        verify_file OPTIONAL "$f" '^IPV6=no' "UFW IPV6=no"
    fi

    # Keep UFW's own sysctl file aligned.
    local ufws=/etc/ufw/sysctl.conf
    if [[ -f "$ufws" ]]; then
        if ! grep -q '^net.ipv6.conf.all.disable_ipv6=1' "$ufws"; then
            backup_file "$ufws"
            printf '\n# Added by disable-ipv6.sh\nnet.ipv6.conf.all.disable_ipv6=1\nnet.ipv6.conf.default.disable_ipv6=1\n' >> "$ufws"
        fi
        verify_file OPTIONAL "$ufws" '^net\.ipv6\.conf\.all\.disable_ipv6=1' "UFW sysctl.conf"
    fi

    if have ufw && ufw status 2>/dev/null | grep -qi 'active'; then
        ufw reload >/dev/null 2>&1 || log_warn "ufw reload failed (non-fatal)"
    fi
    return 0
}

# ---- 6) gai.conf -------------------------------------------------------------
apply_gai() {
    local f=/etc/gai.conf
    if [[ ! -f "$f" ]]; then
        if ! printf '# Written by disable-ipv6.sh\nprecedence ::ffff:0:0/96  100\n' > "$f"; then
            log_error "Cannot write $f"
            report OPTIONAL FAIL "gai.conf" "write failed"
            return 0
        fi
    elif grep -Eq '^[[:space:]]*precedence[[:space:]]+::ffff:0:0/96' "$f"; then
        log_info "$f already prefers IPv4"
    elif grep -Eq '^#[[:space:]]*precedence[[:space:]]+::ffff:0:0/96' "$f"; then
        backup_file "$f"
        sed -i -E 's/^#[[:space:]]*(precedence[[:space:]]+::ffff:0:0\/96[[:space:]]+100)/\1/' "$f"
    else
        backup_file "$f"
        printf '\n# Added by disable-ipv6.sh\nprecedence ::ffff:0:0/96  100\n' >> "$f"
    fi
    # getaddrinfo reads this file as the *calling* user — must be world-readable.
    chmod 0644 "$f" 2>/dev/null || true
    verify_file OPTIONAL "$f" '^[[:space:]]*precedence[[:space:]]+::ffff:0:0/96' "gai.conf IPv4 precedence"
    return 0
}

# ---- 7) Avahi ----------------------------------------------------------------
apply_avahi() {
    if [[ $HAS_AVAHI -ne 1 ]]; then
        log_skip "Avahi not present"
        report OPTIONAL SKIP "Avahi" "not present"
        return 0
    fi
    local f=/etc/avahi/avahi-daemon.conf changed=0
    if grep -q '^use-ipv6=no' "$f"; then
        log_info "$f already disables IPv6"
    else
        backup_file "$f"
        if grep -qE '^#?use-ipv6=' "$f"; then
            sed -i -E 's/^#?use-ipv6=.*/use-ipv6=no/' "$f"
        elif grep -q '^\[server\]' "$f"; then
            sed -i '/^\[server\]/a use-ipv6=no' "$f"
        else
            printf '\n[server]\nuse-ipv6=no\n' >> "$f"
        fi
        changed=1
    fi
    verify_file OPTIONAL "$f" '^use-ipv6=no' "Avahi use-ipv6=no"

    if [[ $changed -eq 1 ]]; then
        if is_systemd; then
            systemctl try-restart avahi-daemon >/dev/null 2>&1 || true
        elif have service; then
            service avahi-daemon restart >/dev/null 2>&1 || true
        fi
    fi
    return 0
}

# ---- 8) ConnMan --------------------------------------------------------------
apply_connman() {
    if [[ $HAS_CONNMAN -ne 1 ]]; then
        log_skip "ConnMan not present"
        report OPTIONAL SKIP "ConnMan" "not present"
        return 0
    fi
    local f=/etc/connman/main.conf
    mkdir -p /etc/connman
    if [[ -f "$f" ]] && grep -q '^IPv6=false' "$f"; then
        log_info "$f already disables IPv6"
    else
        [[ -f "$f" ]] && backup_file "$f"
        if [[ -f "$f" ]] && grep -q '^IPv6=' "$f"; then
            sed -i 's/^IPv6=.*/IPv6=false/' "$f"
        elif [[ -f "$f" ]] && grep -q '^\[General\]' "$f"; then
            sed -i '/^\[General\]/a IPv6=false' "$f"
        else
            printf '\n[General]\nIPv6=false\n' >> "$f"
        fi
    fi
    verify_file OPTIONAL "$f" '^IPv6=false' "ConnMan IPv6=false"
    return 0
}

# ---- 9) Postfix (optional) ---------------------------------------------------
set_postfix_inet_protocols() {
    local f="$1"
    if grep -qE '^[[:space:]]*inet_protocols' "$f"; then
        sed -i -E 's/^[[:space:]]*inet_protocols.*/inet_protocols = ipv4/' "$f"
    else
        printf '\ninet_protocols = ipv4\n' >> "$f"
    fi
}

apply_postfix() {
    local f=/etc/postfix/main.cf
    if [[ ! -f "$f" ]]; then
        log_skip "Postfix not installed"
        report OPTIONAL SKIP "Postfix" "not present"
        return 0
    fi
    if grep -Eq '^[[:space:]]*inet_protocols[[:space:]]*=[[:space:]]*ipv4([[:space:]]|$)' "$f"; then
        log_info "Postfix already uses inet_protocols = ipv4"
    else
        backup_file "$f"
        if have postconf; then
            postconf -e 'inet_protocols = ipv4' >/dev/null 2>&1 || set_postfix_inet_protocols "$f"
        else
            set_postfix_inet_protocols "$f"
        fi
    fi
    verify_file OPTIONAL "$f" '^[[:space:]]*inet_protocols[[:space:]]*=[[:space:]]*ipv4([[:space:]]|$)' "Postfix inet_protocols"
    if is_systemd && systemctl is-active --quiet postfix 2>/dev/null; then
        systemctl restart postfix >/dev/null 2>&1 || log_warn "postfix restart failed (non-fatal)"
    fi
    return 0
}

# ---- 10) modprobe + initramfs ------------------------------------------------
apply_modprobe() {
    if [[ $IN_CONTAINER -eq 1 ]]; then
        log_skip "Container: modprobe/initramfs not applicable"
        report OPTIONAL SKIP "modprobe" "container"
        return 0
    fi
    local wrc=0
    write_file_idempotent "$MODPROBE_FILE" \
        '# Written by disable-ipv6.sh' \
        'options ipv6 disable=1' \
        'alias net-pf-10 off' \
        'alias ipv6 off' \
        'blacklist ipv6' || wrc=$?
    note_written $wrc "$MODPROBE_FILE" "modprobe blacklist"
    [[ $wrc -eq 0 ]] && MODPROBE_CHANGED=1
    verify_file OPTIONAL "$MODPROBE_FILE" '^options ipv6 disable=1' "modprobe ipv6 disable"

    if [[ $MODPROBE_CHANGED -ne 1 ]]; then
        log_info "modprobe config unchanged — skipping initramfs rebuild (fast re-run)"
        return 0
    fi
    if have update-initramfs; then
        log_info "Rebuilding initramfs (only because the modprobe config changed)..."
        if update-initramfs -u; then
            log_ok "initramfs updated"
            report OPTIONAL PASS "initramfs" "update-initramfs -u ok"
        else
            log_warn "update-initramfs -u failed (non-fatal)"
            report OPTIONAL FAIL "initramfs" "update failed"
        fi
    else
        log_skip "update-initramfs not found"
        report OPTIONAL SKIP "initramfs" "tool missing"
    fi
    return 0
}

# ---- 11) ip6tables (optional extra) ------------------------------------------
apply_ip6tables() {
    if [[ $IN_CONTAINER -eq 1 ]]; then
        log_skip "Container: ip6tables needs CAP_NET_ADMIN — skipping"
        report OPTIONAL SKIP "ip6tables" "container"
        return 0
    fi
    if ! have ip6tables; then
        log_skip "ip6tables not installed — skipping (kernel cmdline + sysctl are sufficient)"
        report OPTIONAL SKIP "ip6tables" "not installed"
        return 0
    fi
    ip6tables -P INPUT   DROP 2>/dev/null || true
    ip6tables -P FORWARD DROP 2>/dev/null || true
    # OUTPUT left untouched so local IPv6 sockets don't break mid-session.

    if have netfilter-persistent; then
        mkdir -p /etc/iptables
        if ip6tables-save > /etc/iptables/rules.v6 2>/dev/null; then
            log_ok "Saved ip6tables policies to /etc/iptables/rules.v6"
            report OPTIONAL PASS "ip6tables persist" "/etc/iptables/rules.v6"
        else
            log_warn "ip6tables-save failed"
            report OPTIONAL FAIL "ip6tables persist" "save failed"
        fi
    else
        log_info "netfilter-persistent not installed — ip6tables policy is runtime-only."
        report OPTIONAL PASS "ip6tables runtime" "INPUT/FORWARD DROP (not persisted)"
    fi
    return 0
}

# ---- runtime address check ---------------------------------------------------
verify_addresses() {
    log_step "Runtime address check"
    if ! have ip; then
        log_skip "ip(8) not found"
        report OPTIONAL SKIP "ip -6 addr" "iproute2 missing"
        return 0
    fi
    local addrs
    addrs="$(ip -6 addr show scope global 2>/dev/null | grep -c 'inet6' || true)"
    addrs="${addrs:-0}"
    if [[ "$addrs" == "0" ]]; then
        log_ok "No global IPv6 addresses assigned"
        report CRITICAL PASS "Global IPv6 addresses" "none"
    elif [[ "$MODE" == "verify" ]]; then
        log_error "Still $addrs global IPv6 address(es):"
        ip -6 addr show scope global 2>/dev/null | sed 's/^/          /'
        report CRITICAL FAIL "Global IPv6 addresses" "$addrs present"
    else
        log_warn "Still $addrs global IPv6 address(es) — should clear after NM reapply/reboot."
        ip -6 addr show scope global 2>/dev/null | sed 's/^/          /'
        report OPTIONAL FAIL "Global IPv6 addresses" "$addrs present (reboot pending)"
    fi
    return 0
}

# ---- final report ------------------------------------------------------------
print_report() {
    printf '\n%s%s================ VERIFICATION REPORT ================%s\n' "$C_BOLD" "$C_CYN" "$C_NC"
    printf '%s%-9s %-6s %-30s %s%s\n' "$C_BOLD" "SEV" "STATUS" "COMPONENT" "DETAIL" "$C_NC"
    printf '%s%-9s %-6s %-30s %s%s\n' "$C_DIM" "---------" "------" "------------------------------" "------" "$C_NC"

    local line sev st name detail color
    for line in "${REPORT_LINES[@]}"; do
        IFS='|' read -r sev st name detail <<< "$line"
        case "$st" in
            PASS) color="$C_GRN" ;;
            FAIL) color="$C_RED" ;;
            SKIP) color="$C_YEL" ;;
            *)    color="$C_NC"  ;;
        esac
        printf '%-9s %s%-6s%s %-30s %s\n' "$sev" "$color" "$st" "$C_NC" "$name" "$detail"
    done

    if [[ ${#SECTION_RESULTS[@]} -gt 0 ]]; then
        printf '\n%sSection outcomes:%s\n' "$C_BOLD" "$C_NC"
        local s snm
        for s in "${SECTION_RESULTS[@]}"; do
            IFS='|' read -r st snm <<< "$s"
            if [[ "$st" == "PASS" ]]; then color="$C_GRN"; else color="$C_RED"; fi
            printf '  %s%-5s%s %s\n' "$color" "$st" "$C_NC" "$snm"
        done
    fi

    printf '\n%sSummary:%s OK=%s FAIL=%s SKIP=%s (critical fails=%s, optional fails=%s)\n' \
        "$C_BOLD" "$C_NC" "$STEPS_OK" "$STEPS_FAIL" "$STEPS_SKIP" "$CRITICAL_FAIL" "$OPTIONAL_FAIL"

    [[ -n "$BACKUP_ROOT" && -d "$BACKUP_ROOT" ]] && log_info "Backups saved under $BACKUP_ROOT"

    if [[ "$MODE" == "apply" ]]; then
        echo
        printf '%sNEXT STEP:%s reboot, then run:  %ssudo bash %s --verify%s\n' "$C_YEL" "$C_NC" "$C_BOLD" "$0" "$C_NC"
        printf 'Post-reboot spot checks:\n'
        printf '  cat /proc/cmdline | grep ipv6.disable=1\n'
        printf '  test -d /proc/sys/net/ipv6 && echo STILL_PRESENT || echo IPV6_GONE\n'
        printf '  ip -6 addr show scope global\n'
    fi
}

# ---- verify-only -------------------------------------------------------------
run_verify_only() {
    log_step "Verify-only mode (no changes will be made)"

    verify_file CRITICAL "$SYSCTL_DROPIN" \
        '^[[:space:]]*net\.ipv6\.conf\.all\.disable_ipv6[[:space:]]*=[[:space:]]*1' \
        "sysctl drop-in"
    verify_sysctl_runtime || true
    verify_cmdline_runtime || true

    case "$BOOTLOADER" in
        grub)
            if grub_has_param /etc/default/grub || file_contains /etc/default/grub.d/99-disable-ipv6.cfg 'ipv6\.disable=1'; then
                log_ok "GRUB configuration contains $PARAM"
                report CRITICAL PASS "GRUB config" "param present"
            else
                log_error "GRUB configuration missing $PARAM"
                report CRITICAL FAIL "GRUB config" "param missing"
            fi
            ;;
        kernelstub)
            if file_contains /etc/kernelstub/configuration 'ipv6.disable=1'; then
                log_ok "kernelstub configuration contains $PARAM"
                report CRITICAL PASS "kernelstub" "param present"
            else
                log_error "kernelstub configuration missing $PARAM"
                report CRITICAL FAIL "kernelstub" "param missing"
            fi
            ;;
        systemd-boot)
            local e ok=0
            for e in /boot/efi/loader/entries/*.conf /boot/loader/entries/*.conf /efi/loader/entries/*.conf; do
                [[ -f "$e" ]] || continue
                grep -q 'ipv6.disable=1' "$e" && ok=$((ok+1))
            done
            if [[ $ok -ge 1 ]]; then
                log_ok "$ok loader entry(ies) contain $PARAM"
                report CRITICAL PASS "systemd-boot" "$ok entries"
            else
                log_error "No loader entry contains $PARAM"
                report CRITICAL FAIL "systemd-boot" "missing"
            fi
            ;;
    esac

    if [[ $HAS_NM -eq 1 ]]; then
        verify_file OPTIONAL "$NM_DROPIN" '^ipv6\.method=disabled' "NM conf.d"
    fi
    if [[ -f /etc/default/ufw ]]; then
        verify_file OPTIONAL /etc/default/ufw '^IPV6=no' "UFW IPV6=no"
    fi
    if [[ -f /etc/avahi/avahi-daemon.conf ]]; then
        verify_file OPTIONAL /etc/avahi/avahi-daemon.conf '^use-ipv6=no' "Avahi"
    fi
    if [[ -f /etc/gai.conf ]]; then
        verify_file OPTIONAL /etc/gai.conf '^[[:space:]]*precedence[[:space:]]+::ffff:0:0/96' "gai.conf"
    fi
    if [[ -f /etc/postfix/main.cf ]]; then
        verify_file OPTIONAL /etc/postfix/main.cf '^[[:space:]]*inet_protocols[[:space:]]*=[[:space:]]*ipv4([[:space:]]|$)' "Postfix"
    fi
    if [[ -f "$MODPROBE_FILE" ]]; then
        verify_file OPTIONAL "$MODPROBE_FILE" '^options ipv6 disable=1' "modprobe"
    fi

    verify_addresses
    print_report
}

run_apply() {
    run_step "1) sysctl configuration"            apply_sysctl
    verify_sysctl_runtime || true
    run_step "2) Bootloader kernel cmdline"       apply_bootloader
    verify_cmdline_runtime || true
    run_step "3) NetworkManager"                  apply_nm
    run_step "4) netplan"                         apply_netplan
    run_step "5) UFW"                             apply_ufw
    run_step "6) gai.conf IPv4 precedence"        apply_gai
    run_step "7) Avahi"                           apply_avahi
    run_step "8) ConnMan"                         apply_connman
    run_step "9) Postfix (optional)"              apply_postfix
    run_step "10) modprobe blacklist + initramfs" apply_modprobe
    run_step "11) ip6tables extra layer"          apply_ip6tables
    verify_addresses
    print_report
}

banner() {
    printf '%s%s\n' "$C_BOLD" "=============================================================="
    printf ' disable-ipv6.sh v%s — complete IPv6 disable (Debian family)\n' "$VERSION"
    printf '==============================================================%s\n' "$C_NC"
}

# ---- main --------------------------------------------------------------------
main() {
    setup_colors
    trap 'trap_err "$LINENO" "$?"' ERR

    case "${1:-}" in
        -h|--help)   usage; exit 0 ;;
        --verify)    MODE="verify" ;;
        ""|--apply)  MODE="apply" ;;
        *)           usage; die "Unknown argument: $1" ;;
    esac

    banner
    [[ $EUID -eq 0 ]] || die "This script must be run as root (sudo)."

    if [[ "$MODE" == "apply" ]]; then
        BACKUP_ROOT="/root/ipv6-disable-backup-$(date +%Y%m%d-%H%M%S)"
        mkdir -p "$BACKUP_ROOT" || die "Cannot create backup dir $BACKUP_ROOT"
        log_warn "Disabling IPv6 can break IPv6-only services (some VPNs, k8s, Tailscale, mDNS)."
        log_warn "IPv4 is untouched. File backups go to: $BACKUP_ROOT"
    fi

    preflight

    if [[ "$MODE" == "verify" ]]; then
        run_verify_only
    else
        run_apply
    fi

    echo
    if [[ $CRITICAL_FAIL -gt 0 ]]; then
        printf '%sRESULT: FAILED%s — one or more critical checks did not pass (see report).\n' "$C_RED" "$C_NC"
        exit 1
    fi
    if [[ $OPTIONAL_FAIL -gt 0 ]]; then
        printf '%sRESULT: OK WITH WARNINGS%s — critical path passed; optional items need attention.\n' "$C_YEL" "$C_NC"
        exit 0
    fi
    printf '%sRESULT: SUCCESS%s — all IPv6-disable configs verified.\n' "$C_GRN" "$C_NC"
    exit 0
}

main "$@"